chore(release): prepare 1.0.0-rc.3

.config/make/lint-fmt.mak

@@ -66,8 +66,8 @@ s3s-footprint-check: ## Check the s3s dependency footprint ratchet stays frozen
 	./scripts/check_s3s_footprint.sh
 
 .PHONY: fips-wording-check
-fips-wording-check: ## Check docs and crates/kms do not over-claim crypto capabilities
-	@echo "📣 Checking cryptographic capability wording guard..."
+fips-wording-check: ## Check outward docs do not make unsupported FIPS claims
+	@echo "📣 Checking FIPS wording guard..."
 	./scripts/check_fips_wording.sh
 
 .PHONY: log-analyzer-rules-check

.github/workflows/ci-docs-only.yml

@@ -117,9 +117,6 @@ jobs:
       - name: Check s3s footprint ratchet
         run: ./scripts/check_s3s_footprint.sh
 
-      - name: Check cryptographic capability wording
-        run: ./scripts/check_fips_wording.sh
-
       - name: Check no planning docs committed
         run: ./scripts/check_no_planning_docs.sh
 

.github/workflows/ci.yml

@@ -152,9 +152,6 @@ jobs:
       - name: Check s3s footprint ratchet
         run: ./scripts/check_s3s_footprint.sh
 
-      - name: Check cryptographic capability wording
-        run: ./scripts/check_fips_wording.sh
-
       - name: Check no planning docs committed
         run: ./scripts/check_no_planning_docs.sh
 

.github/workflows/package.yml

@@ -15,35 +15,28 @@
 # Package Workflow - Build DEB/RPM packages
 #
 # This workflow builds DEB and RPM packages from pre-built Linux binaries
-# and uploads them to Cloudflare R2 and the GitHub release.
+# and uploads them to Cloudflare R2.
 #
 # Trigger:
-# - workflow_run: automatically package after "Build and Release" completes
-#   for a release tag (the mac/windows/linux binaries are already uploaded
-#   to the GitHub release before packaging starts)
-# - workflow_dispatch: manual fallback (backfill / re-run) with optional tag/run_id
+# - release published: automatically package when a GitHub release is published
+# - workflow_dispatch: manual trigger with optional tag/run_id
 #
 # Flow:
-# 1. Resolve the triggering Build workflow run for the release tag
+# 1. Find the Build workflow run for the release tag
 # 2. Download Linux binaries (x86_64-gnu, aarch64-gnu) from build artifacts
 # 3. Build DEB packages for amd64 and arm64
 # 4. Build RPM packages for x86_64 and aarch64
-# 5. Upload all packages to Cloudflare R2 and the GitHub release
+# 5. Upload all packages to Cloudflare R2
 
 name: Package DEB/RPM
 
 permissions:
-  # contents: write is required to upload packages to the GitHub release
-  contents: write
+  contents: read
   actions: read
 
 on:
-  # Follows the same pattern as docker.yml: run after the release build
-  # workflow completes, so packaging is triggered only by release tags
-  # (e.g. 1.0.0-rc.2, 1.0.0-rc.3), never by development builds.
-  workflow_run:
-    workflows: [ "Build and Release" ]
-    types: [ completed ]
+  release:
+    types: [ published ]
   workflow_dispatch:
     inputs:
       tag:
@@ -56,26 +49,13 @@ on:
         type: string
 
 concurrency:
-  group: ${{ github.workflow }}-${{ github.event.workflow_run.head_branch || github.event.inputs.tag || github.run_id }}
+  group: ${{ github.workflow }}-${{ github.event.release.tag_name || github.event.inputs.tag || github.run_id }}
   cancel-in-progress: true
 
-env:
-  HEAD_BRANCH: ${{ github.event.workflow_run.head_branch }}
-  WORKFLOW_RUN_ID: ${{ github.event.workflow_run.id }}
-
 jobs:
   # Resolve which build run to use and extract version info
   resolve:
     name: Resolve Build
-    # Auto-trigger only from successful tag builds of "Build and Release".
-    # Tag pushes arrive as event == push with head_branch != main (a
-    # non-main push head_branch is the release tag name). Manual dispatch
-    # stays available as a fallback for backfills and re-runs.
-    if: >-
-      github.event_name == 'workflow_dispatch' ||
-      (github.event.workflow_run.conclusion == 'success' &&
-       github.event.workflow_run.event == 'push' &&
-       github.event.workflow_run.head_branch != 'main')
     runs-on: ubuntu-latest
     timeout-minutes: 10
     outputs:
@@ -95,8 +75,8 @@ jobs:
           set -euo pipefail
 
           # Determine tag
-          if [[ "${{ github.event_name }}" == "workflow_run" ]]; then
-            TAG="${HEAD_BRANCH}"
+          if [[ "${{ github.event_name }}" == "release" ]]; then
+            TAG="${{ github.event.release.tag_name }}"
           elif [[ -n "$INPUT_TAG" ]]; then
             TAG="$INPUT_TAG"
           else
@@ -113,11 +93,6 @@ jobs:
             BUILD_RUN_ID="$INPUT_RUN_ID"
             echo "Using explicit build run ID: $BUILD_RUN_ID"
 
-          elif [[ "${{ github.event_name }}" == "workflow_run" ]]; then
-            # Use the Build and Release run that triggered this workflow
-            BUILD_RUN_ID="${WORKFLOW_RUN_ID}"
-            echo "Using triggering workflow run: $BUILD_RUN_ID"
-
           elif [[ -n "$TAG" ]]; then
             # Find the build run that produced this tag
             echo "Looking for build run for tag: $TAG"
@@ -481,54 +456,6 @@ jobs:
             echo "✅ Latest packages updated"
           fi
 
-      - name: Upload packages to GitHub Release
-        if: needs.resolve.outputs.tag != ''
-        env:
-          GH_TOKEN: ${{ github.token }}
-        shell: bash
-        run: |
-          set -euo pipefail
-
-          TAG="${{ needs.resolve.outputs.tag }}"
-          DEB_FILE="${{ steps.deb.outputs.deb_file }}"
-          RPM_FILE="${{ steps.rpm.outputs.rpm_file }}"
-
-          # Upload the packages, then refresh the release checksums so the new
-          # assets are covered, matching the binary release flow.
-          for f in "$DEB_FILE" "$RPM_FILE"; do
-            if [[ -n "$f" && -f "$f" ]]; then
-              echo "📤 Uploading $(basename "$f") to GitHub release ${TAG}..."
-              gh release upload "$TAG" "$f" --clobber
-            fi
-          done
-
-          CHECKSUM_DIR="$(mktemp -d)"
-          gh release download "$TAG" -p 'SHA256SUMS' -p 'SHA512SUMS' \
-            -D "$CHECKSUM_DIR" --clobber 2>/dev/null || true
-
-          for spec in "SHA256SUMS:sha256sum" "SHA512SUMS:sha512sum"; do
-            asset="${spec%%:*}"
-            checksum_cmd="${spec##*:}"
-            checksum_file="${CHECKSUM_DIR}/${asset}"
-
-            touch "$checksum_file"
-
-            for f in "$DEB_FILE" "$RPM_FILE"; do
-              if [[ -n "$f" && -f "$f" ]]; then
-                base="$(basename "$f")"
-                # Remove any stale entry, then append the fresh digest
-                grep -Fv -- "$base" "$checksum_file" > "${checksum_file}.tmp" || true
-                mv "${checksum_file}.tmp" "$checksum_file"
-                (cd "$(dirname "$f")" && "$checksum_cmd" -- "$base") >> "$checksum_file"
-              fi
-            done
-
-            echo "📤 Updating ${asset} for release ${TAG}..."
-            gh release upload "$TAG" "$checksum_file" --clobber
-          done
-
-          echo "✅ GitHub release assets updated"
-
   # Summary
   summary:
     name: Summary

ARCHITECTURE.md

@@ -31,7 +31,7 @@ HTTP request
       → storage/ecfs (erasure coding, encryption, checksums)
         → ecstore (disk pool selection, data distribution)
           → rio (reader pipeline: encrypt → compress → hash → write)
-            → io-core (buffer pool, storage profiling, admission control)
+            → io-core (zero-copy I/O, buffer pool, direct I/O)
               → local disk / remote disk via RPC
 ```
 
@@ -55,7 +55,7 @@ rustfs/                      # Workspace root (virtual manifest)
 ├── crates/                  # library crates (authoritative list: Cargo.toml [workspace].members)
 │   ├── ecstore/             # Erasure-coded storage engine
 │   ├── rio/                 # Reader I/O pipeline (encrypt, compress, hash)
-│   ├── io-core/             # Buffer pool, storage profiling, admission control
+│   ├── io-core/             # Zero-copy I/O, scheduling, buffer pool
 │   ├── io-metrics/          # I/O metrics collection
 │   ├── common/              # Shared runtime state, globals, data usage types
 │   ├── config/              # Configuration types and parsing
@@ -302,7 +302,7 @@ The binary (`main.rs`) boots in this order:
               │                  │                  │
         ┌─────▼──────┐    ┌──────▼──────┐    ┌──────▼──────┐
         │  ecstore   │    │     rio     │    │   io-core   │
-        │   (core)   │    │  (readers)  │    │ (buffers)   │
+        │   (core)   │    │  (readers)  │    │ (zero-copy) │
         └─────┬──────┘    └─────────────┘    └─────────────┘
               │
      ┌─────┬──┼──┬─────┬──────┐
@@ -314,7 +314,7 @@ The binary (`main.rs`) boots in this order:
 
 - **"Where does S3 PutObject go?"**
   `server/` routes → `app/object_usecase` validates → `storage/ecfs` encodes →
-  `ecstore` distributes → `rio` encrypts/compresses → `io-core` supplies buffers
+  `ecstore` distributes → `rio` encrypts/compresses → `io-core` writes
 
 - **"Where are bucket policies enforced?"**
   `app/bucket_usecase` calls into `crates/policy/`

Cargo.toml

@@ -69,7 +69,7 @@ edition = "2024"
 license = "Apache-2.0"
 repository = "https://github.com/rustfs/rustfs"
 rust-version = "1.97.1"
-version = "1.0.0-rc.2"
+version = "1.0.0-rc.3"
 homepage = "https://rustfs.com"
 description = "RustFS is a high-performance distributed object storage software built using Rust, one of the most popular languages worldwide. "
 keywords = ["RustFS", "Minio", "object-storage", "filesystem", "s3"]
@@ -86,52 +86,52 @@ redundant_clone = "warn"
 
 [workspace.dependencies]
 # RustFS Internal Crates
-rustfs = { path = "./rustfs", version = "1.0.0-rc.2" }
-rustfs-heal = { path = "crates/heal", version = "1.0.0-rc.2" }
-rustfs-audit = { path = "crates/audit", version = "1.0.0-rc.2" }
-rustfs-checksums = { path = "crates/checksums", version = "1.0.0-rc.2" }
-rustfs-common = { path = "crates/common", version = "1.0.0-rc.2" }
-rustfs-data-usage = { path = "crates/data-usage", version = "1.0.0-rc.2" }
-rustfs-config = { path = "./crates/config", version = "1.0.0-rc.2" }
-rustfs-concurrency = { path = "./crates/concurrency", version = "1.0.0-rc.2" }
-rustfs-credentials = { path = "crates/credentials", version = "1.0.0-rc.2" }
-rustfs-crypto = { path = "crates/crypto", version = "1.0.0-rc.2" }
-rustfs-ecstore = { path = "crates/ecstore", version = "1.0.0-rc.2" }
-rustfs-filemeta = { path = "crates/filemeta", version = "1.0.0-rc.2" }
-rustfs-iam = { path = "crates/iam", version = "1.0.0-rc.2" }
-rustfs-keystone = { path = "crates/keystone", version = "1.0.0-rc.2" }
-rustfs-lifecycle = { path = "crates/lifecycle", version = "1.0.0-rc.2" }
-rustfs-kms = { path = "crates/kms", version = "1.0.0-rc.2" }
-rustfs-lock = { path = "crates/lock", version = "1.0.0-rc.2" }
-rustfs-madmin = { path = "crates/madmin", version = "1.0.0-rc.2" }
-rustfs-notify = { path = "crates/notify", version = "1.0.0-rc.2" }
-rustfs-io-metrics = { path = "crates/io-metrics", version = "1.0.0-rc.2" }
-rustfs-io-core = { path = "crates/io-core", version = "1.0.0-rc.2" }
-rustfs-object-capacity = { path = "crates/object-capacity", version = "1.0.0-rc.2" }
-rustfs-object-data-cache = { path = "crates/object-data-cache", version = "1.0.0-rc.2", default-features = false }
-rustfs-log-analyzer = { path = "crates/log-analyzer", version = "1.0.0-rc.2" }
-rustfs-obs = { path = "crates/obs", version = "1.0.0-rc.2" }
-rustfs-policy = { path = "crates/policy", version = "1.0.0-rc.2" }
-rustfs-protos = { path = "crates/protos", version = "1.0.0-rc.2" }
-rustfs-protocols = { path = "crates/protocols", version = "1.0.0-rc.2" }
-rustfs-replication = { path = "crates/replication", version = "1.0.0-rc.2" }
-rustfs-rio = { path = "crates/rio", version = "1.0.0-rc.2" }
-rustfs-rio-v2 = { path = "crates/rio-v2", version = "1.0.0-rc.2" }
-rustfs-s3-types = { path = "crates/s3-types", version = "1.0.0-rc.2" }
-rustfs-s3-ops = { path = "crates/s3-ops", version = "1.0.0-rc.2" }
-rustfs-s3select-api = { path = "crates/s3select-api", version = "1.0.0-rc.2" }
-rustfs-s3select-query = { path = "crates/s3select-query", version = "1.0.0-rc.2" }
-rustfs-scanner = { path = "crates/scanner", version = "1.0.0-rc.2" }
-rustfs-security-governance = { path = "crates/security-governance", version = "1.0.0-rc.2" }
-rustfs-extension-schema = { path = "crates/extension-schema", version = "1.0.0-rc.2" }
-rustfs-signer = { path = "crates/signer", version = "1.0.0-rc.2" }
-rustfs-storage-api = { path = "crates/storage-api", version = "1.0.0-rc.2" }
-rustfs-trusted-proxies = { path = "crates/trusted-proxies", version = "1.0.0-rc.2" }
-rustfs-targets = { path = "crates/targets", version = "1.0.0-rc.2" }
-rustfs-test-utils = { path = "crates/test-utils", version = "1.0.0-rc.2" }
-rustfs-tls-runtime = { path = "crates/tls-runtime", version = "1.0.0-rc.2" }
-rustfs-utils = { path = "crates/utils", version = "1.0.0-rc.2" }
-rustfs-zip = { path = "./crates/zip", version = "1.0.0-rc.2" }
+rustfs = { path = "./rustfs", version = "1.0.0-rc.3" }
+rustfs-heal = { path = "crates/heal", version = "1.0.0-rc.3" }
+rustfs-audit = { path = "crates/audit", version = "1.0.0-rc.3" }
+rustfs-checksums = { path = "crates/checksums", version = "1.0.0-rc.3" }
+rustfs-common = { path = "crates/common", version = "1.0.0-rc.3" }
+rustfs-data-usage = { path = "crates/data-usage", version = "1.0.0-rc.3" }
+rustfs-config = { path = "./crates/config", version = "1.0.0-rc.3" }
+rustfs-concurrency = { path = "./crates/concurrency", version = "1.0.0-rc.3" }
+rustfs-credentials = { path = "crates/credentials", version = "1.0.0-rc.3" }
+rustfs-crypto = { path = "crates/crypto", version = "1.0.0-rc.3" }
+rustfs-ecstore = { path = "crates/ecstore", version = "1.0.0-rc.3" }
+rustfs-filemeta = { path = "crates/filemeta", version = "1.0.0-rc.3" }
+rustfs-iam = { path = "crates/iam", version = "1.0.0-rc.3" }
+rustfs-keystone = { path = "crates/keystone", version = "1.0.0-rc.3" }
+rustfs-lifecycle = { path = "crates/lifecycle", version = "1.0.0-rc.3" }
+rustfs-kms = { path = "crates/kms", version = "1.0.0-rc.3" }
+rustfs-lock = { path = "crates/lock", version = "1.0.0-rc.3" }
+rustfs-madmin = { path = "crates/madmin", version = "1.0.0-rc.3" }
+rustfs-notify = { path = "crates/notify", version = "1.0.0-rc.3" }
+rustfs-io-metrics = { path = "crates/io-metrics", version = "1.0.0-rc.3" }
+rustfs-io-core = { path = "crates/io-core", version = "1.0.0-rc.3" }
+rustfs-object-capacity = { path = "crates/object-capacity", version = "1.0.0-rc.3" }
+rustfs-object-data-cache = { path = "crates/object-data-cache", version = "1.0.0-rc.3", default-features = false }
+rustfs-log-analyzer = { path = "crates/log-analyzer", version = "1.0.0-rc.3" }
+rustfs-obs = { path = "crates/obs", version = "1.0.0-rc.3" }
+rustfs-policy = { path = "crates/policy", version = "1.0.0-rc.3" }
+rustfs-protos = { path = "crates/protos", version = "1.0.0-rc.3" }
+rustfs-protocols = { path = "crates/protocols", version = "1.0.0-rc.3" }
+rustfs-replication = { path = "crates/replication", version = "1.0.0-rc.3" }
+rustfs-rio = { path = "crates/rio", version = "1.0.0-rc.3" }
+rustfs-rio-v2 = { path = "crates/rio-v2", version = "1.0.0-rc.3" }
+rustfs-s3-types = { path = "crates/s3-types", version = "1.0.0-rc.3" }
+rustfs-s3-ops = { path = "crates/s3-ops", version = "1.0.0-rc.3" }
+rustfs-s3select-api = { path = "crates/s3select-api", version = "1.0.0-rc.3" }
+rustfs-s3select-query = { path = "crates/s3select-query", version = "1.0.0-rc.3" }
+rustfs-scanner = { path = "crates/scanner", version = "1.0.0-rc.3" }
+rustfs-security-governance = { path = "crates/security-governance", version = "1.0.0-rc.3" }
+rustfs-extension-schema = { path = "crates/extension-schema", version = "1.0.0-rc.3" }
+rustfs-signer = { path = "crates/signer", version = "1.0.0-rc.3" }
+rustfs-storage-api = { path = "crates/storage-api", version = "1.0.0-rc.3" }
+rustfs-trusted-proxies = { path = "crates/trusted-proxies", version = "1.0.0-rc.3" }
+rustfs-targets = { path = "crates/targets", version = "1.0.0-rc.3" }
+rustfs-test-utils = { path = "crates/test-utils", version = "1.0.0-rc.3" }
+rustfs-tls-runtime = { path = "crates/tls-runtime", version = "1.0.0-rc.3" }
+rustfs-utils = { path = "crates/utils", version = "1.0.0-rc.3" }
+rustfs-zip = { path = "./crates/zip", version = "1.0.0-rc.3" }
 
 # Async Runtime and Networking
 async-channel = "2.5.0"
@@ -228,9 +228,9 @@ atoi = "3.1.0"
 atomic_enum = "0.3.0"
 aws-config = { version = "1.10.1" }
 aws-credential-types = { version = "1.3.0" }
-aws-sdk-kms = { default-features = false, version = "1.115.0" }
-aws-sdk-s3 = { default-features = false, version = "1.142.0" }
-aws-sdk-sts = { default-features = false, version = "1.111.0" }
+aws-sdk-kms = { default-features = false, version = "1.114.0" }
+aws-sdk-s3 = { default-features = false, version = "1.141.0" }
+aws-sdk-sts = { default-features = false, version = "1.110.0" }
 aws-smithy-http-client = { default-features = false, version = "1.3.0" }
 aws-smithy-runtime-api = { version = "1.14.0" }
 aws-smithy-types = { version = "1.6.2" }
@@ -284,8 +284,8 @@ rayon = "1.12.0"
 reed-solomon-erasure = { package = "rustfs-erasure-codec", version = "8.0.2" }
 reed-solomon-simd = "3.1.0"
 regex = { version = "1.13.1" }
-rumqttc = { package = "rumqttc-next", version = "0.34.0" }
-redis = { version = "1.6.0" }
+rumqttc = { package = "rumqttc-next", version = "0.33.3" }
+redis = { version = "1.5.0" }
 rustify = { version = "0.7", default-features = false }
 rustix = { version = "1.1.4" }
 rust-embed = { version = "8.12.0" }
@@ -313,7 +313,7 @@ tracing-subscriber = { version = "0.3.23" }
 transform-stream = "0.3.1"
 url = "2.5.8"
 urlencoding = "2.1.3"
-uuid = { version = "1.24.1" }
+uuid = { version = "1.24.0" }
 vaultrs = { version = "0.8.0" }
 tar = "0.4.46"
 walkdir = "2.5.0"
@@ -341,7 +341,7 @@ libunftp = { version = "0.23.0" }
 unftp-core = "0.1.0"
 suppaftp = { version = "10.0.1" }
 rcgen = { version = "0.14.9", default-features = false, features = ["aws_lc_rs", "crypto", "pem"] }
-russh = { version = "0.62.7" }
+russh = { version = "0.62.6" }
 russh-sftp = "2.4.0"
 
 # WebDAV
@@ -350,7 +350,7 @@ dav-server = "0.11.0"
 # Performance Analysis and Memory Profiling
 mimalloc = { version = "0.1.52", git = "https://github.com/xonatius/mimalloc_rust.git", rev = "6d4c41bb10c6d9da1d1b6f07b38c4cc051667f11" }
 libmimalloc-sys = { version = "0.1.49", git = "https://github.com/xonatius/mimalloc_rust.git", rev = "6d4c41bb10c6d9da1d1b6f07b38c4cc051667f11", features = ["extended"] }
-hotpath = { version = "0.23.3", default-features = false }
+hotpath = { version = "0.23.2", default-features = false }
 # Snapshot testing for output format regression detection
 insta = { version = "1.48" }
 

README.md

@@ -116,7 +116,7 @@ chown -R 10001:10001 data logs
 docker run -d -p 9000:9000 -p 9001:9001 -v $(pwd)/data:/data -v $(pwd)/logs:/logs rustfs/rustfs:latest
 
 # Using specific version
-docker run -d -p 9000:9000 -p 9001:9001 -v $(pwd)/data:/data -v $(pwd)/logs:/logs rustfs/rustfs:1.0.0-rc.2
+docker run -d -p 9000:9000 -p 9001:9001 -v $(pwd)/data:/data -v $(pwd)/logs:/logs rustfs/rustfs:1.0.0-rc.3
 ```
 
 If you use [podman](https://github.com/containers/podman) instead of docker, you can install the RustFS with the below command

README_ZH.md

@@ -113,7 +113,7 @@ chown -R 10001:10001 data logs
 docker run -d -p 9000:9000 -p 9001:9001 -v $(pwd)/data:/data -v $(pwd)/logs:/logs rustfs/rustfs:latest
 
 # 使用指定版本运行
-docker run -d -p 9000:9000 -p 9001:9001 -v $(pwd)/data:/data -v $(pwd)/logs:/logs rustfs/rustfs:1.0.0-rc.2
+docker run -d -p 9000:9000 -p 9001:9001 -v $(pwd)/data:/data -v $(pwd)/logs:/logs rustfs/rustfs:1.0.0-rc.3
 ```
 
 如果您通过绑定挂载启用 TLS 证书目录，也请用同样方式准备该目录：

_typos.toml

@@ -40,7 +40,6 @@ mak = "mak"
 gae = "gae"
 GAE = "GAE"
 thr = "thr"
-mis = "mis"
 # s3-tests original test names (cannot be changed)
 nonexisted = "nonexisted"
 consts = "consts"

crates/common/Cargo.toml

@@ -42,7 +42,6 @@ chrono = { workspace = true, features = ["serde"] }
 jiff = { workspace = true, features = ["serde"] }
 metrics = { workspace = true }
 serde = { workspace = true, features = ["derive"] }
-smallvec = { workspace = true }
 rmp-serde = { workspace = true }
 s3s = { workspace = true, features = ["minio"] }
 tracing = { workspace = true }

crates/common/src/heal_channel.rs

@@ -224,13 +224,6 @@ pub struct HealOpts {
 pub enum HealAdmissionDropReason {
     QueueFull,
     PolicyDropped,
-    /// HS-06: an admin heal start overlaps (same bucket with mutually
-    /// containing prefixes, or the same erasure set) an already running or
-    /// queued task. Only produced when RUSTFS_HEAL_OVERLAP_POLICY=minio_error.
-    AlreadyRunning,
-    /// HS-06: same as [`Self::AlreadyRunning`] but for paths that merely
-    /// contain (or are contained by) the active task's path.
-    OverlappingPaths,
 }
 
 impl HealAdmissionDropReason {
@@ -238,8 +231,6 @@ impl HealAdmissionDropReason {
         match self {
             Self::QueueFull => "queue_full",
             Self::PolicyDropped => "policy_dropped",
-            Self::AlreadyRunning => "already_running",
-            Self::OverlappingPaths => "overlapping_paths",
         }
     }
 }
@@ -296,9 +287,6 @@ pub enum HealRequestSource {
     Scanner,
     AutoHeal,
     ReadRepair,
-    /// Mission Repair Feed: intents delivered by error paths and replayed
-    /// from the durable MRF journal.
-    Mrf,
 }
 
 impl HealRequestSource {
@@ -309,7 +297,6 @@ impl HealRequestSource {
             Self::Scanner => "scanner",
             Self::AutoHeal => "auto_heal",
             Self::ReadRepair => "read_repair",
-            Self::Mrf => "mrf",
         }
     }
 }
@@ -326,9 +313,6 @@ pub enum HealChannelCommand {
     Query {
         heal_path: String,
         client_token: String,
-        /// Incremental result cursor (HS-06): only items with a sequence
-        /// greater than this are returned; `None` keeps the full snapshot.
-        since_seq: Option<u64>,
         response_tx: oneshot::Sender<Result<HealChannelResponse, String>>,
     },
     /// Cancel heal task
@@ -534,21 +518,10 @@ async fn receive_heal_channel_response(
 
 /// Send heal query request
 pub async fn query_heal_status(heal_path: String, client_token: String) -> Result<HealChannelResponse, String> {
-    query_heal_status_since(heal_path, client_token, None).await
-}
-
-/// Incremental heal query (HS-06): pass the client's last seen sequence
-/// number to receive only newer result items.
-pub async fn query_heal_status_since(
-    heal_path: String,
-    client_token: String,
-    since_seq: Option<u64>,
-) -> Result<HealChannelResponse, String> {
     let (response_tx, response_rx) = oneshot::channel();
     send_heal_command(HealChannelCommand::Query {
         heal_path,
         client_token,
-        since_seq,
         response_tx,
     })
     .await?;

crates/common/src/lib.rs

@@ -17,10 +17,8 @@ pub mod globals;
 pub mod heal_channel;
 pub mod last_minute;
 pub mod metrics;
-pub mod mrf_channel;
 mod readiness;
 pub mod table_catalog;
-pub mod trace_bus;
 
 pub use globals::*;
 pub use readiness::{GlobalReadiness, SystemStage};

crates/common/src/mrf_channel.rs

@@ -1,203 +0,0 @@
-// Copyright 2024 RustFS Team
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-//! Mission Repair Feed (MRF) intent channel.
-//!
-//! Producers on error paths (read decode failure, scanner metadata
-//! corruption, partial-write recovery) hand a lightweight [`MrfIntent`] to the
-//! heal crate through a global bounded channel. Delivery is strictly
-//! non-blocking: `try_send_mrf_intent` never awaits and drops the intent
-//! (counting it) when the channel is full or uninitialized — losing one heal
-//! hint is always preferred over stalling an IO path. Durable replay of
-//! unconsumed intents is the consumer's job (see `rustfs-heal`
-//! `heal::mrf_queue`), mirroring MinIO's `.heal/mrf/list.bin`.
-
-use std::sync::{
-    Arc, OnceLock,
-    atomic::{AtomicBool, Ordering},
-};
-use tokio::sync::mpsc;
-use uuid::Uuid;
-
-/// Bounded capacity of the global MRF channel. Backpressure is resolved by
-/// dropping (and counting) intents, never by blocking the producer.
-const MRF_CHANNEL_CAPACITY: usize = 8192;
-
-/// Why an intent was produced. Drives the heal priority mapping on the
-/// consumer side (DecodeFailure -> Urgent, MetadataCorruption -> High,
-/// PartialWrite -> Normal).
-#[derive(Clone, Copy, Debug, PartialEq, Eq)]
-pub enum MrfKind {
-    /// Erasure decode failed while serving a read (read path).
-    DecodeFailure,
-    /// Scanner classified object metadata as corrupt.
-    MetadataCorruption,
-    /// A write left the object with fewer committed shards than the set size.
-    PartialWrite,
-}
-
-impl MrfKind {
-    pub const fn as_str(self) -> &'static str {
-        match self {
-            MrfKind::DecodeFailure => "decode-failure",
-            MrfKind::MetadataCorruption => "metadata-corruption",
-            MrfKind::PartialWrite => "partial-write",
-        }
-    }
-}
-
-/// One repair intent. Kept deliberately small so the in-memory queue and the
-/// journal stay bounded; `bucket`/`object` are `Arc<str>` so re-arming an
-/// intent never re-allocates the strings.
-#[derive(Clone, Debug)]
-pub struct MrfIntent {
-    pub bucket: Arc<str>,
-    pub object: Arc<str>,
-    /// Version the intent targets, as raw UUID bytes.
-    pub version_id: Option<[u8; 16]>,
-    pub kind: MrfKind,
-    pub enqueued_at_ms: u64,
-    /// Times this intent has already been offered to the heal manager.
-    /// Dropped by the consumer once it reaches `MRF_MAX_ATTEMPTS`.
-    pub attempts: u8,
-}
-
-/// Consumer-side retry ceiling before an intent is given up on.
-pub const MRF_MAX_ATTEMPTS: u8 = 3;
-
-impl MrfIntent {
-    /// Rough in-memory footprint used by the queue's byte budget.
-    pub fn estimated_bytes(&self) -> usize {
-        // Struct + strings + version bytes; buckets and objects are usually
-        // far below this bound, so rounding up keeps the budget conservative.
-        64 + self.bucket.len() + self.object.len()
-    }
-}
-
-static GLOBAL_MRF_SENDER: OnceLock<mpsc::Sender<MrfIntent>> = OnceLock::new();
-
-/// Delivery kill-switch, set from `RUSTFS_HEAL_MRF_ENABLE`. Producers check
-/// this before touching the channel so the disabled path stays allocation- and
-/// sync-free.
-static MRF_DELIVERY_ENABLED: AtomicBool = AtomicBool::new(true);
-
-/// Override delivery (used at heal-runtime startup from configuration).
-pub fn set_mrf_delivery_enabled(enabled: bool) {
-    MRF_DELIVERY_ENABLED.store(enabled, Ordering::Relaxed);
-}
-
-/// Whether producers currently deliver intents.
-pub fn mrf_delivery_enabled() -> bool {
-    MRF_DELIVERY_ENABLED.load(Ordering::Relaxed)
-}
-
-/// Create the global MRF channel and return the consumer half. Fails if the
-/// channel is already initialized (the heal runtime is a singleton).
-pub fn init_mrf_channel() -> Result<mpsc::Receiver<MrfIntent>, &'static str> {
-    let (sender, receiver) = mpsc::channel(MRF_CHANNEL_CAPACITY);
-    GLOBAL_MRF_SENDER
-        .set(sender)
-        .map_err(|_| "MRF channel sender already initialized")?;
-    Ok(receiver)
-}
-
-/// Best-effort, non-blocking intent delivery from an error path.
-///
-/// Returns `true` when the intent was accepted into the channel. `false`
-/// means the intent was dropped (feature disabled, channel not yet
-/// initialized, or channel full) — callers must not retry or await; the
-/// existing read-repair / scanner heal paths remain the safety net.
-///
-/// This runs on IO error paths, so it stays synchronous and cheap: one
-/// bounded allocation for the two `Arc<str>` handles plus the channel slot.
-pub fn try_send_mrf_intent(kind: MrfKind, bucket: &str, object: &str, version_id: Option<Uuid>) -> bool {
-    if !mrf_delivery_enabled() {
-        return false;
-    }
-    let Some(sender) = GLOBAL_MRF_SENDER.get() else {
-        return false;
-    };
-    let intent = MrfIntent {
-        bucket: Arc::from(bucket),
-        object: Arc::from(object),
-        version_id: version_id.map(|vid| *vid.as_bytes()),
-        kind,
-        enqueued_at_ms: unix_now_ms(),
-        attempts: 0,
-    };
-    sender.try_send(intent).is_ok()
-}
-
-fn unix_now_ms() -> u64 {
-    // Kept trivial: the timestamp is diagnostic metadata only; wall-clock
-    // failure would be a bug rather than something to handle here.
-    std::time::SystemTime::now()
-        .duration_since(std::time::UNIX_EPOCH)
-        .map(|d| d.as_millis() as u64)
-        .unwrap_or(0)
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    #[test]
-    fn intents_estimate_is_conservative() {
-        let intent = MrfIntent {
-            bucket: Arc::from("bucket"),
-            object: Arc::from("object"),
-            version_id: Some([0u8; 16]),
-            kind: MrfKind::DecodeFailure,
-            enqueued_at_ms: 0,
-            attempts: 0,
-        };
-        assert!(intent.estimated_bytes() >= intent.bucket.len() + intent.object.len());
-    }
-
-    #[tokio::test]
-    async fn try_send_delivers_and_respects_capacity() {
-        let mut receiver = init_mrf_channel().expect("first initialization should succeed");
-        assert!(init_mrf_channel().is_err(), "double initialization must fail");
-
-        assert!(try_send_mrf_intent(MrfKind::DecodeFailure, "b", "o", Some(Uuid::nil())));
-        let intent = receiver.recv().await.expect("intent should arrive");
-        assert_eq!(intent.kind, MrfKind::DecodeFailure);
-        assert_eq!(intent.bucket.as_ref(), "b");
-
-        // Disable delivery: producers become no-ops.
-        set_mrf_delivery_enabled(false);
-        assert!(!try_send_mrf_intent(MrfKind::PartialWrite, "b", "o", None));
-        set_mrf_delivery_enabled(true);
-
-        // Fill the bounded channel past capacity: excess intents are dropped,
-        // never blocking.
-        let mut accepted = 0;
-        for _ in 0..(MRF_CHANNEL_CAPACITY + 64) {
-            if try_send_mrf_intent(MrfKind::PartialWrite, "b", "o", None) {
-                accepted += 1;
-            }
-        }
-        assert_eq!(accepted, MRF_CHANNEL_CAPACITY);
-    }
-
-    #[test]
-    fn try_send_without_channel_is_false() {
-        // This test may run after the tokio test above in the same process;
-        // the singleton semantics make a clean "uninitialized" case hard, so
-        // assert the flag-off behavior only.
-        set_mrf_delivery_enabled(false);
-        assert!(!try_send_mrf_intent(MrfKind::MetadataCorruption, "b", "o", None));
-        set_mrf_delivery_enabled(true);
-    }
-}

crates/common/src/trace_bus.rs

@@ -1,333 +0,0 @@
-// Copyright 2024 RustFS Team
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-use smallvec::SmallVec;
-use std::{
-    sync::{
-        Arc, OnceLock,
-        atomic::{AtomicUsize, Ordering},
-    },
-    time::{Duration, SystemTime},
-};
-use tokio::sync::broadcast;
-
-const DEFAULT_TRACE_BUS_CAPACITY: usize = 1024;
-const TRACE_ATTR_INLINE_CAPACITY: usize = 8;
-
-static GLOBAL_TRACE_BUS: OnceLock<TraceBus> = OnceLock::new();
-
-#[derive(Debug, Clone, Copy, PartialEq, Eq)]
-pub enum TraceKind {
-    Heal,
-    Scanner,
-}
-
-impl TraceKind {
-    pub const fn as_str(self) -> &'static str {
-        match self {
-            Self::Heal => "heal",
-            Self::Scanner => "scanner",
-        }
-    }
-}
-
-#[derive(Debug, Clone, Copy, PartialEq, Eq)]
-pub enum TraceFunc {
-    HealTask,
-    HealBucket,
-    HealObject,
-    HealCheckAbandonedParts,
-    HealErasureSetPage,
-    ScannerFolder,
-    ScannerIlmAction,
-    ScannerHealCandidate,
-    Dropped,
-}
-
-impl TraceFunc {
-    pub const fn as_str(self) -> &'static str {
-        match self {
-            Self::HealTask => "heal.Task",
-            Self::HealBucket => "heal.Bucket",
-            Self::HealObject => "heal.Object",
-            Self::HealCheckAbandonedParts => "heal.CheckAbandonedParts",
-            Self::HealErasureSetPage => "heal.ErasureSetPage",
-            Self::ScannerFolder => "scanner.Folder",
-            Self::ScannerIlmAction => "scanner.IlmAction",
-            Self::ScannerHealCandidate => "scanner.HealCandidate",
-            Self::Dropped => "trace.Dropped",
-        }
-    }
-}
-
-#[derive(Debug, Clone, PartialEq, Eq)]
-pub enum TraceVal {
-    Bool(bool),
-    U64(u64),
-    I64(i64),
-    Str(Arc<str>),
-}
-
-impl From<bool> for TraceVal {
-    fn from(value: bool) -> Self {
-        Self::Bool(value)
-    }
-}
-
-impl From<u64> for TraceVal {
-    fn from(value: u64) -> Self {
-        Self::U64(value)
-    }
-}
-
-impl From<i64> for TraceVal {
-    fn from(value: i64) -> Self {
-        Self::I64(value)
-    }
-}
-
-impl From<&str> for TraceVal {
-    fn from(value: &str) -> Self {
-        Self::Str(Arc::from(value))
-    }
-}
-
-impl From<String> for TraceVal {
-    fn from(value: String) -> Self {
-        Self::Str(Arc::from(value))
-    }
-}
-
-#[derive(Debug, Clone, PartialEq, Eq)]
-pub struct TraceAttr {
-    pub key: &'static str,
-    pub value: TraceVal,
-}
-
-#[derive(Debug, Clone, PartialEq, Eq)]
-pub struct TraceEvent {
-    pub kind: TraceKind,
-    pub func: TraceFunc,
-    pub time: SystemTime,
-    pub bucket: Option<Arc<str>>,
-    pub object: Option<Arc<str>>,
-    pub duration: Duration,
-    pub bytes: u64,
-    pub attrs: SmallVec<[TraceAttr; TRACE_ATTR_INLINE_CAPACITY]>,
-}
-
-impl TraceEvent {
-    pub fn new(kind: TraceKind, func: TraceFunc) -> Self {
-        Self {
-            kind,
-            func,
-            time: SystemTime::now(),
-            bucket: None,
-            object: None,
-            duration: Duration::ZERO,
-            bytes: 0,
-            attrs: SmallVec::new(),
-        }
-    }
-
-    pub fn with_bucket(mut self, bucket: impl Into<Arc<str>>) -> Self {
-        self.bucket = Some(bucket.into());
-        self
-    }
-
-    pub fn with_object(mut self, object: impl Into<Arc<str>>) -> Self {
-        self.object = Some(object.into());
-        self
-    }
-
-    pub fn with_duration(mut self, duration: Duration) -> Self {
-        self.duration = duration;
-        self
-    }
-
-    pub fn with_bytes(mut self, bytes: u64) -> Self {
-        self.bytes = bytes;
-        self
-    }
-
-    pub fn with_attr(mut self, key: &'static str, value: impl Into<TraceVal>) -> Self {
-        self.attrs.push(TraceAttr {
-            key,
-            value: value.into(),
-        });
-        self
-    }
-}
-
-#[derive(Debug)]
-pub struct TraceBus {
-    sender: broadcast::Sender<Arc<TraceEvent>>,
-    subscriber_count: Arc<AtomicUsize>,
-}
-
-impl TraceBus {
-    pub fn new(capacity: usize) -> Self {
-        let capacity = capacity.max(1);
-        let (sender, _receiver) = broadcast::channel(capacity);
-        Self {
-            sender,
-            subscriber_count: Arc::new(AtomicUsize::new(0)),
-        }
-    }
-
-    pub fn subscriber_count(&self) -> usize {
-        self.subscriber_count.load(Ordering::Acquire)
-    }
-
-    pub fn subscribe(&self) -> TraceSubscription {
-        let receiver = self.sender.subscribe();
-        self.subscriber_count.fetch_add(1, Ordering::AcqRel);
-        TraceSubscription {
-            receiver,
-            subscriber_count: Arc::clone(&self.subscriber_count),
-        }
-    }
-
-    pub fn emit(&self, build: impl FnOnce() -> TraceEvent) -> bool {
-        if self.subscriber_count() == 0 {
-            return false;
-        }
-
-        self.sender.send(Arc::new(build())).is_ok()
-    }
-}
-
-impl Default for TraceBus {
-    fn default() -> Self {
-        Self::new(DEFAULT_TRACE_BUS_CAPACITY)
-    }
-}
-
-#[derive(Debug)]
-pub struct TraceSubscription {
-    receiver: broadcast::Receiver<Arc<TraceEvent>>,
-    subscriber_count: Arc<AtomicUsize>,
-}
-
-impl TraceSubscription {
-    pub async fn recv(&mut self) -> Result<Arc<TraceEvent>, broadcast::error::RecvError> {
-        self.receiver.recv().await
-    }
-
-    pub fn try_recv(&mut self) -> Result<Arc<TraceEvent>, broadcast::error::TryRecvError> {
-        self.receiver.try_recv()
-    }
-}
-
-impl Drop for TraceSubscription {
-    fn drop(&mut self) {
-        self.subscriber_count.fetch_sub(1, Ordering::AcqRel);
-    }
-}
-
-pub fn global_trace_bus() -> &'static TraceBus {
-    GLOBAL_TRACE_BUS.get_or_init(TraceBus::default)
-}
-
-pub fn subscribe_trace_events() -> TraceSubscription {
-    global_trace_bus().subscribe()
-}
-
-pub fn trace_emit(build: impl FnOnce() -> TraceEvent) -> bool {
-    global_trace_bus().emit(build)
-}
-
-pub fn trace_subscriber_count() -> usize {
-    global_trace_bus().subscriber_count()
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use std::sync::atomic::AtomicUsize;
-
-    #[test]
-    fn trace_emit_skips_builder_without_subscribers() {
-        let bus = TraceBus::new(4);
-        let built = AtomicUsize::new(0);
-
-        let sent = bus.emit(|| {
-            built.fetch_add(1, Ordering::Relaxed);
-            TraceEvent::new(TraceKind::Heal, TraceFunc::HealTask)
-        });
-
-        assert!(!sent);
-        assert_eq!(built.load(Ordering::Relaxed), 0);
-    }
-
-    #[tokio::test]
-    async fn trace_subscriber_receives_event() {
-        let bus = TraceBus::new(4);
-        let mut subscription = bus.subscribe();
-
-        assert!(bus.emit(|| {
-            TraceEvent::new(TraceKind::Heal, TraceFunc::HealObject)
-                .with_bucket("bucket")
-                .with_object("object")
-                .with_duration(Duration::from_millis(7))
-                .with_bytes(11)
-                .with_attr("dry", true)
-        }));
-
-        let event = subscription
-            .recv()
-            .await
-            .expect("subscriber should receive emitted trace event");
-
-        assert_eq!(event.kind, TraceKind::Heal);
-        assert_eq!(event.func, TraceFunc::HealObject);
-        assert_eq!(event.bucket.as_deref(), Some("bucket"));
-        assert_eq!(event.object.as_deref(), Some("object"));
-        assert_eq!(event.duration, Duration::from_millis(7));
-        assert_eq!(event.bytes, 11);
-        assert_eq!(
-            event.attrs.as_slice(),
-            &[TraceAttr {
-                key: "dry",
-                value: TraceVal::Bool(true)
-            }]
-        );
-    }
-
-    #[test]
-    fn trace_subscription_drop_decrements_count() {
-        let bus = TraceBus::new(4);
-        let subscription = bus.subscribe();
-
-        assert_eq!(bus.subscriber_count(), 1);
-        drop(subscription);
-        assert_eq!(bus.subscriber_count(), 0);
-    }
-
-    #[tokio::test]
-    async fn lagged_subscriber_drops_events_without_blocking_publishers() {
-        let bus = TraceBus::new(2);
-        let mut subscription = bus.subscribe();
-
-        for index in 0_u64..4 {
-            assert!(bus.emit(|| { TraceEvent::new(TraceKind::Scanner, TraceFunc::ScannerFolder).with_attr("index", index) }));
-        }
-
-        let err = subscription
-            .recv()
-            .await
-            .expect_err("receiver should observe lag instead of blocking publishers");
-        assert!(matches!(err, broadcast::error::RecvError::Lagged(_)));
-    }
-}

crates/concurrency/src/backpressure.rs

@@ -14,8 +14,9 @@
 
 //! Shared backpressure policy type.
 //!
-//! This module only carries the watermark policy; the admission primitive it
-//! projects into lives in `rustfs-io-core`.
+//! The runtime backpressure implementation (byte-watermark pipes and
+//! monitors) lives in `rustfs/src/storage/backpressure.rs`; this module only
+//! carries the watermark policy type that implementation shares.
 
 use rustfs_io_core::BackpressureConfig as CoreBackpressureConfig;
 

crates/config/src/constants/heal.rs

@@ -177,40 +177,3 @@ pub const DEFAULT_HEAL_MAINLINE_WRITE_UTILIZATION_HIGH_PERCENT: usize = 80;
 
 /// Default foreground pressure recheck delay for heal scheduler, in milliseconds.
 pub const DEFAULT_HEAL_MAINLINE_MAX_SLEEP_MS: u64 = 250;
-
-/// Environment variable that toggles the MRF (mission repair feed) intent
-/// pipeline: error paths deliver repair intents to the heal runtime, and
-/// unconsumed intents are replayed from the durable journal after a restart.
-pub const ENV_HEAL_MRF_ENABLE: &str = "RUSTFS_HEAL_MRF_ENABLE";
-
-/// Environment variable for the MRF in-memory queue capacity (intent count).
-pub const ENV_HEAL_MRF_QUEUE_SIZE: &str = "RUSTFS_HEAL_MRF_QUEUE_SIZE";
-
-/// Environment variable for the MRF journal byte budget. The journal is
-/// compacted once its on-disk size crosses this bound.
-pub const ENV_HEAL_MRF_JOURNAL_MAX_BYTES: &str = "RUSTFS_HEAL_MRF_JOURNAL_MAX_BYTES";
-
-/// Environment variable for the MRF journal replay batch size (intents per
-/// replay push round).
-pub const ENV_HEAL_MRF_REPLAY_BATCH: &str = "RUSTFS_HEAL_MRF_REPLAY_BATCH";
-
-/// Default behavior keeps the MRF intent pipeline enabled.
-pub const DEFAULT_HEAL_MRF_ENABLE: bool = true;
-
-/// Default MRF queue capacity (matches MinIO's 100k MRF list ceiling).
-pub const DEFAULT_HEAL_MRF_QUEUE_SIZE: usize = 100_000;
-
-/// Default MRF journal byte budget (8 MiB), mirroring the channel payload cap.
-pub const DEFAULT_HEAL_MRF_JOURNAL_MAX_BYTES: usize = 8 * 1024 * 1024;
-
-/// Default MRF replay batch size.
-pub const DEFAULT_HEAL_MRF_REPLAY_BATCH: usize = 256;
-
-/// Environment variable selecting how admin heal starts behave when the
-/// requested path overlaps an already running or queued heal: `merge`
-/// (default, keep today's dedup/merge semantics) or `minio_error` (return a
-/// typed already-running / overlapping-paths rejection like madmin).
-pub const ENV_HEAL_OVERLAP_POLICY: &str = "RUSTFS_HEAL_OVERLAP_POLICY";
-
-/// Default overlap policy: merge duplicate/overlapping requests.
-pub const DEFAULT_HEAL_OVERLAP_POLICY: &str = "merge";

crates/config/src/constants/object.rs

@@ -234,31 +234,6 @@ pub const ENV_OBJECT_DISK_WRITE_ABSOLUTE_CAP: &str = "RUSTFS_OBJECT_DISK_WRITE_A
 /// Default absolute per-object erasure write cap in seconds (`0` = disabled).
 pub const DEFAULT_OBJECT_DISK_WRITE_ABSOLUTE_CAP: u64 = 0;
 
-/// Enable foreground PutObject request admission.
-///
-/// This is an experimental, default-off foreground write backpressure gate for
-/// strict commit tail investigations. When disabled, PUTs follow the legacy
-/// path and only the existing request counters are updated.
-pub const ENV_PUT_FOREGROUND_ADMISSION_ENABLE: &str = "RUSTFS_PUT_FOREGROUND_ADMISSION_ENABLE";
-pub const DEFAULT_PUT_FOREGROUND_ADMISSION_ENABLE: bool = false;
-
-/// Maximum foreground PutObject requests admitted concurrently per process.
-///
-/// The limit is used only when [`ENV_PUT_FOREGROUND_ADMISSION_ENABLE`] is true.
-/// A value of `0` disables the gate even when the enable flag is present, so a
-/// partially configured rollout cannot reject every PUT.
-pub const ENV_PUT_FOREGROUND_ADMISSION_LIMIT: &str = "RUSTFS_PUT_FOREGROUND_ADMISSION_LIMIT";
-pub const DEFAULT_PUT_FOREGROUND_ADMISSION_LIMIT: usize = 0;
-
-/// Time in milliseconds a foreground PutObject waits for an admission permit.
-///
-/// Once this timeout expires the request fails before body ingest/storage
-/// mutation with S3 `SlowDown`/503. `0` means fail fast when the limit is full.
-pub const ENV_PUT_FOREGROUND_ADMISSION_WAIT_TIMEOUT_MS: &str = "RUSTFS_PUT_FOREGROUND_ADMISSION_WAIT_TIMEOUT_MS";
-pub const DEFAULT_PUT_FOREGROUND_ADMISSION_WAIT_TIMEOUT_MS: u64 = 0;
-
-const _: () = assert!(!DEFAULT_PUT_FOREGROUND_ADMISSION_ENABLE);
-
 /// Environment variable for minimum GetObject timeout in seconds.
 ///
 /// When dynamic timeout calculation is enabled, this is the minimum timeout

crates/data-usage/src/data_usage.rs

@@ -870,157 +870,6 @@ pub struct DataUsageCacheInfo {
     pub snapshot_complete: bool,
 }
 
-/// Prefix-level usage over a raw entry map — the shared core behind
-/// [`DataUsageCache::prefix_usage`], usable by any cache-shaped reader (the
-/// scanner's writer-side cache has the same map type).
-///
-/// Cache keys are cleaned literal paths (`bucket/pre/fix`), so sub-prefix
-/// names come straight off the child keys — no reverse mapping exists or is
-/// needed. A compacted prefix carries its aggregate but no children, which
-/// the `compacted` flag reports so callers can say why the breakdown is
-/// empty. `truncated` is set when the breakdown exceeded `max_entries` and
-/// was cut (largest first).
-pub fn prefix_usage_in_cache(
-    cache: &HashMap<String, DataUsageEntry>,
-    bucket: &str,
-    prefix: &str,
-    max_entries: usize,
-) -> Option<PrefixUsageQuery> {
-    let prefix = prefix.trim_matches('/');
-    let root = if prefix.is_empty() {
-        bucket.to_string()
-    } else {
-        format!("{bucket}/{prefix}")
-    };
-    let entry = cache.get(&hash_path(&root).key())?.clone();
-
-    let usage = PrefixUsageSummary::from_entry(&flatten_entry(cache, &entry, 0)?);
-
-    let child_prefix = format!("{root}/");
-    let mut sub_prefixes: Vec<PrefixUsageEntry> = entry
-        .children
-        .iter()
-        .filter_map(|child_key| {
-            let child = cache.get(child_key)?;
-            let child_flat = flatten_entry(cache, child, 1)?;
-            // Child keys are literal `bucket/pre/name` paths; a trailing
-            // slash marks a directory object and is display-only here.
-            let name = child_key
-                .strip_prefix(child_prefix.as_str())
-                .unwrap_or(child_key.as_str())
-                .trim_end_matches('/')
-                .to_string();
-            Some(PrefixUsageEntry {
-                prefix: name,
-                usage: PrefixUsageSummary::from_entry(&child_flat),
-            })
-        })
-        .collect();
-    sub_prefixes.sort_by(|left, right| {
-        right
-            .usage
-            .size
-            .cmp(&left.usage.size)
-            .then_with(|| left.prefix.cmp(&right.prefix))
-    });
-    let truncated = sub_prefixes.len() > max_entries;
-    sub_prefixes.truncate(max_entries);
-
-    Some(PrefixUsageQuery {
-        usage,
-        compacted: entry.compacted,
-        truncated,
-        sub_prefixes,
-    })
-}
-
-/// Maximum subtree depth [`flatten_entry`] will walk before declaring the
-/// cache corrupt — the same bound the scanner's checked flatten uses.
-const PREFIX_USAGE_MAX_DEPTH: usize = 1024;
-
-/// Flatten one entry's subtree into an aggregate: the free-function twin of
-/// [`DataUsageCache::flatten`], carrying the scanner checked-flatten
-/// hardening so a corrupt cache (cycles, over-deep trees, overflowing
-/// counters) yields `None` instead of unbounded recursion or wrapped totals.
-fn flatten_entry(cache: &HashMap<String, DataUsageEntry>, root: &DataUsageEntry, depth: usize) -> Option<DataUsageEntry> {
-    if depth > PREFIX_USAGE_MAX_DEPTH {
-        return None;
-    }
-    let mut flattened = DataUsageEntry::default();
-    if !flattened.checked_merge(root) {
-        return None;
-    }
-    flattened.compacted = root.compacted;
-    // The root itself is not pre-seeded: it is merged above, and a corrupt
-    // child edge pointing back at the root's own key is still terminated by
-    // the visited set on first encounter.
-    let mut visited: HashSet<&str> = HashSet::new();
-    let mut pending: Vec<(&String, usize)> = root.children.iter().map(|child| (child, depth + 1)).collect();
-    while let Some((key, child_depth)) = pending.pop() {
-        if child_depth > PREFIX_USAGE_MAX_DEPTH || !visited.insert(key.as_str()) {
-            return None;
-        }
-        let entry = cache.get(key)?;
-        if !flattened.checked_merge(entry) {
-            return None;
-        }
-        pending.extend(entry.children.iter().map(|child| (child, child_depth + 1)));
-    }
-    flattened.children.clear();
-    Some(flattened)
-}
-
-/// Flattened counters of one prefix subtree, as returned by
-/// [`DataUsageCache::prefix_usage`].
-#[derive(Clone, Copy, Debug, Default, PartialEq, Eq, serde::Serialize)]
-#[serde(rename_all = "camelCase")]
-pub struct PrefixUsageSummary {
-    pub size: u64,
-    pub objects: u64,
-    pub versions: u64,
-    pub delete_markers: u64,
-}
-
-impl PrefixUsageSummary {
-    fn from_entry(entry: &DataUsageEntry) -> Self {
-        Self {
-            size: entry.size as u64,
-            objects: entry.objects as u64,
-            versions: entry.versions as u64,
-            delete_markers: entry.delete_markers as u64,
-        }
-    }
-
-    /// Add another set's counters into this one (entries are partitioned by
-    /// set, so per-set results sum).
-    pub fn merge(&mut self, other: &Self) {
-        self.size = self.size.saturating_add(other.size);
-        self.objects = self.objects.saturating_add(other.objects);
-        self.versions = self.versions.saturating_add(other.versions);
-        self.delete_markers = self.delete_markers.saturating_add(other.delete_markers);
-    }
-}
-
-/// One first-level sub-prefix row of a [`PrefixUsageQuery`].
-#[derive(Clone, Debug, PartialEq, Eq, serde::Serialize)]
-pub struct PrefixUsageEntry {
-    pub prefix: String,
-    pub usage: PrefixUsageSummary,
-}
-
-/// Result of [`DataUsageCache::prefix_usage`].
-#[derive(Clone, Debug, Default, PartialEq, Eq, serde::Serialize)]
-#[serde(rename_all = "camelCase")]
-pub struct PrefixUsageQuery {
-    pub usage: PrefixUsageSummary,
-    /// The prefix entry was compacted by the scanner: its aggregate is valid
-    /// but no sub-prefix breakdown exists on disk.
-    pub compacted: bool,
-    /// The breakdown had more entries than `max_entries`; the largest remain.
-    pub truncated: bool,
-    pub sub_prefixes: Vec<PrefixUsageEntry>,
-}
-
 /// Read-only projection of a scanner-written `.usage-cache.bin` file.
 ///
 /// The scanner-side `DataUsageCache` (`crates/scanner/src/data_usage_define.rs`)
@@ -1148,21 +997,6 @@ impl DataUsageCache {
         }
     }
 
-    /// Prefix-level usage for one bucket subtree, plus the one-level
-    /// breakdown below it (rustfs/backlog#1872, MinIO
-    /// `loadPrefixUsageFromBackend` parity and beyond: arbitrary prefixes and
-    /// full counters instead of first-level sizes only).
-    ///
-    /// Cache keys are cleaned literal paths (`bucket/pre/fix`), so sub-prefix
-    /// names come straight off the child keys — no reverse mapping exists or
-    /// is needed. A compacted prefix carries its aggregate but no children,
-    /// which the `compacted` flag reports so callers can say why the
-    /// breakdown is empty. `truncated` is set when the breakdown exceeded
-    /// `max_entries` and was cut (largest first).
-    pub fn prefix_usage(&self, bucket: &str, prefix: &str, max_entries: usize) -> Option<PrefixUsageQuery> {
-        prefix_usage_in_cache(&self.cache, bucket, prefix, max_entries)
-    }
-
     pub fn force_compact(&mut self, limit: usize) {
         if self.cache.len() < limit {
             return;
@@ -2064,126 +1898,6 @@ mod tests {
         );
     }
 
-    /// Build a cache shaped like `bucket/{a,b/{c,d}},bucket/loose` with
-    /// distinct counters so aggregation is observable.
-    fn prefix_usage_fixture_cache() -> DataUsageCache {
-        let mut cache = DataUsageCache::default();
-        let mut insert = |path: &str, parent: &str, size: usize, objects: usize, versions: usize, delete_markers: usize| {
-            cache.replace(
-                path,
-                parent,
-                DataUsageEntry {
-                    size,
-                    objects,
-                    versions,
-                    delete_markers,
-                    ..Default::default()
-                },
-            );
-        };
-        insert("bucket", "", 0, 0, 0, 0);
-        insert("bucket/a", "bucket", 100, 1, 1, 0);
-        insert("bucket/b", "bucket", 0, 0, 0, 0);
-        insert("bucket/b/c", "bucket/b", 200, 2, 2, 1);
-        insert("bucket/b/d", "bucket/b", 40, 1, 3, 0);
-        insert("bucket/loose", "bucket", 10, 1, 1, 1);
-        cache
-    }
-
-    #[test]
-    fn prefix_usage_aggregates_bucket_root_and_one_level_below() {
-        let cache = prefix_usage_fixture_cache();
-
-        let root = cache
-            .prefix_usage("bucket", "", 100)
-            .expect("root query must find the bucket entry");
-        assert_eq!(root.usage.size, 350, "root aggregate flattens the whole subtree");
-        assert_eq!(root.usage.objects, 5);
-        assert_eq!(root.usage.versions, 7);
-        assert_eq!(root.usage.delete_markers, 2);
-        assert!(!root.compacted);
-        assert!(!root.truncated);
-        // Breakdown is one level: b (240) before a (100) before loose (10),
-        // each flattened to its own subtree total.
-        let names: Vec<(&str, u64)> = root
-            .sub_prefixes
-            .iter()
-            .map(|entry| (entry.prefix.as_str(), entry.usage.size))
-            .collect();
-        assert_eq!(names, vec![("b", 240), ("a", 100), ("loose", 10)]);
-    }
-
-    #[test]
-    fn prefix_usage_drills_into_arbitrary_prefixes() {
-        let cache = prefix_usage_fixture_cache();
-
-        let b = cache.prefix_usage("bucket", "b", 100).expect("nested prefix must resolve");
-        assert_eq!(b.usage.size, 240);
-        assert_eq!(b.usage.versions, 5);
-        let names: Vec<&str> = b.sub_prefixes.iter().map(|entry| entry.prefix.as_str()).collect();
-        assert_eq!(names, vec!["c", "d"]);
-
-        // Prefix slashes are normalized away.
-        let slashed = cache.prefix_usage("bucket", "/b/", 100).expect("slash-insensitive lookup");
-        assert_eq!(slashed.usage.size, 240);
-
-        assert!(cache.prefix_usage("bucket", "absent", 100).is_none(), "unknown prefix must be a miss");
-        assert!(cache.prefix_usage("other", "", 100).is_none(), "unknown bucket must be a miss");
-    }
-
-    #[test]
-    fn prefix_usage_reports_and_respects_truncation() {
-        let cache = prefix_usage_fixture_cache();
-        let capped = cache.prefix_usage("bucket", "", 2).expect("root query");
-        assert!(capped.truncated, "three children capped to two must flag truncation");
-        let names: Vec<&str> = capped.sub_prefixes.iter().map(|entry| entry.prefix.as_str()).collect();
-        assert_eq!(names, vec!["b", "a"], "largest prefixes survive the cut");
-    }
-
-    #[test]
-    fn prefix_usage_marks_compacted_entries() {
-        let mut cache = DataUsageCache::default();
-        cache.replace(
-            "bucket",
-            "",
-            DataUsageEntry {
-                size: 999,
-                objects: 9,
-                compacted: true,
-                ..Default::default()
-            },
-        );
-
-        let compacted = cache.prefix_usage("bucket", "", 100).expect("compacted root resolves");
-        assert!(compacted.compacted, "compaction must be visible to callers");
-        assert_eq!(compacted.usage.size, 999);
-        assert!(compacted.sub_prefixes.is_empty(), "a compacted entry carries no children");
-    }
-
-    #[test]
-    fn prefix_usage_rejects_cyclic_and_dangling_caches() {
-        // A self-referencing child (corrupt cache) must yield a miss for the
-        // whole query, not unbounded recursion.
-        let mut cache = prefix_usage_fixture_cache();
-        if let Some(entry) = cache.cache.get_mut("bucket/b") {
-            entry.children.insert("bucket/b".to_string());
-        }
-        assert!(cache.prefix_usage("bucket", "b", 100).is_none(), "a cyclic subtree must be rejected");
-        // The unaffected sibling still answers.
-        assert!(cache.prefix_usage("bucket", "a", 100).is_some());
-
-        // A child key with no entry (dangling link) is rejected rather than
-        // silently dropped: half a tree would under-report usage.
-        let mut dangling = prefix_usage_fixture_cache();
-        if let Some(entry) = dangling.cache.get_mut("bucket/b") {
-            entry.children.insert("bucket/b/ghost".to_string());
-        }
-        assert!(
-            dangling.prefix_usage("bucket", "b", 100).is_none(),
-            "a dangling child link must be rejected"
-        );
-    }
-
     #[test]
     fn hash_path_uses_portable_slash_semantics() {
         for (input, expected) in [

crates/e2e_test/src/common.rs

@@ -32,7 +32,6 @@ use rustfs_signer::sign_v4;
 use s3s::Body;
 use std::ffi::OsStr;
 use std::fs as stdfs;
-use std::io::ErrorKind;
 use std::path::{Path, PathBuf};
 use std::process::{Child, Command, Stdio};
 use std::sync::Once;
@@ -52,11 +51,6 @@ pub(crate) const FAST_DATA_USAGE_SCANNER_ENV: &[(&str, &str)] =
     &[("RUSTFS_SCANNER_CYCLE", "1"), ("RUSTFS_SCANNER_START_DELAY_SECS", "0")];
 pub const TEST_BUCKET: &str = "e2e-test-bucket";
 const RUSTFS_FULL_FEATURE: &str = "full";
-const TEST_PORT_MIN: u16 = 20_000;
-const TEST_PORT_RANGE: u16 = 40_000;
-const TEST_PORT_COUNTER_PATH: &str = "/tmp/rustfs_e2e_next_port";
-const TEST_PORT_LOCK_DIR: &str = "/tmp/rustfs_e2e_port_allocator.lock";
-const TEST_PORT_LOCK_STALE_AFTER: Duration = Duration::from_secs(30);
 
 fn capture_log_path(log_dir: &Path, temp_dir: &str) -> Option<PathBuf> {
     let temp_name = Path::new(temp_dir).file_name()?.to_string_lossy();
@@ -73,64 +67,6 @@ fn configured_capture_log_path(temp_dir: &str) -> Option<String> {
     capture_log_path(Path::new(&log_dir), temp_dir).map(|path| path.to_string_lossy().into_owned())
 }
 
-struct PortAllocatorGuard;
-
-impl PortAllocatorGuard {
-    async fn acquire() -> Result<Self, Box<dyn std::error::Error + Send + Sync>> {
-        loop {
-            match stdfs::create_dir(TEST_PORT_LOCK_DIR) {
-                Ok(()) => return Ok(Self),
-                Err(err) if err.kind() == ErrorKind::AlreadyExists => {
-                    remove_stale_port_allocator_lock();
-                    sleep(Duration::from_millis(10)).await;
-                }
-                Err(err) => return Err(err.into()),
-            }
-        }
-    }
-}
-
-impl Drop for PortAllocatorGuard {
-    fn drop(&mut self) {
-        let _ = stdfs::remove_dir(TEST_PORT_LOCK_DIR);
-    }
-}
-
-fn advance_test_port(port: u16) -> u16 {
-    let offset = (port - TEST_PORT_MIN + 1) % TEST_PORT_RANGE;
-    TEST_PORT_MIN + offset
-}
-
-fn seeded_test_port() -> u16 {
-    let offset = (Uuid::new_v4().as_u128() % u128::from(TEST_PORT_RANGE)) as u16;
-    TEST_PORT_MIN + offset
-}
-
-fn read_next_test_port() -> u16 {
-    stdfs::read_to_string(TEST_PORT_COUNTER_PATH)
-        .ok()
-        .and_then(|value| value.trim().parse::<u16>().ok())
-        .filter(|port| (TEST_PORT_MIN..TEST_PORT_MIN + TEST_PORT_RANGE).contains(port))
-        .unwrap_or_else(seeded_test_port)
-}
-
-fn remove_stale_port_allocator_lock() {
-    let Ok(metadata) = stdfs::metadata(TEST_PORT_LOCK_DIR) else {
-        return;
-    };
-    let Ok(modified) = metadata.modified() else {
-        return;
-    };
-    if modified.elapsed().is_ok_and(|elapsed| elapsed > TEST_PORT_LOCK_STALE_AFTER) {
-        let _ = stdfs::remove_dir(TEST_PORT_LOCK_DIR);
-    }
-}
-
-fn write_next_test_port(port: u16) -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
-    stdfs::write(TEST_PORT_COUNTER_PATH, port.to_string())?;
-    Ok(())
-}
-
 pub(crate) fn capture_command_logs(
     command: &mut Command,
     log_path: Option<&str>,
@@ -572,21 +508,10 @@ impl RustFSTestEnvironment {
     /// Find an available port for the test
     pub async fn find_available_port() -> Result<u16, Box<dyn std::error::Error + Send + Sync>> {
         use std::net::TcpListener;
-        let _guard = PortAllocatorGuard::acquire().await?;
-        let mut next_port = read_next_test_port();
-
-        for _ in 0..TEST_PORT_RANGE {
-            let port = next_port;
-            next_port = advance_test_port(next_port);
-            write_next_test_port(next_port)?;
-
-            if let Ok(listener) = TcpListener::bind(("127.0.0.1", port)) {
-                drop(listener);
-                return Ok(port);
-            }
-        }
-
-        Err("no available E2E test port found".into())
+        let listener = TcpListener::bind("127.0.0.1:0")?;
+        let port = listener.local_addr()?.port();
+        drop(listener);
+        Ok(port)
     }
 
     /// Kill any existing RustFS processes

crates/e2e_test/src/multipart_auth_test.rs

@@ -30,6 +30,7 @@ use md5::{Digest as Md5Digest, Md5};
 use rustfs_signer::constants::UNSIGNED_PAYLOAD;
 use rustfs_signer::sign_v4;
 use s3s::Body;
+use serial_test::serial;
 use std::collections::HashMap;
 use std::error::Error;
 use std::io::Cursor;
@@ -355,6 +356,7 @@ async fn run_post_object_policy_case(
 /// smuggles one extra field the policy never declared, and the upload must be
 /// rejected with 403 AccessDenied naming the offending field.
 #[tokio::test]
+#[serial]
 async fn test_anonymous_post_object_rejects_fields_missing_from_policy_conditions()
 -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
     init_logging();
@@ -482,6 +484,7 @@ async fn test_anonymous_post_object_rejects_fields_missing_from_policy_condition
 /// sends a different one, and the upload must be rejected with 400
 /// InvalidPolicyDocument naming the field.
 #[tokio::test]
+#[serial]
 async fn test_anonymous_post_object_rejects_exact_condition_policy_mismatches()
 -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
     init_logging();
@@ -686,6 +689,7 @@ async fn test_anonymous_post_object_rejects_exact_condition_policy_mismatches()
 /// one of them with a different value, and the upload must be rejected with
 /// 400 InvalidPolicyDocument naming the mismatched field.
 #[tokio::test]
+#[serial]
 async fn test_anonymous_post_object_rejects_object_lock_policy_mismatches() -> Result<(), Box<dyn std::error::Error + Send + Sync>>
 {
     init_logging();
@@ -753,6 +757,7 @@ async fn test_anonymous_post_object_rejects_object_lock_policy_mismatches() -> R
 /// exact values, the form sends a different parameter value, and the upload
 /// must be rejected with 400 InvalidPolicyDocument naming the parameter.
 #[tokio::test]
+#[serial]
 async fn test_anonymous_post_object_rejects_sse_kms_policy_mismatches() -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
     init_logging();
 
@@ -834,6 +839,7 @@ async fn test_anonymous_post_object_rejects_sse_kms_policy_mismatches() -> Resul
 /// NotImplemented (SSE-KMS POST uploads are not implemented), not with a
 /// policy error.
 #[tokio::test]
+#[serial]
 async fn test_anonymous_post_object_rejects_sse_kms_params_outside_policy_conditions()
 -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
     init_logging();
@@ -888,6 +894,7 @@ async fn test_anonymous_post_object_rejects_sse_kms_params_outside_policy_condit
 }
 
 #[tokio::test]
+#[serial]
 async fn test_anonymous_multipart_control_apis_require_auth() -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
     init_logging();
 
@@ -961,6 +968,7 @@ async fn test_anonymous_multipart_control_apis_require_auth() -> Result<(), Box<
 }
 
 #[tokio::test]
+#[serial]
 async fn test_anonymous_post_object_requires_auth() -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
     init_logging();
 
@@ -994,6 +1002,7 @@ async fn test_anonymous_post_object_requires_auth() -> Result<(), Box<dyn std::e
 }
 
 #[tokio::test]
+#[serial]
 async fn test_anonymous_post_object_honors_success_action_status() -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
     init_logging();
 
@@ -1057,6 +1066,7 @@ async fn test_anonymous_post_object_honors_success_action_status() -> Result<(),
 }
 
 #[tokio::test]
+#[serial]
 async fn test_anonymous_post_object_honors_success_action_redirect() -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
     init_logging();
 
@@ -1129,6 +1139,7 @@ async fn test_anonymous_post_object_honors_success_action_redirect() -> Result<(
 }
 
 #[tokio::test]
+#[serial]
 async fn test_anonymous_post_object_defaults_to_no_content() -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
     init_logging();
 
@@ -1174,6 +1185,7 @@ async fn test_anonymous_post_object_defaults_to_no_content() -> Result<(), Box<d
 }
 
 #[tokio::test]
+#[serial]
 async fn test_anonymous_post_object_rejects_sse_kms() -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
     init_logging();
 
@@ -1220,6 +1232,7 @@ async fn test_anonymous_post_object_rejects_sse_kms() -> Result<(), Box<dyn std:
 }
 
 #[tokio::test]
+#[serial]
 async fn test_anonymous_post_object_accepts_sse_s3() -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
     init_logging();
 
@@ -1277,6 +1290,7 @@ async fn test_anonymous_post_object_accepts_sse_s3() -> Result<(), Box<dyn std::
 }
 
 #[tokio::test]
+#[serial]
 async fn test_anonymous_post_object_uses_bucket_default_sse_s3() -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
     init_logging();
 
@@ -1349,6 +1363,7 @@ async fn test_anonymous_post_object_uses_bucket_default_sse_s3() -> Result<(), B
 }
 
 #[tokio::test]
+#[serial]
 async fn test_anonymous_post_object_uses_bucket_default_sse_kms() -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
     init_logging();
 
@@ -1422,6 +1437,7 @@ async fn test_anonymous_post_object_uses_bucket_default_sse_kms() -> Result<(),
 }
 
 #[tokio::test]
+#[serial]
 async fn test_anonymous_post_object_rejects_sse_s3_policy_mismatch() -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
     init_logging();
 
@@ -1472,6 +1488,7 @@ async fn test_anonymous_post_object_rejects_sse_s3_policy_mismatch() -> Result<(
 }
 
 #[tokio::test]
+#[serial]
 async fn test_anonymous_post_object_accepts_sse_s3_missing_from_policy_conditions()
 -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
     init_logging();
@@ -1535,6 +1552,7 @@ async fn test_anonymous_post_object_accepts_sse_s3_missing_from_policy_condition
 }
 
 #[tokio::test]
+#[serial]
 async fn test_anonymous_post_object_accepts_storage_class_exact_policy_match()
 -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
     init_logging();
@@ -1588,6 +1606,7 @@ async fn test_anonymous_post_object_accepts_storage_class_exact_policy_match()
 }
 
 #[tokio::test]
+#[serial]
 async fn test_anonymous_post_object_rejects_storage_class_missing_from_policy_conditions()
 -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
     init_logging();
@@ -1638,6 +1657,7 @@ async fn test_anonymous_post_object_rejects_storage_class_missing_from_policy_co
 }
 
 #[tokio::test]
+#[serial]
 async fn test_anonymous_post_object_rejects_invalid_storage_class_value() -> Result<(), Box<dyn std::error::Error + Send + Sync>>
 {
     init_logging();
@@ -1689,6 +1709,7 @@ async fn test_anonymous_post_object_rejects_invalid_storage_class_value() -> Res
 }
 
 #[tokio::test]
+#[serial]
 async fn test_anonymous_post_object_rejects_checksum_algorithm_missing_from_policy_conditions()
 -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
     init_logging();
@@ -1744,6 +1765,7 @@ async fn test_anonymous_post_object_rejects_checksum_algorithm_missing_from_poli
 }
 
 #[tokio::test]
+#[serial]
 async fn test_anonymous_post_object_rejects_checksum_algorithm_policy_mismatch()
 -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
     init_logging();
@@ -1800,6 +1822,7 @@ async fn test_anonymous_post_object_rejects_checksum_algorithm_policy_mismatch()
 }
 
 #[tokio::test]
+#[serial]
 async fn test_anonymous_post_object_rejects_checksum_auxiliary_fields_missing_from_policy_conditions()
 -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
     init_logging();
@@ -1863,6 +1886,7 @@ async fn test_anonymous_post_object_rejects_checksum_auxiliary_fields_missing_fr
 }
 
 #[tokio::test]
+#[serial]
 async fn test_anonymous_post_object_allows_sse_c_fields_outside_policy_conditions()
 -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
     init_logging();
@@ -1939,6 +1963,7 @@ async fn test_anonymous_post_object_allows_sse_c_fields_outside_policy_condition
 }
 
 #[tokio::test]
+#[serial]
 async fn test_anonymous_post_object_rejects_sse_c_exact_policy_mismatch() -> Result<(), Box<dyn std::error::Error + Send + Sync>>
 {
     init_logging();
@@ -1997,6 +2022,7 @@ async fn test_anonymous_post_object_rejects_sse_c_exact_policy_mismatch() -> Res
 }
 
 #[tokio::test]
+#[serial]
 async fn test_anonymous_post_object_rejects_duplicate_key_form_values() -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
     init_logging();
 
@@ -2046,6 +2072,7 @@ async fn test_anonymous_post_object_rejects_duplicate_key_form_values() -> Resul
 }
 
 #[tokio::test]
+#[serial]
 async fn test_anonymous_post_object_rejects_invalid_success_action_status() -> Result<(), Box<dyn std::error::Error + Send + Sync>>
 {
     init_logging();
@@ -2093,6 +2120,7 @@ async fn test_anonymous_post_object_rejects_invalid_success_action_status() -> R
 }
 
 #[tokio::test]
+#[serial]
 async fn test_anonymous_post_object_rejects_invalid_success_action_redirect()
 -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
     init_logging();
@@ -2140,6 +2168,7 @@ async fn test_anonymous_post_object_rejects_invalid_success_action_redirect()
 }
 
 #[tokio::test]
+#[serial]
 async fn test_anonymous_post_object_rejects_form_fields_missing_from_policy_conditions()
 -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
     init_logging();
@@ -2194,6 +2223,7 @@ async fn test_anonymous_post_object_rejects_form_fields_missing_from_policy_cond
 }
 
 #[tokio::test]
+#[serial]
 async fn test_anonymous_post_object_accepts_form_fields_covered_by_policy_conditions()
 -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
     init_logging();
@@ -2250,6 +2280,7 @@ async fn test_anonymous_post_object_accepts_form_fields_covered_by_policy_condit
 }
 
 #[tokio::test]
+#[serial]
 async fn test_anonymous_post_object_rejects_starts_with_policy_mismatch() -> Result<(), Box<dyn std::error::Error + Send + Sync>>
 {
     init_logging();
@@ -2304,6 +2335,7 @@ async fn test_anonymous_post_object_rejects_starts_with_policy_mismatch() -> Res
 }
 
 #[tokio::test]
+#[serial]
 async fn test_anonymous_post_object_rejects_content_length_range_violation()
 -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
     init_logging();
@@ -2356,6 +2388,7 @@ async fn test_anonymous_post_object_rejects_content_length_range_violation()
 }
 
 #[tokio::test]
+#[serial]
 async fn test_anonymous_post_object_accepts_success_action_status_exact_policy_match()
 -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
     init_logging();
@@ -2412,6 +2445,7 @@ async fn test_anonymous_post_object_accepts_success_action_status_exact_policy_m
 }
 
 #[tokio::test]
+#[serial]
 async fn test_anonymous_post_object_rejects_success_action_redirect_policy_mismatch()
 -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
     init_logging();
@@ -2468,6 +2502,7 @@ async fn test_anonymous_post_object_rejects_success_action_redirect_policy_misma
 }
 
 #[tokio::test]
+#[serial]
 async fn test_anonymous_post_object_accepts_success_action_redirect_exact_policy_match()
 -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
     init_logging();
@@ -2533,6 +2568,7 @@ async fn test_anonymous_post_object_accepts_success_action_redirect_exact_policy
 }
 
 #[tokio::test]
+#[serial]
 async fn test_anonymous_post_object_rejects_success_action_redirect_missing_from_policy_conditions()
 -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
     init_logging();
@@ -2585,6 +2621,7 @@ async fn test_anonymous_post_object_rejects_success_action_redirect_missing_from
 }
 
 #[tokio::test]
+#[serial]
 async fn test_anonymous_post_object_accepts_metadata_field_covered_by_starts_with()
 -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
     init_logging();
@@ -2639,6 +2676,7 @@ async fn test_anonymous_post_object_accepts_metadata_field_covered_by_starts_wit
 }
 
 #[tokio::test]
+#[serial]
 async fn test_anonymous_post_object_accepts_content_type_field_exact_policy_match()
 -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
     init_logging();
@@ -2696,6 +2734,7 @@ async fn test_anonymous_post_object_accepts_content_type_field_exact_policy_matc
 }
 
 #[tokio::test]
+#[serial]
 async fn test_anonymous_post_object_accepts_content_type_field_covered_by_starts_with()
 -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
     init_logging();
@@ -2753,6 +2792,7 @@ async fn test_anonymous_post_object_accepts_content_type_field_covered_by_starts
 }
 
 #[tokio::test]
+#[serial]
 async fn test_anonymous_post_object_accepts_content_disposition_field_exact_policy_match()
 -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
     init_logging();
@@ -2810,6 +2850,7 @@ async fn test_anonymous_post_object_accepts_content_disposition_field_exact_poli
 }
 
 #[tokio::test]
+#[serial]
 async fn test_anonymous_post_object_accepts_cache_control_field_exact_policy_match()
 -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
     init_logging();
@@ -2867,6 +2908,7 @@ async fn test_anonymous_post_object_accepts_cache_control_field_exact_policy_mat
 }
 
 #[tokio::test]
+#[serial]
 async fn test_anonymous_post_object_accepts_content_language_field_exact_policy_match()
 -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
     init_logging();
@@ -2924,6 +2966,7 @@ async fn test_anonymous_post_object_accepts_content_language_field_exact_policy_
 }
 
 #[tokio::test]
+#[serial]
 async fn test_anonymous_post_object_accepts_content_encoding_field_exact_policy_match()
 -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
     init_logging();
@@ -2981,6 +3024,7 @@ async fn test_anonymous_post_object_accepts_content_encoding_field_exact_policy_
 }
 
 #[tokio::test]
+#[serial]
 async fn test_anonymous_post_object_accepts_website_redirect_location_exact_policy_match()
 -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
     init_logging();
@@ -3038,6 +3082,7 @@ async fn test_anonymous_post_object_accepts_website_redirect_location_exact_poli
 }
 
 #[tokio::test]
+#[serial]
 async fn test_anonymous_post_object_accepts_expires_field_exact_policy_match()
 -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
     init_logging();
@@ -3095,6 +3140,7 @@ async fn test_anonymous_post_object_accepts_expires_field_exact_policy_match()
 }
 
 #[tokio::test]
+#[serial]
 async fn test_anonymous_post_object_rejects_object_lock_retention_without_permission()
 -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
     init_logging();
@@ -3150,6 +3196,7 @@ async fn test_anonymous_post_object_rejects_object_lock_retention_without_permis
 }
 
 #[tokio::test]
+#[serial]
 async fn test_anonymous_post_object_rejects_object_lock_retention_missing_from_policy_conditions()
 -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
     init_logging();
@@ -3209,6 +3256,7 @@ async fn test_anonymous_post_object_rejects_object_lock_retention_missing_from_p
 }
 
 #[tokio::test]
+#[serial]
 async fn test_anonymous_post_object_rejects_object_lock_legal_hold_without_permission()
 -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
     init_logging();
@@ -3261,6 +3309,7 @@ async fn test_anonymous_post_object_rejects_object_lock_legal_hold_without_permi
 }
 
 #[tokio::test]
+#[serial]
 async fn test_anonymous_post_object_rejects_object_lock_legal_hold_policy_mismatch()
 -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
     init_logging();
@@ -3319,6 +3368,7 @@ async fn test_anonymous_post_object_rejects_object_lock_legal_hold_policy_mismat
 }
 
 #[tokio::test]
+#[serial]
 async fn test_anonymous_post_object_rejects_object_lock_legal_hold_missing_from_policy_conditions()
 -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
     init_logging();
@@ -3376,6 +3426,7 @@ async fn test_anonymous_post_object_rejects_object_lock_legal_hold_missing_from_
 }
 
 #[tokio::test]
+#[serial]
 async fn test_anonymous_post_object_accepts_tagging_field_exact_policy_match()
 -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
     init_logging();
@@ -3441,6 +3492,7 @@ async fn test_anonymous_post_object_accepts_tagging_field_exact_policy_match()
 }
 
 #[tokio::test]
+#[serial]
 async fn test_anonymous_post_object_accepts_metadata_field_exact_policy_match()
 -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
     init_logging();
@@ -3499,6 +3551,7 @@ async fn test_anonymous_post_object_accepts_metadata_field_exact_policy_match()
 }
 
 #[tokio::test]
+#[serial]
 async fn test_anonymous_post_object_allows_x_ignore_fields_outside_policy_conditions()
 -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
     init_logging();
@@ -3551,6 +3604,7 @@ async fn test_anonymous_post_object_allows_x_ignore_fields_outside_policy_condit
 }
 
 #[tokio::test]
+#[serial]
 async fn test_anonymous_post_object_rejects_sigv4_date_policy_mismatch() -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
     init_logging();
 
@@ -3603,6 +3657,7 @@ async fn test_anonymous_post_object_rejects_sigv4_date_policy_mismatch() -> Resu
 }
 
 #[tokio::test]
+#[serial]
 async fn test_anonymous_post_object_rejects_mismatched_bucket_form_field() -> Result<(), Box<dyn std::error::Error + Send + Sync>>
 {
     init_logging();
@@ -3657,6 +3712,7 @@ async fn test_anonymous_post_object_rejects_mismatched_bucket_form_field() -> Re
 }
 
 #[tokio::test]
+#[serial]
 async fn test_anonymous_post_object_rejects_multiple_bucket_values() -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
     init_logging();
 
@@ -3708,6 +3764,7 @@ async fn test_anonymous_post_object_rejects_multiple_bucket_values() -> Result<(
 }
 
 #[tokio::test]
+#[serial]
 async fn test_anonymous_post_object_rejects_extra_content_disposition_field()
 -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
     init_logging();
@@ -3763,6 +3820,7 @@ async fn test_anonymous_post_object_rejects_extra_content_disposition_field()
 }
 
 #[tokio::test]
+#[serial]
 async fn test_signed_put_object_extract_expands_tar_entries_with_prefix_headers()
 -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
     init_logging();
@@ -3833,6 +3891,7 @@ async fn test_signed_put_object_extract_expands_tar_entries_with_prefix_headers(
 }
 
 #[tokio::test]
+#[serial]
 async fn test_signed_put_object_extract_preserves_request_metadata_on_extracted_objects()
 -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
     init_logging();
@@ -3897,6 +3956,7 @@ async fn test_signed_put_object_extract_preserves_request_metadata_on_extracted_
 }
 
 #[tokio::test]
+#[serial]
 async fn test_signed_put_object_extract_preserves_sse_s3_and_redirect() -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
     init_logging();
 
@@ -3944,6 +4004,7 @@ async fn test_signed_put_object_extract_preserves_sse_s3_and_redirect() -> Resul
 }
 
 #[tokio::test]
+#[serial]
 async fn test_signed_put_object_extract_preserves_storage_class() -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
     init_logging();
 
@@ -3986,6 +4047,7 @@ async fn test_signed_put_object_extract_preserves_storage_class() -> Result<(),
 }
 
 #[tokio::test]
+#[serial]
 async fn test_signed_put_object_extract_rejects_invalid_storage_class() -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
     init_logging();
 
@@ -4021,6 +4083,7 @@ async fn test_signed_put_object_extract_rejects_invalid_storage_class() -> Resul
 }
 
 #[tokio::test]
+#[serial]
 async fn test_signed_put_object_rejects_write_offset_bytes_header() -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
     init_logging();
 
@@ -4074,6 +4137,7 @@ async fn test_signed_put_object_rejects_write_offset_bytes_header() -> Result<()
 }
 
 #[tokio::test]
+#[serial]
 async fn test_raw_signed_put_object_write_offset_bytes_returns_minio_compatible_error_body()
 -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
     init_logging();
@@ -4112,6 +4176,7 @@ async fn test_raw_signed_put_object_write_offset_bytes_returns_minio_compatible_
 }
 
 #[tokio::test]
+#[serial]
 async fn test_anonymous_put_object_write_offset_bytes_returns_minio_compatible_error_body()
 -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
     init_logging();
@@ -4170,6 +4235,7 @@ async fn test_anonymous_put_object_write_offset_bytes_returns_minio_compatible_e
 }
 
 #[tokio::test]
+#[serial]
 async fn test_signed_put_object_extract_uses_bucket_default_sse_s3() -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
     init_logging();
 
@@ -4234,6 +4300,7 @@ async fn test_signed_put_object_extract_uses_bucket_default_sse_s3() -> Result<(
 }
 
 #[tokio::test]
+#[serial]
 async fn test_signed_put_object_extract_rejects_bucket_default_sse_kms() -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
     init_logging();
 
@@ -4289,6 +4356,7 @@ async fn test_signed_put_object_extract_rejects_bucket_default_sse_kms() -> Resu
 }
 
 #[tokio::test]
+#[serial]
 async fn test_signed_put_object_extract_preserves_sse_c() -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
     init_logging();
 
@@ -4353,6 +4421,7 @@ async fn test_signed_put_object_extract_preserves_sse_c() -> Result<(), Box<dyn
 }
 
 #[tokio::test]
+#[serial]
 async fn test_signed_put_object_extract_preserves_object_lock_legal_hold() -> Result<(), Box<dyn std::error::Error + Send + Sync>>
 {
     init_logging();
@@ -4407,6 +4476,7 @@ async fn test_signed_put_object_extract_preserves_object_lock_legal_hold() -> Re
 }
 
 #[tokio::test]
+#[serial]
 async fn test_signed_put_object_extract_preserves_object_lock_retention() -> Result<(), Box<dyn std::error::Error + Send + Sync>>
 {
     init_logging();
@@ -4466,6 +4536,7 @@ async fn test_signed_put_object_extract_preserves_object_lock_retention() -> Res
 }
 
 #[tokio::test]
+#[serial]
 async fn test_signed_put_object_extract_pax_retention_overrides_request_retention()
 -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
     init_logging();
@@ -4529,6 +4600,7 @@ async fn test_signed_put_object_extract_pax_retention_overrides_request_retentio
 }
 
 #[tokio::test]
+#[serial]
 async fn test_signed_put_object_extract_returns_archive_etag() -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
     init_logging();
 
@@ -4562,6 +4634,7 @@ async fn test_signed_put_object_extract_returns_archive_etag() -> Result<(), Box
 }
 
 #[tokio::test]
+#[serial]
 async fn test_signed_put_object_extract_preserves_entry_mtime() -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
     init_logging();
 
@@ -4597,6 +4670,7 @@ async fn test_signed_put_object_extract_preserves_entry_mtime() -> Result<(), Bo
 }
 
 #[tokio::test]
+#[serial]
 async fn test_signed_put_object_extract_preserves_pax_metadata_and_version_id()
 -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
     init_logging();
@@ -4650,6 +4724,7 @@ async fn test_signed_put_object_extract_preserves_pax_metadata_and_version_id()
 }
 
 #[tokio::test]
+#[serial]
 async fn test_signed_put_object_extract_authorizes_each_pax_privilege_and_retention_conditions()
 -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
     init_logging();
@@ -4959,6 +5034,7 @@ async fn test_signed_put_object_extract_authorizes_each_pax_privilege_and_retent
 }
 
 #[tokio::test]
+#[serial]
 async fn test_signed_put_object_extract_accepts_compat_header() -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
     init_logging();
 
@@ -5000,6 +5076,7 @@ async fn test_signed_put_object_extract_accepts_compat_header() -> Result<(), Bo
 }
 
 #[tokio::test]
+#[serial]
 async fn test_signed_put_object_extract_preserves_directory_markers_by_default()
 -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
     init_logging();
@@ -5060,6 +5137,7 @@ async fn test_signed_put_object_extract_preserves_directory_markers_by_default()
 }
 
 #[tokio::test]
+#[serial]
 async fn test_signed_put_object_extract_expands_tar_gz_archive() -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
     init_logging();
 
@@ -5111,6 +5189,7 @@ async fn test_signed_put_object_extract_expands_tar_gz_archive() -> Result<(), B
 }
 
 #[tokio::test]
+#[serial]
 async fn test_signed_put_object_extract_expands_tgz_archive() -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
     init_logging();
 
@@ -5162,6 +5241,7 @@ async fn test_signed_put_object_extract_expands_tgz_archive() -> Result<(), Box<
 }
 
 #[tokio::test]
+#[serial]
 async fn test_signed_put_object_extract_expands_tbz2_archive() -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
     init_logging();
 
@@ -5213,6 +5293,7 @@ async fn test_signed_put_object_extract_expands_tbz2_archive() -> Result<(), Box
 }
 
 #[tokio::test]
+#[serial]
 async fn test_signed_put_object_extract_expands_txz_archive() -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
     init_logging();
 
@@ -5264,6 +5345,7 @@ async fn test_signed_put_object_extract_expands_txz_archive() -> Result<(), Box<
 }
 
 #[tokio::test]
+#[serial]
 async fn test_signed_put_object_extract_skips_invalid_entry_when_ignore_errors_enabled()
 -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
     init_logging();
@@ -5337,6 +5419,7 @@ async fn test_signed_put_object_extract_skips_invalid_entry_when_ignore_errors_e
 }
 
 #[tokio::test]
+#[serial]
 async fn test_signed_put_object_extract_normalizes_prefix_header_value() -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
     init_logging();
 
@@ -5379,6 +5462,7 @@ async fn test_signed_put_object_extract_normalizes_prefix_header_value() -> Resu
 }
 
 #[tokio::test]
+#[serial]
 async fn test_signed_put_object_extract_expands_tzst_archive() -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
     init_logging();
 
@@ -5430,6 +5514,7 @@ async fn test_signed_put_object_extract_expands_tzst_archive() -> Result<(), Box
 }
 
 #[tokio::test]
+#[serial]
 async fn test_signed_put_object_extract_rejects_missing_archive_extension() -> Result<(), Box<dyn std::error::Error + Send + Sync>>
 {
     init_logging();
@@ -5463,6 +5548,7 @@ async fn test_signed_put_object_extract_rejects_missing_archive_extension() -> R
 }
 
 #[tokio::test]
+#[serial]
 async fn test_signed_put_object_extract_rejects_invalid_tar_gz_payload() -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
     init_logging();
 

crates/e2e_test/src/object_lock/object_lock_test.rs

@@ -33,6 +33,7 @@ use aws_sdk_s3::types::{
     ObjectLockMode, ObjectLockRetentionMode,
 };
 use chrono::{DateTime, Duration, Utc};
+use serial_test::serial;
 use tracing::info;
 
 /// Initialize test logging
@@ -106,6 +107,7 @@ fn parse_s3_datetime(value: &aws_sdk_s3::primitives::DateTime) -> DateTime<Utc>
 // ============================================================================
 
 #[tokio::test]
+#[serial]
 async fn test_delete_object_blocked_by_compliance_retention() {
     init_logging();
     info!("🧪 Test: DeleteObject blocked by COMPLIANCE retention");
@@ -143,6 +145,7 @@ async fn test_delete_object_blocked_by_compliance_retention() {
 }
 
 #[tokio::test]
+#[serial]
 async fn test_delete_object_blocked_by_governance_without_bypass() {
     init_logging();
     info!("🧪 Test: DeleteObject blocked by GOVERNANCE retention without bypass");
@@ -172,6 +175,7 @@ async fn test_delete_object_blocked_by_governance_without_bypass() {
 }
 
 #[tokio::test]
+#[serial]
 async fn test_delete_object_allowed_by_governance_with_bypass() {
     init_logging();
     info!("🧪 Test: DeleteObject allowed by GOVERNANCE retention with bypass");
@@ -211,6 +215,7 @@ async fn test_delete_object_allowed_by_governance_with_bypass() {
 }
 
 #[tokio::test]
+#[serial]
 async fn test_delete_object_creates_delete_marker_for_retained_current_version() {
     init_logging();
     info!("🧪 Test: DeleteObject creates delete marker for retained current version");
@@ -261,6 +266,7 @@ async fn test_delete_object_creates_delete_marker_for_retained_current_version()
 }
 
 #[tokio::test]
+#[serial]
 async fn test_delete_object_blocked_by_legal_hold() {
     init_logging();
     info!("🧪 Test: DeleteObject blocked by Legal Hold");
@@ -293,6 +299,7 @@ async fn test_delete_object_blocked_by_legal_hold() {
 }
 
 #[tokio::test]
+#[serial]
 async fn test_delete_object_allowed_with_legal_hold_off() {
     init_logging();
     info!("🧪 Test: DeleteObject allowed with Legal Hold OFF");
@@ -328,6 +335,7 @@ async fn test_delete_object_allowed_with_legal_hold_off() {
 }
 
 #[tokio::test]
+#[serial]
 async fn test_delete_object_after_legal_hold_removed() {
     init_logging();
     info!("🧪 Test: DeleteObject succeeds after Legal Hold is removed");
@@ -361,6 +369,7 @@ async fn test_delete_object_after_legal_hold_removed() {
 }
 
 #[tokio::test]
+#[serial]
 async fn test_get_object_legal_hold_returns_updated_status() {
     init_logging();
     info!("🧪 Test: GetObjectLegalHold returns updated status");
@@ -416,6 +425,7 @@ async fn test_get_object_legal_hold_returns_updated_status() {
 }
 
 #[tokio::test]
+#[serial]
 async fn test_get_object_retention_returns_configured_values() {
     init_logging();
     info!("🧪 Test: GetObjectRetention returns configured values");
@@ -466,6 +476,7 @@ async fn test_get_object_retention_returns_configured_values() {
 // creating a new current version. The lock protects the existing version
 // from deletion; it never blocks new versions.
 #[tokio::test]
+#[serial]
 async fn test_put_object_overwrite_creates_new_version_under_legal_hold() {
     init_logging();
     info!("🧪 Test: PutObject overwrite of a legal-hold version creates a new version");
@@ -550,6 +561,7 @@ async fn test_put_object_overwrite_creates_new_version_under_legal_hold() {
 }
 
 #[tokio::test]
+#[serial]
 async fn test_copy_object_applies_requested_legal_hold() {
     init_logging();
     info!("🧪 Test: CopyObject applies requested Legal Hold");
@@ -601,6 +613,7 @@ async fn test_copy_object_applies_requested_legal_hold() {
 }
 
 #[tokio::test]
+#[serial]
 async fn test_copy_object_does_not_inherit_source_legal_hold() {
     init_logging();
     info!("🧪 Test: CopyObject does not inherit source Legal Hold");
@@ -694,6 +707,7 @@ async fn test_copy_object_does_not_inherit_source_legal_hold() {
 }
 
 #[tokio::test]
+#[serial]
 async fn test_copy_object_overwrite_creates_new_version_under_legal_hold() {
     init_logging();
     info!("🧪 Test: CopyObject overwrite of a legal-hold destination creates a new version");
@@ -773,6 +787,7 @@ async fn test_copy_object_overwrite_creates_new_version_under_legal_hold() {
 }
 
 #[tokio::test]
+#[serial]
 async fn test_create_multipart_upload_applies_requested_legal_hold() {
     init_logging();
     info!("🧪 Test: CreateMultipartUpload applies requested Legal Hold");
@@ -838,6 +853,7 @@ async fn test_create_multipart_upload_applies_requested_legal_hold() {
 }
 
 #[tokio::test]
+#[serial]
 async fn test_create_multipart_upload_creates_new_version_under_compliance_retention() {
     init_logging();
     info!("🧪 Test: CreateMultipartUpload over a COMPLIANCE-retained key creates a new version");
@@ -917,6 +933,7 @@ async fn test_create_multipart_upload_creates_new_version_under_compliance_reten
 }
 
 #[tokio::test]
+#[serial]
 async fn test_delete_completed_multipart_object_blocked_by_legal_hold() {
     init_logging();
     info!("🧪 Test: Delete completed multipart object blocked by Legal Hold");
@@ -976,6 +993,7 @@ async fn test_delete_completed_multipart_object_blocked_by_legal_hold() {
 }
 
 #[tokio::test]
+#[serial]
 async fn test_delete_completed_multipart_object_blocked_by_retention() {
     init_logging();
     info!("🧪 Test: Delete completed multipart object blocked by retention");
@@ -1037,6 +1055,7 @@ async fn test_delete_completed_multipart_object_blocked_by_retention() {
 }
 
 #[tokio::test]
+#[serial]
 async fn test_complete_multipart_upload_creates_new_version_under_legal_hold() {
     init_logging();
     info!("🧪 Test: CompleteMultipartUpload creates a new version when the current version is under Legal Hold");
@@ -1116,6 +1135,7 @@ async fn test_complete_multipart_upload_creates_new_version_under_legal_hold() {
 }
 
 #[tokio::test]
+#[serial]
 async fn test_complete_multipart_upload_creates_new_version_under_compliance_retention() {
     init_logging();
     info!("🧪 Test: CompleteMultipartUpload creates a new version when the current version is under COMPLIANCE retention");
@@ -1189,6 +1209,7 @@ async fn test_complete_multipart_upload_creates_new_version_under_compliance_ret
 }
 
 #[tokio::test]
+#[serial]
 async fn test_write_paths_require_put_object_legal_hold_permission() {
     init_logging();
     info!("🧪 Test: write paths require PutObjectLegalHold permission");
@@ -1252,6 +1273,7 @@ async fn test_write_paths_require_put_object_legal_hold_permission() {
 }
 
 #[tokio::test]
+#[serial]
 async fn test_write_paths_require_put_object_retention_permission() {
     init_logging();
     info!("🧪 Test: write paths require PutObjectRetention permission");
@@ -1323,6 +1345,7 @@ async fn test_write_paths_require_put_object_retention_permission() {
 // ============================================================================
 
 #[tokio::test]
+#[serial]
 async fn test_delete_objects_mixed_locked_unlocked() {
     init_logging();
     info!("🧪 Test: DeleteObjects with mixed locked and unlocked objects");
@@ -1404,6 +1427,7 @@ async fn test_delete_objects_mixed_locked_unlocked() {
 // ============================================================================
 
 #[tokio::test]
+#[serial]
 async fn test_put_retention_compliance_cannot_shorten() {
     init_logging();
     info!("🧪 Test: PutObjectRetention cannot shorten COMPLIANCE retention");
@@ -1444,6 +1468,7 @@ async fn test_put_retention_compliance_cannot_shorten() {
 }
 
 #[tokio::test]
+#[serial]
 async fn test_put_retention_compliance_can_extend() {
     init_logging();
     info!("🧪 Test: PutObjectRetention can extend COMPLIANCE retention");
@@ -1484,6 +1509,7 @@ async fn test_put_retention_compliance_can_extend() {
 }
 
 #[tokio::test]
+#[serial]
 async fn test_put_retention_governance_extend_without_bypass() {
     init_logging();
     info!("🧪 Test: PutObjectRetention on GOVERNANCE can extend without bypass");
@@ -1527,6 +1553,7 @@ async fn test_put_retention_governance_extend_without_bypass() {
 }
 
 #[tokio::test]
+#[serial]
 async fn test_put_retention_governance_shorten_requires_bypass() {
     init_logging();
     info!("🧪 Test: PutObjectRetention on GOVERNANCE requires bypass to shorten");
@@ -1588,6 +1615,7 @@ async fn test_put_retention_governance_shorten_requires_bypass() {
 // ============================================================================
 
 #[tokio::test]
+#[serial]
 async fn test_default_retention_applied_to_new_objects() {
     init_logging();
     info!("🧪 Test: Default retention is applied to new objects");
@@ -1657,6 +1685,7 @@ async fn test_default_retention_applied_to_new_objects() {
 }
 
 #[tokio::test]
+#[serial]
 async fn test_delete_object_creates_delete_marker_for_default_retained_current_version() {
     init_logging();
     info!("🧪 Test: DeleteObject creates delete marker for default-retained current version");
@@ -1741,6 +1770,7 @@ async fn test_delete_object_creates_delete_marker_for_default_retained_current_v
 }
 
 #[tokio::test]
+#[serial]
 async fn test_put_copy_and_multipart_reject_incomplete_retention_headers() {
     init_logging();
     info!("🧪 Test: write paths reject incomplete Object Lock retention headers");
@@ -1839,6 +1869,7 @@ async fn test_put_copy_and_multipart_reject_incomplete_retention_headers() {
 }
 
 #[tokio::test]
+#[serial]
 async fn test_copy_object_retention_uses_destination_policy() {
     init_logging();
     info!("🧪 Test: CopyObject retention follows destination policy");
@@ -2020,6 +2051,7 @@ async fn test_copy_object_retention_uses_destination_policy() {
 }
 
 #[tokio::test]
+#[serial]
 async fn test_multipart_default_retention_fixed_at_create() {
     init_logging();
     info!("🧪 Test: multipart default retention is fixed at CreateMultipartUpload");
@@ -2090,6 +2122,7 @@ async fn test_multipart_default_retention_fixed_at_create() {
 // ============================================================================
 
 #[tokio::test]
+#[serial]
 async fn test_unretained_object_lock_object_delete_and_bucket_cleanup() {
     init_logging();
     info!("🧪 Test: Unretained Object Lock object delete and bucket cleanup (Issue #5339)");
@@ -2210,6 +2243,7 @@ async fn test_unretained_object_lock_object_delete_and_bucket_cleanup() {
 }
 
 #[tokio::test]
+#[serial]
 async fn test_versioning_auto_enabled_with_object_lock() {
     init_logging();
     info!("🧪 Test: Versioning is auto-enabled when Object Lock is configured");
@@ -2268,6 +2302,7 @@ async fn test_versioning_auto_enabled_with_object_lock() {
 // ============================================================================
 
 #[tokio::test]
+#[serial]
 async fn test_error_message_distinguishes_legal_hold_from_retention() {
     init_logging();
     info!("🧪 Test: Error messages distinguish Legal Hold from Retention");

crates/e2e_test/src/replication_extension_test.rs

@@ -60,6 +60,7 @@ use rustfs_signer::constants::UNSIGNED_PAYLOAD;
 use rustfs_signer::sign_v4;
 use s3s::Body;
 use s3s::header::X_AMZ_REPLICATION_STATUS;
+use serial_test::serial;
 use sha2::{Digest, Sha256};
 use std::collections::BTreeMap;
 use std::convert::Infallible;
@@ -2505,6 +2506,7 @@ async fn build_replication_pair(
 /// metadata was inherited wholesale from the source, so the scanner heal pass
 /// skipped it too — no PENDING/FAILED marker meant nothing to re-drive).
 #[tokio::test]
+#[serial]
 async fn test_copy_object_replicates_to_target() -> TestResult {
     init_logging();
 
@@ -2553,6 +2555,7 @@ async fn test_copy_object_replicates_to_target() -> TestResult {
 /// independent object; every member must replicate to the remote target like a
 /// regular PUT (MinIO PutObjectExtract parity).
 #[tokio::test]
+#[serial]
 async fn test_snowball_extract_replicates_members_to_target() -> TestResult {
     init_logging();
 
@@ -2598,6 +2601,7 @@ async fn test_snowball_extract_replicates_members_to_target() -> TestResult {
 }
 
 #[tokio::test]
+#[serial]
 async fn test_replication_check_succeeds_with_remote_target() -> Result<(), Box<dyn Error + Send + Sync>> {
     init_logging();
 
@@ -2634,6 +2638,7 @@ async fn test_replication_check_succeeds_with_remote_target() -> Result<(), Box<
 }
 
 #[tokio::test]
+#[serial]
 async fn test_replication_check_rejects_target_without_object_lock() -> Result<(), Box<dyn Error + Send + Sync>> {
     init_logging();
 
@@ -2687,6 +2692,7 @@ async fn test_replication_check_rejects_target_without_object_lock() -> Result<(
 }
 
 #[tokio::test]
+#[serial]
 async fn test_set_remote_target_rejects_unversioned_source_bucket() -> Result<(), Box<dyn Error + Send + Sync>> {
     init_logging();
 
@@ -2725,6 +2731,7 @@ async fn test_set_remote_target_rejects_unversioned_source_bucket() -> Result<()
 }
 
 #[tokio::test]
+#[serial]
 async fn test_replication_check_rejects_unversioned_source_bucket() -> Result<(), Box<dyn Error + Send + Sync>> {
     init_logging();
 
@@ -2748,6 +2755,7 @@ async fn test_replication_check_rejects_unversioned_source_bucket() -> Result<()
 }
 
 #[tokio::test]
+#[serial]
 async fn test_replication_check_rejects_missing_replication_config() -> Result<(), Box<dyn Error + Send + Sync>> {
     init_logging();
 
@@ -2771,6 +2779,7 @@ async fn test_replication_check_rejects_missing_replication_config() -> Result<(
 }
 
 #[tokio::test]
+#[serial]
 async fn test_replication_check_rejects_invalid_bucket() -> Result<(), Box<dyn Error + Send + Sync>> {
     init_logging();
 
@@ -2789,6 +2798,7 @@ async fn test_replication_check_rejects_invalid_bucket() -> Result<(), Box<dyn E
 }
 
 #[tokio::test]
+#[serial]
 async fn test_set_remote_target_rejects_same_bucket_on_same_deployment() -> Result<(), Box<dyn Error + Send + Sync>> {
     init_logging();
 
@@ -2832,6 +2842,7 @@ async fn test_set_remote_target_rejects_same_bucket_on_same_deployment() -> Resu
 }
 
 #[tokio::test]
+#[serial]
 async fn test_set_remote_target_rejects_unversioned_target_bucket() -> Result<(), Box<dyn Error + Send + Sync>> {
     init_logging();
 
@@ -2865,6 +2876,7 @@ async fn test_set_remote_target_rejects_unversioned_target_bucket() -> Result<()
 }
 
 #[tokio::test]
+#[serial]
 async fn test_set_remote_target_update_requires_arn() -> Result<(), Box<dyn Error + Send + Sync>> {
     init_logging();
 
@@ -2916,6 +2928,7 @@ async fn test_set_remote_target_update_requires_arn() -> Result<(), Box<dyn Erro
 }
 
 #[tokio::test]
+#[serial]
 async fn test_set_remote_target_update_rejects_missing_target() -> Result<(), Box<dyn Error + Send + Sync>> {
     init_logging();
 
@@ -3004,6 +3017,7 @@ async fn fetch_single_target(
 }
 
 #[tokio::test]
+#[serial]
 async fn test_set_remote_target_partial_update_preserves_credentials() -> Result<(), Box<dyn Error + Send + Sync>> {
     init_logging();
 
@@ -3089,6 +3103,7 @@ async fn test_set_remote_target_partial_update_preserves_credentials() -> Result
 }
 
 #[tokio::test]
+#[serial]
 async fn test_set_remote_target_rejects_invalid_target_url() -> Result<(), Box<dyn Error + Send + Sync>> {
     init_logging();
 
@@ -3130,6 +3145,7 @@ async fn test_set_remote_target_rejects_invalid_target_url() -> Result<(), Box<d
 }
 
 #[tokio::test]
+#[serial]
 async fn test_set_remote_target_rejects_self_signed_https_target_without_skip_tls_verify()
 -> Result<(), Box<dyn Error + Send + Sync>> {
     init_logging();
@@ -3214,6 +3230,7 @@ async fn test_set_remote_target_rejects_self_signed_https_target_without_skip_tl
 }
 
 #[tokio::test]
+#[serial]
 async fn test_set_remote_target_allows_self_signed_https_target_with_skip_tls_verify() -> Result<(), Box<dyn Error + Send + Sync>>
 {
     init_logging();
@@ -3325,6 +3342,7 @@ async fn test_set_remote_target_allows_self_signed_https_target_with_skip_tls_ve
 }
 
 #[tokio::test]
+#[serial]
 async fn test_set_remote_target_rejects_private_ca_https_target_without_ca_cert_pem() -> Result<(), Box<dyn Error + Send + Sync>>
 {
     init_logging();
@@ -3409,6 +3427,7 @@ async fn test_set_remote_target_rejects_private_ca_https_target_without_ca_cert_
 }
 
 #[tokio::test]
+#[serial]
 async fn test_set_remote_target_allows_private_ca_https_target_with_ca_cert_pem() -> Result<(), Box<dyn Error + Send + Sync>> {
     init_logging();
 
@@ -3499,6 +3518,7 @@ async fn test_set_remote_target_allows_private_ca_https_target_with_ca_cert_pem(
 }
 
 #[tokio::test]
+#[serial]
 async fn test_list_remote_targets_rejects_empty_bucket() -> Result<(), Box<dyn Error + Send + Sync>> {
     init_logging();
 
@@ -3518,6 +3538,7 @@ async fn test_list_remote_targets_rejects_empty_bucket() -> Result<(), Box<dyn E
 }
 
 #[tokio::test]
+#[serial]
 async fn test_list_remote_targets_rejects_invalid_bucket() -> Result<(), Box<dyn Error + Send + Sync>> {
     init_logging();
 
@@ -3536,6 +3557,7 @@ async fn test_list_remote_targets_rejects_invalid_bucket() -> Result<(), Box<dyn
 }
 
 #[tokio::test]
+#[serial]
 async fn test_remove_remote_target_rejects_missing_target() -> Result<(), Box<dyn Error + Send + Sync>> {
     init_logging();
 
@@ -3576,6 +3598,7 @@ async fn test_remove_remote_target_rejects_missing_target() -> Result<(), Box<dy
 }
 
 #[tokio::test]
+#[serial]
 async fn test_remove_remote_target_rejects_missing_arn() -> Result<(), Box<dyn Error + Send + Sync>> {
     init_logging();
 
@@ -3600,6 +3623,7 @@ async fn test_remove_remote_target_rejects_missing_arn() -> Result<(), Box<dyn E
 }
 
 #[tokio::test]
+#[serial]
 async fn test_remove_remote_target_rejects_invalid_bucket() -> Result<(), Box<dyn Error + Send + Sync>> {
     init_logging();
 
@@ -3623,6 +3647,7 @@ async fn test_remove_remote_target_rejects_invalid_bucket() -> Result<(), Box<dy
 }
 
 #[tokio::test]
+#[serial]
 async fn test_remove_remote_target_rejects_target_used_by_replication() -> Result<(), Box<dyn Error + Send + Sync>> {
     init_logging();
 
@@ -3662,6 +3687,7 @@ async fn test_remove_remote_target_rejects_target_used_by_replication() -> Resul
 }
 
 #[tokio::test]
+#[serial]
 async fn test_delete_bucket_replication_removes_remote_target() -> Result<(), Box<dyn Error + Send + Sync>> {
     init_logging();
 
@@ -3711,6 +3737,7 @@ async fn test_delete_bucket_replication_removes_remote_target() -> Result<(), Bo
 }
 
 #[tokio::test]
+#[serial]
 async fn test_bucket_replication_replicates_put_object_issue_2539() -> Result<(), Box<dyn Error + Send + Sync>> {
     init_logging();
 
@@ -3752,6 +3779,7 @@ async fn test_bucket_replication_replicates_put_object_issue_2539() -> Result<()
 }
 
 #[tokio::test]
+#[serial]
 async fn test_bucket_replication_converges_delete_marker_and_version_purge() -> TestResult {
     init_logging();
 
@@ -3850,6 +3878,7 @@ async fn test_bucket_replication_converges_delete_marker_and_version_purge() ->
 }
 
 #[tokio::test]
+#[serial]
 async fn test_bucket_replication_disabled_delete_marker_does_not_propagate() -> TestResult {
     init_logging();
 
@@ -3936,6 +3965,7 @@ async fn test_bucket_replication_disabled_delete_marker_does_not_propagate() ->
 /// interoperability profile for a runner that provisions MinIO credentials
 /// and a reachable endpoint.
 #[tokio::test]
+#[serial]
 async fn test_bucket_replication_acceptance_matrix_local_dual_targets() -> TestResult {
     init_logging();
 
@@ -4263,6 +4293,7 @@ async fn test_bucket_replication_acceptance_matrix_local_dual_targets() -> TestR
 }
 
 #[tokio::test]
+#[serial]
 async fn test_single_bucket_multipart_replication_fans_out_to_multiple_targets() -> Result<(), Box<dyn Error + Send + Sync>> {
     init_logging();
 
@@ -4431,6 +4462,7 @@ async fn test_repl17_failure_observation_helpers() -> TestResult {
 /// the replica is decryptable only with the original customer key. The
 /// backlog#1291 property still holds: never a silent plaintext replica.
 #[tokio::test]
+#[serial]
 async fn test_bucket_replication_sse_c_contract() -> TestResult {
     init_logging();
 
@@ -4508,6 +4540,7 @@ async fn test_bucket_replication_sse_c_contract() -> TestResult {
 /// part — part boundaries and the encrypted-multipart marker survive so the
 /// replica decrypts each part with its part-derived nonce.
 #[tokio::test]
+#[serial]
 async fn test_bucket_replication_sse_c_multipart_passthrough() -> TestResult {
     init_logging();
 
@@ -4624,6 +4657,7 @@ async fn test_bucket_replication_sse_c_multipart_passthrough() -> TestResult {
 /// (independent KMS, so success proves target-owned envelopes), preserved
 /// source ETag, and a version that stays stable across scanner cycles.
 #[tokio::test]
+#[serial]
 async fn test_bucket_replication_sse_s3_contract() -> TestResult {
     init_logging();
     assert_managed_sse_replicates_and_reencrypts("sse-s3", false).await
@@ -4633,6 +4667,7 @@ async fn test_bucket_replication_sse_s3_contract() -> TestResult {
 /// fail closed — replication FAILED, and no plaintext (or any) replica ever
 /// materializes on the target.
 #[tokio::test]
+#[serial]
 async fn test_bucket_replication_sse_s3_fails_closed_without_target_kms() -> TestResult {
     init_logging();
 
@@ -4676,6 +4711,7 @@ async fn test_bucket_replication_sse_s3_fails_closed_without_target_kms() -> Tes
 /// the ETag comparison sees the preserved source ETag on the replica and does
 /// not rewrite it, so the replica's version stays stable through the resync.
 #[tokio::test]
+#[serial]
 async fn test_bucket_replication_sse_s3_resync_converges() -> TestResult {
     init_logging();
 
@@ -4732,6 +4768,7 @@ async fn test_bucket_replication_sse_s3_resync_converges() -> TestResult {
 /// re-encrypts under its own default key. The independent-KMS pair proves the
 /// replica's envelope is target-owned.
 #[tokio::test]
+#[serial]
 async fn test_bucket_replication_sse_kms_contract() -> TestResult {
     init_logging();
     assert_managed_sse_replicates_and_reencrypts("sse-kms", true).await
@@ -4742,6 +4779,7 @@ async fn test_bucket_replication_sse_kms_contract() -> TestResult {
 /// carries the full header set (SSE intent, content-type, user metadata) and
 /// the completed replica preserves the source's multipart ETag.
 #[tokio::test]
+#[serial]
 async fn test_bucket_replication_sse_s3_multipart_reencrypts() -> TestResult {
     init_logging();
 
@@ -4835,6 +4873,7 @@ async fn test_bucket_replication_sse_s3_multipart_reencrypts() -> TestResult {
 /// still-running source's data scanner (short cycle via [`FAST_SCANNER_ENV`])
 /// re-drives the failed objects once the target is reachable again.
 #[tokio::test]
+#[serial]
 async fn test_bucket_replication_recovers_after_target_outage() -> TestResult {
     init_logging();
 
@@ -4914,6 +4953,7 @@ async fn test_bucket_replication_recovers_after_target_outage() -> TestResult {
 /// must settle back to zero even though the historical failed counter remains
 /// non-zero.
 #[tokio::test]
+#[serial]
 async fn test_bucket_replication_backlog_metrics_observe_outage_and_recovery() -> TestResult {
     init_logging();
 
@@ -5047,6 +5087,7 @@ async fn test_bucket_replication_backlog_metrics_observe_outage_and_recovery() -
 /// must converge every persisted failure, including the replayed delete marker
 /// (whose replication decision is re-derived from the live config).
 #[tokio::test]
+#[serial]
 async fn test_bucket_replication_replays_failed_entries_after_source_restart() -> TestResult {
     init_logging();
 
@@ -5138,6 +5179,7 @@ async fn test_bucket_replication_replays_failed_entries_after_source_restart() -
 }
 
 #[tokio::test]
+#[serial]
 async fn test_bucket_replication_replayed_delete_marker_preserves_source_mtime_without_source_restart() -> TestResult {
     init_logging();
 
@@ -5207,6 +5249,7 @@ async fn test_bucket_replication_replayed_delete_marker_preserves_source_mtime_w
 }
 
 #[tokio::test]
+#[serial]
 async fn test_sequential_bucket_replication_succeeds_for_multiple_buckets() -> Result<(), Box<dyn Error + Send + Sync>> {
     init_logging();
 
@@ -5250,6 +5293,7 @@ async fn test_sequential_bucket_replication_succeeds_for_multiple_buckets() -> R
 }
 
 #[tokio::test]
+#[serial]
 async fn test_replication_recovers_after_runtime_target_cache_is_cleared() -> Result<(), Box<dyn Error + Send + Sync>> {
     init_logging();
 
@@ -5293,6 +5337,7 @@ async fn test_replication_recovers_after_runtime_target_cache_is_cleared() -> Re
 }
 
 #[tokio::test]
+#[serial]
 async fn test_site_replication_allows_self_signed_https_with_skip_tls_verify_real_dual_node() -> TestResult {
     init_logging();
 
@@ -5371,6 +5416,7 @@ async fn test_site_replication_allows_self_signed_https_with_skip_tls_verify_rea
 }
 
 #[tokio::test]
+#[serial]
 async fn test_site_replication_allows_private_ca_https_with_ca_cert_pem_real_dual_node() -> TestResult {
     init_logging();
 
@@ -5449,6 +5495,7 @@ async fn test_site_replication_allows_private_ca_https_with_ca_cert_pem_real_dua
 }
 
 #[tokio::test]
+#[serial]
 async fn test_site_replication_resync_lifecycle_survives_real_server_restart() -> Result<(), Box<dyn Error + Send + Sync>> {
     init_logging();
     let resync_process_env = [
@@ -5668,6 +5715,7 @@ async fn test_site_replication_resync_lifecycle_survives_real_server_restart() -
 }
 
 #[tokio::test]
+#[serial]
 async fn test_site_replication_edit_and_status_peer_state_real_three_node() -> Result<(), Box<dyn Error + Send + Sync>> {
     init_logging();
 
@@ -5916,6 +5964,7 @@ async fn test_site_replication_edit_and_status_peer_state_real_three_node() -> R
 }
 
 #[tokio::test]
+#[serial]
 async fn test_site_replication_remove_all_real_dual_node() -> Result<(), Box<dyn Error + Send + Sync>> {
     init_logging();
 
@@ -6035,6 +6084,7 @@ async fn test_site_replication_remove_all_real_dual_node() -> Result<(), Box<dyn
 }
 
 #[tokio::test]
+#[serial]
 async fn test_site_replication_state_edit_fresh_and_stale_real_dual_node() -> Result<(), Box<dyn Error + Send + Sync>> {
     init_logging();
 
@@ -6143,6 +6193,7 @@ async fn test_site_replication_state_edit_fresh_and_stale_real_dual_node() -> Re
 }
 
 #[tokio::test]
+#[serial]
 async fn test_site_replication_replicates_object_with_bucket_versioning_real_dual_node() -> TestResult {
     init_logging();
 
@@ -6233,6 +6284,7 @@ async fn test_site_replication_replicates_object_with_bucket_versioning_real_dua
 /// receiver was dropped with only a debug line, while `replicate status` still reported
 /// "1/1 Buckets in sync" because both configs were byte-identical.
 #[tokio::test]
+#[serial]
 async fn test_site_replication_config_broadcast_keeps_reverse_direction_real_dual_node() -> TestResult {
     init_logging();
 
@@ -6371,6 +6423,7 @@ async fn wait_for_site_replication_rule(
 }
 
 #[tokio::test]
+#[serial]
 async fn test_site_replication_active_active_converges_without_loops_real_dual_node() -> TestResult {
     init_logging();
 
@@ -6688,6 +6741,7 @@ async fn test_site_replication_active_active_converges_without_loops_real_dual_n
 }
 
 #[tokio::test]
+#[serial]
 async fn test_site_replication_replicates_policy_backed_user_access_real_dual_node() -> Result<(), Box<dyn Error + Send + Sync>> {
     init_logging();
 
@@ -6775,6 +6829,7 @@ async fn test_site_replication_replicates_policy_backed_user_access_real_dual_no
 }
 
 #[tokio::test]
+#[serial]
 async fn test_site_replication_replicates_group_policy_backed_access_real_dual_node() -> Result<(), Box<dyn Error + Send + Sync>>
 {
     init_logging();
@@ -6865,6 +6920,7 @@ async fn test_site_replication_replicates_group_policy_backed_access_real_dual_n
 }
 
 #[tokio::test]
+#[serial]
 async fn test_service_account_policy_from_accountinfo_round_trips_real_single_node() -> TestResult {
     init_logging();
 
@@ -6916,6 +6972,7 @@ async fn test_service_account_policy_from_accountinfo_round_trips_real_single_no
 }
 
 #[tokio::test]
+#[serial]
 async fn test_site_replication_replicates_multiple_service_accounts_real_dual_node() -> Result<(), Box<dyn Error + Send + Sync>> {
     init_logging();
 
@@ -7016,6 +7073,7 @@ async fn test_site_replication_replicates_multiple_service_accounts_real_dual_no
 }
 
 #[tokio::test]
+#[serial]
 async fn test_site_replication_replicates_service_accounts_created_from_sts_session_real_dual_node() -> TestResult {
     init_logging();
 
@@ -7156,6 +7214,7 @@ async fn wait_for_target_request_version_id(
 }
 
 #[tokio::test]
+#[serial]
 async fn test_bucket_resync_restart_revisits_objects_before_out_of_order_checkpoint() -> TestResult {
     init_logging();
 
@@ -7274,6 +7333,7 @@ async fn test_bucket_resync_restart_revisits_objects_before_out_of_order_checkpo
 /// CreateMultipartUpload (the version is decided at initiate time) must both
 /// carry the source version as `?versionId=`.
 #[tokio::test]
+#[serial]
 async fn test_replication_put_and_create_multipart_carry_source_version_id_query() -> TestResult {
     init_logging();
 
@@ -7388,6 +7448,7 @@ async fn test_replication_put_and_create_multipart_carry_source_version_id_query
 /// flow to the onward bucket, proving B's outbound replication and scanner
 /// are live.
 #[tokio::test]
+#[serial]
 async fn test_scanner_never_cascades_inbound_replicas() -> TestResult {
     init_logging();
 
@@ -7468,6 +7529,7 @@ async fn test_scanner_never_cascades_inbound_replicas() -> TestResult {
 /// version ids and still mint its own there — the check must not report OK
 /// while multipart deletes and heals would silently miss.
 #[tokio::test]
+#[serial]
 async fn test_replication_check_flags_multipart_only_version_minting_target() -> TestResult {
     init_logging();
 
@@ -7540,6 +7602,7 @@ async fn test_replication_check_flags_multipart_only_version_minting_target() ->
 }
 
 #[tokio::test]
+#[serial]
 async fn test_replication_check_aborts_failed_multipart_probes() -> TestResult {
     init_logging();
 
@@ -7702,6 +7765,7 @@ async fn test_replication_check_aborts_failed_multipart_probes() -> TestResult {
 /// BucketRemoteTargetVersionMismatch — while still cleaning up the probe
 /// object via the version id the target actually assigned.
 #[tokio::test]
+#[serial]
 async fn test_replication_check_flags_version_minting_target() -> TestResult {
     init_logging();
 
@@ -7942,6 +8006,7 @@ async fn wait_for_target_marker_purged(
 /// the target forever. Contract under test: a failed purge attempt is retried
 /// within the watch window and converges once the fault clears.
 #[tokio::test]
+#[serial]
 async fn test_delayed_delete_marker_purge_retries_after_transient_target_failure() -> TestResult {
     init_logging();
     let source_bucket = "delayed-purge-retry-src";
@@ -8001,6 +8066,7 @@ async fn test_delayed_delete_marker_purge_retries_after_transient_target_failure
 /// with an idempotent 204, which used to look like success and strand the
 /// real marker on the target forever.
 #[tokio::test]
+#[serial]
 async fn test_delayed_delete_marker_purge_uses_target_assigned_version() -> TestResult {
     init_logging();
     let source_bucket = "delayed-purge-mint-src";
@@ -8033,6 +8099,7 @@ async fn test_delayed_delete_marker_purge_uses_target_assigned_version() -> Test
 /// replayed purge succeeds, the entry must be acknowledged instead of being
 /// retained as Missed forever.
 #[tokio::test]
+#[serial]
 async fn test_delayed_delete_marker_purge_exhaustion_persists_to_mrf_and_replays_on_restart() -> TestResult {
     init_logging();
     let source_bucket = "delayed-purge-mrf-src";
@@ -8169,6 +8236,7 @@ async fn build_scanner_compensation_pair(
 /// nil-version objects entirely (`scanner_folder.rs` heal_replication), so it
 /// must NEVER be compensated.
 #[tokio::test]
+#[serial]
 async fn test_scanner_compensates_existing_objects_across_write_paths() -> TestResult {
     init_logging();
     let source_bucket = "scanner-comp-src";
@@ -8284,6 +8352,7 @@ async fn test_scanner_compensates_existing_objects_across_write_paths() -> TestR
 /// written after the rule replicate normally (the setting only gates the
 /// existing-object resync path).
 #[tokio::test]
+#[serial]
 async fn test_scanner_never_compensates_when_existing_object_replication_disabled() -> TestResult {
     init_logging();
     let source_bucket = "scanner-disabled-src";

crates/ecstore/Cargo.toml

@@ -273,7 +273,6 @@ proptest = "1"
 rcgen.workspace = true
 insta = { workspace = true, features = ["yaml", "json"] }
 rustfs-crypto = { workspace = true }
-tonic-prost = { workspace = true }
 
 [build-dependencies]
 shadow-rs = { workspace = true, default-features = false, features = ["build", "metadata"] }

crates/ecstore/src/api/mod.rs

@@ -373,14 +373,14 @@ pub mod error {
 
 pub mod erasure {
     pub use crate::erasure::coding::{
-        BitrotReader, BitrotSelfTestError, BitrotWriter, BitrotWriterWrapper, CustomWriter, Erasure, ErasureConstructionError,
-        ReedSolomonEncoder, bitrot_self_test, calc_shard_size, calc_shard_size_legacy,
+        BitrotReader, BitrotWriter, BitrotWriterWrapper, CustomWriter, Erasure, ErasureConstructionError, ReedSolomonEncoder,
+        calc_shard_size, calc_shard_size_legacy,
     };
 }
 
 pub mod event {
     pub use crate::event::name::EventName;
-    pub use crate::services::event_notification::{EventArgs, register_event_dispatch_hook, send_event};
+    pub use crate::services::event_notification::{EventArgs, register_event_dispatch_hook};
 }
 
 pub mod global {
@@ -483,7 +483,6 @@ pub mod store_list {
 }
 
 pub mod storage {
-    pub use crate::core::pools::HealLifecycleExpiryContext;
     pub use crate::store::HealWalkVersion;
     pub use crate::store::{
         ECStore, all_local_disk, all_local_disk_path, find_local_disk_by_ref, init_local_disks,

crates/ecstore/src/bucket/bucket_target_sys.rs

@@ -1549,8 +1549,8 @@ impl Default for PutObjectOptions {
     }
 }
 
+#[allow(dead_code)]
 impl PutObjectOptions {
-    #[allow(dead_code, reason = "MinIO-parity surface with no caller in this port (backlog#1823)")]
     fn set_match_etag(&mut self, etag: &str) {
         if etag == "*" {
             self.custom_header
@@ -1561,7 +1561,6 @@ impl PutObjectOptions {
         }
     }
 
-    #[allow(dead_code, reason = "MinIO-parity surface with no caller in this port (backlog#1823)")]
     fn set_match_etag_except(&mut self, etag: &str) {
         if etag == "*" {
             self.custom_header
@@ -1697,7 +1696,6 @@ impl PutObjectOptions {
         header
     }
 
-    #[allow(dead_code, reason = "MinIO-parity surface with no caller in this port (backlog#1823)")]
     fn validate(&self, _c: Arc<TargetClient>) -> Result<(), std::io::Error> {
         //if self.checksum.is_set() {
         /*if !self.trailing_header_support {

crates/ecstore/src/bucket/lifecycle/bucket_lifecycle_ops.rs

@@ -456,23 +456,16 @@ impl<'a> LifecycleExpiryTrace<'a> {
     }
 }
 
+#[allow(dead_code)]
 impl ExpiryStats {
     pub fn missed_tasks(&self) -> i64 {
         self.missed_expiry_tasks.load(Ordering::SeqCst)
     }
 
-    #[allow(
-        dead_code,
-        reason = "asserted by this file's tests; the lib target cannot see test-only consumers (backlog#1823)"
-    )]
     fn missed_free_vers_tasks(&self) -> i64 {
         self.missed_freevers_tasks.load(Ordering::SeqCst)
     }
 
-    #[allow(
-        dead_code,
-        reason = "asserted by this file's tests; the lib target cannot see test-only consumers (backlog#1823)"
-    )]
     fn missed_tier_journal_tasks(&self) -> i64 {
         self.missed_tier_journal_tasks.load(Ordering::SeqCst)
     }
@@ -1783,7 +1776,7 @@ impl TransitionState {
                                 .await;
                             }
                             global_metrics().record_scanner_transition_failed(1);
-                            if !is_err_version_not_found(&err) && !is_err_object_not_found(&err) && !is_network_or_host_down(&err.to_string(), false) {
+                            if !is_err_version_not_found(&err) && !is_err_object_not_found(&err) && !is_network_or_host_down(&err.to_string(), false) && !err.to_string().contains("use of closed network connection") {
                                 error!(
                                     event = EVENT_LIFECYCLE_TIER_OPERATION_FAILED,
                                     component = LOG_COMPONENT_ECSTORE,

crates/ecstore/src/bucket/lifecycle/mod.rs

@@ -19,7 +19,7 @@ pub mod core;
 pub mod evaluator;
 pub mod manual_transition_job;
 mod metadata_boundary;
-pub(crate) use metadata_boundary::{LifecycleExpiryConfigs, get_expiry_configs};
+pub(crate) use metadata_boundary::get_expiry_configs;
 mod object_lock_boundary;
 pub use self::core as lifecycle;
 mod replication_sink;

crates/ecstore/src/bucket/lifecycle/tier_last_day_stats.rs

@@ -80,10 +80,7 @@ impl LastDayTierStats {
         }
     }
 
-    #[allow(
-        dead_code,
-        reason = "asserted by this file's tests; the lib target cannot see test-only consumers (backlog#1823)"
-    )]
+    #[allow(dead_code)]
     fn merge(&self, m: LastDayTierStats) -> LastDayTierStats {
         let mut cl = self.clone();
         let mut cm = m;

crates/ecstore/src/bucket/lifecycle/tier_sweeper.rs

@@ -177,10 +177,9 @@ fn should_record_remote_delete_failure(err: &std::io::Error) -> bool {
 }
 
 #[derive(Default)]
+#[allow(dead_code)]
 struct ObjSweeper {
-    #[allow(dead_code, reason = "written but never read back (backlog#1823)")]
     object: String,
-    #[allow(dead_code, reason = "written but never read back (backlog#1823)")]
     bucket: String,
     version_id: Option<Uuid>,
     versioned: bool,
@@ -192,9 +191,9 @@ struct ObjSweeper {
     remote_object: String,
 }
 
+#[allow(dead_code)]
 impl ObjSweeper {
     #[allow(clippy::new_ret_no_self)]
-    #[allow(dead_code, reason = "MinIO-parity surface with no caller in this port (backlog#1823)")]
     pub async fn new(bucket: &str, object: &str) -> Result<Self, std::io::Error> {
         Ok(Self {
             object: object.into(),
@@ -203,20 +202,17 @@ impl ObjSweeper {
         })
     }
 
-    #[allow(dead_code, reason = "MinIO-parity surface with no caller in this port (backlog#1823)")]
     pub fn with_version(&mut self, vid: Option<Uuid>) -> &Self {
         self.version_id = vid.clone();
         self
     }
 
-    #[allow(dead_code, reason = "MinIO-parity surface with no caller in this port (backlog#1823)")]
     pub fn with_versioning(&mut self, versioned: bool, suspended: bool) -> &Self {
         self.versioned = versioned;
         self.suspended = suspended;
         self
     }
 
-    #[allow(dead_code, reason = "MinIO-parity surface with no caller in this port (backlog#1823)")]
     pub fn get_opts(&self) -> lifecycle::ObjectOpts {
         let mut opts = ObjectOpts {
             version_id: self.version_id.clone(),
@@ -230,7 +226,6 @@ impl ObjSweeper {
         opts
     }
 
-    #[allow(dead_code, reason = "MinIO-parity surface with no caller in this port (backlog#1823)")]
     pub fn set_transition_state(&mut self, info: TransitionedObject) {
         self.transition_tier = info.tier;
         self.transition_status = info.status;
@@ -271,7 +266,6 @@ impl ObjSweeper {
         None
     }
 
-    #[allow(dead_code, reason = "MinIO-parity surface with no caller in this port (backlog#1823)")]
     pub async fn sweep(&self, api: Arc<ECStore>) {
         let Some(je) = self.should_remove_remote_object() else {
             return;

crates/ecstore/src/bucket/quota/mod.rs

@@ -312,7 +312,9 @@ mod tests {
         }
         #[derive(Deserialize)]
         struct LegacyBucketQuota {
+            #[allow(dead_code)]
             quota: Option<u64>,
+            #[allow(dead_code)]
             quota_type: LegacyQuotaType,
         }
         let legacy = serde_json::from_slice::<LegacyBucketQuota>(&json)

crates/ecstore/src/client/api_get_object.rs

@@ -95,6 +95,7 @@ impl TransitionClient {
 }
 
 #[derive(Default)]
+#[allow(dead_code)]
 pub struct GetRequest {
     pub buffer: Vec<u8>,
     pub offset: i64,
@@ -106,12 +107,11 @@ pub struct GetRequest {
     pub setting_object_info: bool,
 }
 
+#[allow(dead_code)]
 pub struct GetResponse {
     pub size: i64,
     //pub error:       error,
-    #[allow(dead_code, reason = "written but never read back (backlog#1823)")]
     pub did_read: bool,
-    #[allow(dead_code, reason = "written but never read back (backlog#1823)")]
     pub object_info: ObjectInfo,
 }
 

crates/ecstore/src/client/api_get_options.rs

@@ -20,7 +20,6 @@
 #![allow(clippy::all)]
 
 use http::{HeaderMap, HeaderName, HeaderValue};
-use rustfs_utils::http::headers::AMZ_CHECKSUM_MODE;
 use std::collections::HashMap;
 use time::OffsetDateTime;
 use tracing::warn;
@@ -28,6 +27,7 @@ use tracing::warn;
 use crate::client::api_error_response::err_invalid_argument;
 
 #[derive(Default)]
+#[allow(dead_code)]
 pub struct AdvancedGetOptions {
     pub replication_delete_marker: bool,
     pub is_replication_ready_for_delete_marker: bool,
@@ -77,7 +77,7 @@ impl GetObjectOptions {
             }
         }
         if self.checksum {
-            headers.insert(HeaderName::from_static(AMZ_CHECKSUM_MODE), HeaderValue::from_static("ENABLED"));
+            headers.insert(HeaderName::from_static("x-amz-checksum-mode"), HeaderValue::from_static("ENABLED"));
         }
         headers
     }

crates/ecstore/src/client/api_list.rs

@@ -360,6 +360,7 @@ impl TransitionClient {
 }
 
 #[derive(Default)]
+#[allow(dead_code)]
 pub struct ListObjectsOptions {
     reverse_versions: bool,
     with_versions: bool,

crates/ecstore/src/client/api_put_object.rs

@@ -137,8 +137,8 @@ impl Default for PutObjectOptions {
     }
 }
 
+#[allow(dead_code)]
 impl PutObjectOptions {
-    #[allow(dead_code, reason = "MinIO-parity surface with no caller in this port (backlog#1823)")]
     fn set_match_etag(&mut self, etag: &str) {
         if etag == "*" {
             self.custom_header.insert("If-Match", HeaderValue::from_static("*"));
@@ -149,7 +149,6 @@ impl PutObjectOptions {
         }
     }
 
-    #[allow(dead_code, reason = "MinIO-parity surface with no caller in this port (backlog#1823)")]
     fn set_match_etag_except(&mut self, etag: &str) {
         if etag == "*" {
             self.custom_header.insert("If-None-Match", HeaderValue::from_static("*"));
@@ -260,7 +259,6 @@ impl PutObjectOptions {
         header
     }
 
-    #[allow(dead_code, reason = "MinIO-parity surface with no caller in this port (backlog#1823)")]
     fn validate(&self, c: TransitionClient) -> Result<(), std::io::Error> {
         //if self.checksum.is_set() {
         /*if !self.trailing_header_support {

crates/ecstore/src/client/api_remove.rs

@@ -55,6 +55,7 @@ pub struct RemoveBucketOptions {
 const DELETE_RESPONSE_PREVIEW_LEN: usize = 1024;
 
 #[derive(Debug)]
+#[allow(dead_code)]
 pub struct AdvancedRemoveOptions {
     pub replication_delete_marker: bool,
     pub replication_status: ReplicationStatus,
@@ -464,10 +465,10 @@ impl TransitionClient {
 }
 
 #[derive(Debug, Default)]
+#[allow(dead_code)]
 pub struct RemoveObjectError {
-    #[allow(dead_code, reason = "written but never read back (backlog#1823)")]
     object_name: String,
-    #[allow(dead_code, reason = "written but never read back (backlog#1823)")]
+    #[allow(dead_code)]
     version_id: String,
     err: Option<std::io::Error>,
 }

crates/ecstore/src/client/checksum.rs

@@ -372,8 +372,8 @@ pub struct Checksum {
     computed: bool,
 }
 
+#[allow(dead_code)]
 impl Checksum {
-    #[allow(dead_code, reason = "MinIO-parity surface with no caller in this port (backlog#1823)")]
     fn new(t: ChecksumMode, b: &[u8]) -> Checksum {
         if t.is_set() && b.len() == t.raw_byte_len() {
             return Checksum {
@@ -385,7 +385,7 @@ impl Checksum {
         Checksum::default()
     }
 
-    #[allow(dead_code, reason = "MinIO-parity surface with no caller in this port (backlog#1823)")]
+    #[allow(dead_code)]
     fn new_checksum_string(t: ChecksumMode, s: &str) -> Result<Checksum, std::io::Error> {
         let b = match base64_decode(s.as_bytes()) {
             Ok(b) => b,
@@ -412,7 +412,7 @@ impl Checksum {
         base64_encode(&self.r)
     }
 
-    #[allow(dead_code, reason = "MinIO-parity surface with no caller in this port (backlog#1823)")]
+    #[allow(dead_code)]
     fn raw(&self) -> Option<Vec<u8>> {
         if !self.is_set() {
             return None;

crates/ecstore/src/client/object_api_utils.rs

@@ -37,17 +37,16 @@ pub struct PutObjReader {
     //pub sealMD5Fn: SealMD5CurrFn,
 }
 
+#[allow(dead_code)]
 impl PutObjReader {
     pub fn new(reader: HashReader) -> Self {
         Self { reader }
     }
 
-    #[allow(dead_code, reason = "MinIO-parity surface with no caller in this port (backlog#1823)")]
     fn md5_current_hex_string(&self) -> String {
         self.reader.checksum().map(|v| v.encoded).unwrap_or_default()
     }
 
-    #[allow(dead_code, reason = "MinIO-parity surface with no caller in this port (backlog#1823)")]
     fn with_encryption(&mut self, enc_reader: HashReader) -> Result<(), std::io::Error> {
         self.reader = enc_reader;
 

crates/ecstore/src/client/transition_api.rs

@@ -54,10 +54,6 @@ use rustfs_config::MAX_S3_CLIENT_RESPONSE_SIZE;
 use rustfs_rio::HashReader;
 use rustfs_utils::HashAlgorithm;
 use rustfs_utils::{
-    http::headers::{
-        AMZ_CHECKSUM_CRC32, AMZ_CHECKSUM_CRC32C, AMZ_CHECKSUM_CRC64NVME, AMZ_CHECKSUM_MODE, AMZ_CHECKSUM_SHA1,
-        AMZ_CHECKSUM_SHA256,
-    },
     net::get_endpoint_url,
     retry::{DEFAULT_RETRY_CAP, DEFAULT_RETRY_UNIT, MAX_JITTER, MAX_RETRY, RetryTimer},
 };
@@ -1387,12 +1383,12 @@ pub(crate) fn to_object_info_for_provider(
     };
 
     // Extract checksums
-    let checksum_crc32 = get_header(AMZ_CHECKSUM_CRC32);
-    let checksum_crc32c = get_header(AMZ_CHECKSUM_CRC32C);
-    let checksum_sha1 = get_header(AMZ_CHECKSUM_SHA1);
-    let checksum_sha256 = get_header(AMZ_CHECKSUM_SHA256);
-    let checksum_crc64nvme = get_header(AMZ_CHECKSUM_CRC64NVME);
-    let checksum_mode = get_header(AMZ_CHECKSUM_MODE);
+    let checksum_crc32 = get_header("x-amz-checksum-crc32");
+    let checksum_crc32c = get_header("x-amz-checksum-crc32c");
+    let checksum_sha1 = get_header("x-amz-checksum-sha1");
+    let checksum_sha256 = get_header("x-amz-checksum-sha256");
+    let checksum_crc64nvme = get_header("x-amz-checksum-crc64nvme");
+    let checksum_mode = get_header("x-amz-checksum-mode");
 
     // Build and return the ObjectInfo struct
     Ok(ObjectInfo {

crates/ecstore/src/cluster/rpc/internode_data_transport.rs

@@ -233,17 +233,11 @@ pub struct NsScannerCapabilityRequest {
 #[async_trait]
 pub trait InternodeDataTransport: Send + Sync + std::fmt::Debug {
     async fn open_read(&self, request: ReadStreamRequest) -> Result<FileReader>;
-    async fn open_read_fresh(&self, request: ReadStreamRequest) -> Result<FileReader> {
-        self.open_read(request).await
-    }
     /// Opens an owned-chunk stream when this transport can retain receive-buffer
     /// ownership. `None` preserves the established `open_read` fallback.
     async fn open_read_chunks(&self, _request: ReadStreamRequest) -> Result<Option<ChunkReaderBox>> {
         Ok(None)
     }
-    async fn open_read_chunks_fresh(&self, request: ReadStreamRequest) -> Result<Option<ChunkReaderBox>> {
-        self.open_read_chunks(request).await
-    }
     async fn open_write(&self, request: WriteStreamRequest) -> Result<FileWriter>;
     async fn open_walk_dir(&self, request: WalkDirStreamRequest) -> Result<FileReader>;
     async fn open_ns_scanner(&self, _request: NsScannerStreamRequest) -> Result<FileReader> {
@@ -275,15 +269,6 @@ impl InternodeDataTransport for TcpHttpInternodeDataTransport {
         ))
     }
 
-    async fn open_read_fresh(&self, request: ReadStreamRequest) -> Result<FileReader> {
-        let url = build_read_file_stream_url(&request);
-        let mut headers = json_headers();
-        build_auth_headers(&url, &Method::GET, &mut headers)?;
-        Ok(Box::new(
-            HttpReader::new_fresh_connection_with_stall_timeout(url, Method::GET, headers, None, request.stall_timeout).await?,
-        ))
-    }
-
     async fn open_read_chunks(&self, request: ReadStreamRequest) -> Result<Option<ChunkReaderBox>> {
         let url = build_read_file_stream_url(&request);
         let mut headers = json_headers();
@@ -293,16 +278,6 @@ impl InternodeDataTransport for TcpHttpInternodeDataTransport {
         )))
     }
 
-    async fn open_read_chunks_fresh(&self, request: ReadStreamRequest) -> Result<Option<ChunkReaderBox>> {
-        let url = build_read_file_stream_url(&request);
-        let mut headers = json_headers();
-        build_auth_headers(&url, &Method::GET, &mut headers)?;
-        Ok(Some(Box::new(
-            HttpChunkReader::new_fresh_connection_with_stall_timeout(url, Method::GET, headers, None, request.stall_timeout)
-                .await?,
-        )))
-    }
-
     async fn open_write(&self, request: WriteStreamRequest) -> Result<FileWriter> {
         let server_epoch = self.put_file_auth_capability(&request.endpoint).await?;
         let nonce = server_epoch.map(|_| Uuid::new_v4());

crates/ecstore/src/cluster/rpc/peer_rest_client.rs

@@ -86,25 +86,6 @@ const PEER_REST_RECOVERY_MAX_BACKOFF: Duration = Duration::from_secs(30);
 const SCANNER_ACTIVITY_MAX_MESSAGE_SIZE: usize = 1024;
 const REPLICATION_STATS_MAX_MESSAGE_SIZE: usize = 8 * 1024 * 1024;
 
-/// Error for a peer that reported `success = false` without an `error_info` payload.
-///
-/// Same shape as `peer_s3_client::peer_failure_without_details`, over `StorageError`
-/// instead of `DiskError`. The message names the operation (and the bucket, where the
-/// operation has one) and nothing else, for two reasons:
-///
-/// - `finalize_result` classifies failures by message substring, so any text matching
-///   `message_has_network_needle` would take an answering peer offline and evict its
-///   connection over a plain application-level rejection.
-/// - Quorum aggregation (`reduce_errs`) buckets `Io` errors by kind plus rendered
-///   message, so a per-peer detail such as the peer address would split one shared
-///   failure into single-count buckets and downgrade the dominant error.
-fn peer_failure_without_details(op: &str, bucket: Option<&str>) -> Error {
-    match bucket {
-        Some(bucket) => Error::other(format!("{op}({bucket}): peer returned failure without error details")),
-        None => Error::other(format!("{op}: peer returned failure without error details")),
-    }
-}
-
 fn decode_bucket_stats_response(response: GetBucketStatsDataResponse) -> Result<BucketStats> {
     if !response.success {
         return Err(Error::other(
@@ -715,7 +696,7 @@ impl PeerRestClient {
             if let Some(msg) = response.error_info {
                 return Err(Error::other(msg));
             }
-            return Err(peer_failure_without_details("local_storage_info", None));
+            return Err(Error::other(""));
         }
         let data = response.storage_info;
 
@@ -738,7 +719,7 @@ impl PeerRestClient {
             if let Some(msg) = response.error_info {
                 return Err(Error::other(msg));
             }
-            return Err(peer_failure_without_details("server_info", None));
+            return Err(Error::other(""));
         }
         let data = response.server_properties;
 
@@ -761,7 +742,7 @@ impl PeerRestClient {
             if let Some(msg) = response.error_info {
                 return Err(Error::other(msg));
             }
-            return Err(peer_failure_without_details("get_cpus", None));
+            return Err(Error::other(""));
         }
         let data = response.cpus;
 
@@ -784,7 +765,7 @@ impl PeerRestClient {
             if let Some(msg) = response.error_info {
                 return Err(Error::other(msg));
             }
-            return Err(peer_failure_without_details("get_net_info", None));
+            return Err(Error::other(""));
         }
         let data = response.net_info;
 
@@ -807,7 +788,7 @@ impl PeerRestClient {
             if let Some(msg) = response.error_info {
                 return Err(Error::other(msg));
             }
-            return Err(peer_failure_without_details("get_partitions", None));
+            return Err(Error::other(""));
         }
         let data = response.partitions;
 
@@ -830,7 +811,7 @@ impl PeerRestClient {
             if let Some(msg) = response.error_info {
                 return Err(Error::other(msg));
             }
-            return Err(peer_failure_without_details("get_os_info", None));
+            return Err(Error::other(""));
         }
         let data = response.os_info;
 
@@ -851,7 +832,7 @@ impl PeerRestClient {
                     if let Some(msg) = response.error_info {
                         return Err(Error::other(msg));
                     }
-                    return Err(peer_failure_without_details("get_se_linux_info", None));
+                    return Err(Error::other(""));
                 }
                 let data = response.sys_services;
 
@@ -876,7 +857,7 @@ impl PeerRestClient {
                     if let Some(msg) = response.error_info {
                         return Err(Error::other(msg));
                     }
-                    return Err(peer_failure_without_details("get_sys_config", None));
+                    return Err(Error::other(""));
                 }
                 let data = response.sys_config;
 
@@ -901,7 +882,7 @@ impl PeerRestClient {
                     if let Some(msg) = response.error_info {
                         return Err(Error::other(msg));
                     }
-                    return Err(peer_failure_without_details("get_sys_errors", None));
+                    return Err(Error::other(""));
                 }
                 let data = response.sys_errors;
 
@@ -926,7 +907,7 @@ impl PeerRestClient {
                     if let Some(msg) = response.error_info {
                         return Err(Error::other(msg));
                     }
-                    return Err(peer_failure_without_details("get_mem_info", None));
+                    return Err(Error::other(""));
                 }
                 let data = response.mem_info;
 
@@ -958,7 +939,7 @@ impl PeerRestClient {
                     if let Some(msg) = response.error_info {
                         return Err(Error::other(msg));
                     }
-                    return Err(peer_failure_without_details("get_metrics", None));
+                    return Err(Error::other(""));
                 }
                 let data = response.realtime_metrics;
 
@@ -983,7 +964,7 @@ impl PeerRestClient {
                     if let Some(msg) = response.error_info {
                         return Err(Error::other(msg));
                     }
-                    return Err(peer_failure_without_details("get_live_events", None));
+                    return Err(Error::other(""));
                 }
 
                 Ok(PeerLiveEventsBatch {
@@ -1008,7 +989,7 @@ impl PeerRestClient {
                     if let Some(msg) = response.error_info {
                         return Err(Error::other(msg));
                     }
-                    return Err(peer_failure_without_details("get_proc_info", None));
+                    return Err(Error::other(""));
                 }
                 let data = response.proc_info;
 
@@ -1035,7 +1016,7 @@ impl PeerRestClient {
                     if let Some(msg) = response.error_info {
                         return Err(Error::other(msg));
                     }
-                    return Err(peer_failure_without_details("start_profiling", None));
+                    return Err(Error::other(""));
                 }
                 Ok(())
             }
@@ -1342,7 +1323,7 @@ impl PeerRestClient {
                     if let Some(msg) = response.error_info {
                         return Err(Error::other(msg));
                     }
-                    return Err(peer_failure_without_details("load_bucket_metadata", Some(bucket)));
+                    return Err(Error::other(""));
                 }
                 Ok(())
             }
@@ -1365,7 +1346,7 @@ impl PeerRestClient {
                     if let Some(msg) = response.error_info {
                         return Err(Error::other(msg));
                     }
-                    return Err(peer_failure_without_details("delete_bucket_metadata", Some(bucket)));
+                    return Err(Error::other(""));
                 }
                 Ok(())
             }
@@ -1388,7 +1369,7 @@ impl PeerRestClient {
                     if let Some(msg) = response.error_info {
                         return Err(Error::other(msg));
                     }
-                    return Err(peer_failure_without_details("delete_policy", None));
+                    return Err(Error::other(""));
                 }
                 Ok(())
             }
@@ -1411,7 +1392,7 @@ impl PeerRestClient {
                     if let Some(msg) = response.error_info {
                         return Err(Error::other(msg));
                     }
-                    return Err(peer_failure_without_details("load_policy", None));
+                    return Err(Error::other(""));
                 }
                 Ok(())
             }
@@ -1436,7 +1417,7 @@ impl PeerRestClient {
                     if let Some(msg) = response.error_info {
                         return Err(Error::other(msg));
                     }
-                    return Err(peer_failure_without_details("load_policy_mapping", None));
+                    return Err(Error::other(""));
                 }
                 Ok(())
             }
@@ -1459,7 +1440,7 @@ impl PeerRestClient {
                     if let Some(msg) = response.error_info {
                         return Err(Error::other(msg));
                     }
-                    return Err(peer_failure_without_details("delete_user", None));
+                    return Err(Error::other(""));
                 }
                 Ok(())
             }
@@ -1482,7 +1463,7 @@ impl PeerRestClient {
                     if let Some(msg) = response.error_info {
                         return Err(Error::other(msg));
                     }
-                    return Err(peer_failure_without_details("delete_service_account", None));
+                    return Err(Error::other(""));
                 }
                 Ok(())
             }
@@ -1506,7 +1487,7 @@ impl PeerRestClient {
                     if let Some(msg) = response.error_info {
                         return Err(Error::other(msg));
                     }
-                    return Err(peer_failure_without_details("load_user", None));
+                    return Err(Error::other(""));
                 }
                 Ok(())
             }
@@ -1529,7 +1510,7 @@ impl PeerRestClient {
                     if let Some(msg) = response.error_info {
                         return Err(Error::other(msg));
                     }
-                    return Err(peer_failure_without_details("load_service_account", None));
+                    return Err(Error::other(""));
                 }
                 Ok(())
             }
@@ -1552,7 +1533,7 @@ impl PeerRestClient {
                     if let Some(msg) = response.error_info {
                         return Err(Error::other(msg));
                     }
-                    return Err(peer_failure_without_details("load_group", None));
+                    return Err(Error::other(""));
                 }
                 Ok(())
             }
@@ -1573,7 +1554,7 @@ impl PeerRestClient {
                     if let Some(msg) = response.error_info {
                         return Err(Error::other(msg));
                     }
-                    return Err(peer_failure_without_details("reload_site_replication_config", None));
+                    return Err(Error::other(""));
                 }
                 Ok(())
             }
@@ -1616,7 +1597,7 @@ impl PeerRestClient {
                     if let Some(msg) = response.error_info {
                         return Err(Error::other(msg));
                     }
-                    return Err(peer_failure_without_details("signal_service", None));
+                    return Err(Error::other(""));
                 }
                 validate_signal_service_protocol(sig, sub_sys, response.protocol_version)?;
                 Ok(response)
@@ -1686,7 +1667,7 @@ impl PeerRestClient {
                     if let Some(msg) = response.error_info {
                         return Err(Error::other(msg));
                     }
-                    return Err(peer_failure_without_details("reload_pool_meta", None));
+                    return Err(Error::other(""));
                 }
 
                 Ok(())
@@ -1710,7 +1691,7 @@ impl PeerRestClient {
                     if let Some(msg) = response.error_info {
                         return Err(Error::other(msg));
                     }
-                    return Err(peer_failure_without_details("stop_rebalance", None));
+                    return Err(Error::other(""));
                 }
 
                 Ok(())
@@ -1744,7 +1725,7 @@ impl PeerRestClient {
                     if let Some(msg) = response.error_info {
                         return Err(Error::other(msg));
                     }
-                    return Err(peer_failure_without_details("load_rebalance_meta", None));
+                    return Err(Error::other(""));
                 }
 
                 Ok(())
@@ -1772,7 +1753,7 @@ impl PeerRestClient {
                     if let Some(msg) = response.error_info {
                         return Err(Error::other(msg));
                     }
-                    return Err(peer_failure_without_details("start_decommission", None));
+                    return Err(Error::other(""));
                 }
 
                 Ok(())
@@ -1796,7 +1777,7 @@ impl PeerRestClient {
                     if let Some(msg) = response.error_info {
                         return Err(Error::other(msg));
                     }
-                    return Err(peer_failure_without_details("decommission_cancel", None));
+                    return Err(Error::other(""));
                 }
 
                 Ok(())
@@ -1820,7 +1801,7 @@ impl PeerRestClient {
                     if let Some(msg) = response.error_info {
                         return Err(Error::other(msg));
                     }
-                    return Err(peer_failure_without_details("clear_decommission", None));
+                    return Err(Error::other(""));
                 }
 
                 Ok(())
@@ -1966,8 +1947,6 @@ fn tier_config_reload_status_outcome(status: tonic::Status) -> TierConfigReloadO
 mod tests {
     use super::*;
     use crate::config::com::STORAGE_CLASS_SUB_SYS;
-    use crate::disk::error::DiskError;
-    use crate::disk::error_reduce::reduce_errs;
     use crate::layout::{disks_layout::DisksLayout, endpoints::SetupType};
     use rustfs_config::{ENV_KUBERNETES_SERVICE_HOST, ENV_LOCAL_ENDPOINT_HOST, ENV_STARTUP_TOPOLOGY_WAIT_MODE};
     use serde_json::Value;
@@ -3119,115 +3098,4 @@ mod tests {
                 && span.get("request_id").and_then(Value::as_str) == Some("req-peer-rest")
         }));
     }
-
-    /// Every operation name passed to `peer_failure_without_details` in this file.
-    const PEER_FAILURE_OPS: &[&str] = &[
-        "local_storage_info",
-        "server_info",
-        "get_cpus",
-        "get_net_info",
-        "get_partitions",
-        "get_os_info",
-        "get_se_linux_info",
-        "get_sys_config",
-        "get_sys_errors",
-        "get_mem_info",
-        "get_metrics",
-        "get_live_events",
-        "get_proc_info",
-        "start_profiling",
-        "load_bucket_metadata",
-        "delete_bucket_metadata",
-        "delete_policy",
-        "load_policy",
-        "load_policy_mapping",
-        "delete_user",
-        "delete_service_account",
-        "load_user",
-        "load_service_account",
-        "load_group",
-        "reload_site_replication_config",
-        "signal_service",
-        "reload_pool_meta",
-        "stop_rebalance",
-        "load_rebalance_meta",
-        "start_decommission",
-        "decommission_cancel",
-        "clear_decommission",
-    ];
-
-    #[test]
-    fn peer_failure_without_details_names_operation_and_bucket() {
-        for op in PEER_FAILURE_OPS {
-            let message = peer_failure_without_details(op, None).to_string();
-            assert!(message.contains(op), "{op} message must name the operation: {message}");
-        }
-
-        for op in ["load_bucket_metadata", "delete_bucket_metadata"] {
-            let message = peer_failure_without_details(op, Some("ops-bucket")).to_string();
-            assert!(message.contains(op), "{op} message must name the operation: {message}");
-            assert!(message.contains("ops-bucket"), "{op} message must name the bucket: {message}");
-        }
-    }
-
-    #[test]
-    fn peer_failure_without_details_keeps_one_reduce_errs_bucket_per_operation() {
-        // reduce_errs groups Io errors by kind plus rendered message: peers failing the
-        // same operation must stay a single dominant error instead of one bucket per peer.
-        let per_peer_errs = (0..4)
-            .map(|_| Some(DiskError::from(peer_failure_without_details("load_bucket_metadata", Some("shared")))))
-            .collect::<Vec<_>>();
-        let (count, dominant) = reduce_errs(&per_peer_errs, &[]);
-        assert_eq!(count, 4, "one shared failure must not split into per-peer buckets");
-        assert_eq!(
-            dominant,
-            Some(DiskError::from(peer_failure_without_details("load_bucket_metadata", Some("shared"))))
-        );
-
-        assert_ne!(
-            peer_failure_without_details("load_bucket_metadata", Some("shared")).to_string(),
-            peer_failure_without_details("delete_bucket_metadata", Some("shared")).to_string()
-        );
-        assert_ne!(
-            peer_failure_without_details("load_bucket_metadata", Some("bucket-a")).to_string(),
-            peer_failure_without_details("load_bucket_metadata", Some("bucket-b")).to_string()
-        );
-    }
-
-    #[test]
-    fn peer_failure_without_details_never_reads_as_a_network_failure() {
-        // `finalize_result` marks the peer offline and evicts its connection whenever the
-        // message matches a network needle. A peer that answered `success = false` is alive,
-        // so no operation or bucket name may push this text over that classifier.
-        for op in PEER_FAILURE_OPS {
-            let err = peer_failure_without_details(op, None);
-            assert!(
-                !PeerRestClient::is_network_like_error(&err),
-                "{op} must not read as a transport failure: {err}"
-            );
-
-            let scoped = peer_failure_without_details(op, Some("bucket-name"));
-            assert!(
-                !PeerRestClient::is_network_like_error(&scoped),
-                "{op} must not read as a transport failure: {scoped}"
-            );
-        }
-
-        // The bucket name is caller-supplied. Every needle carries a space, which S3 bucket
-        // names cannot, and the name is closed by `)` before the literal text resumes, so no
-        // needle can straddle the boundary either.
-        for bucket in [
-            "timed-out",
-            "connection-reset",
-            "transport-error",
-            "broken-pipe",
-            "unavailable-logs",
-        ] {
-            let err = peer_failure_without_details("load_bucket_metadata", Some(bucket));
-            assert!(
-                !PeerRestClient::is_network_like_error(&err),
-                "bucket {bucket} must not push the message over the network classifier: {err}"
-            );
-        }
-    }
 }

crates/ecstore/src/cluster/rpc/peer_s3_client.rs

@@ -214,21 +214,6 @@ fn pool_write_quorum(participant_count: usize) -> usize {
     (participant_count / 2) + 1
 }
 
-/// Error for a peer that reported `success = false` without an error payload.
-///
-/// The message must stay identical across the peers of one operation: `reduce_errs`
-/// buckets `Error::Io` by kind plus rendered message, so any per-peer detail (address,
-/// timing) would split one shared failure into single-count buckets and downgrade a real
-/// dominant error into `ErasureWriteQuorum`.
-///
-/// `peer_rest_client` carries the same helper over `StorageError` for the same response shape.
-fn peer_failure_without_details(op: &str, bucket: Option<&str>) -> Error {
-    match bucket {
-        Some(bucket) => Error::other(format!("{op}({bucket}): peer returned failure without error details")),
-        None => Error::other(format!("{op}: peer returned failure without error details")),
-    }
-}
-
 fn reduce_pool_write_quorum_errs(per_pool_errs: &[Option<Error>]) -> Option<Error> {
     if per_pool_errs.is_empty() {
         return Some(Error::ErasureWriteQuorum);
@@ -1093,7 +1078,7 @@ impl PeerS3Client for RemotePeerS3Client {
                     return if let Some(err) = response.error {
                         Err(err.into())
                     } else {
-                        Err(peer_failure_without_details("heal_bucket", Some(bucket)))
+                        Err(Error::other(""))
                     };
                 }
 
@@ -1120,7 +1105,7 @@ impl PeerS3Client for RemotePeerS3Client {
                     return if let Some(err) = response.error {
                         Err(err.into())
                     } else {
-                        Err(peer_failure_without_details("list_bucket", None))
+                        Err(Error::other(""))
                     };
                 }
                 let bucket_infos = response
@@ -1151,7 +1136,9 @@ impl PeerS3Client for RemotePeerS3Client {
                     return if let Some(err) = response.error {
                         Err(err.into())
                     } else {
-                        Err(peer_failure_without_details("make_bucket", Some(bucket)))
+                        Err(Error::other(format!(
+                            "make_bucket({bucket}): peer returned failure without error details"
+                        )))
                     };
                 }
 
@@ -1175,7 +1162,7 @@ impl PeerS3Client for RemotePeerS3Client {
                     return if let Some(err) = response.error {
                         Err(err.into())
                     } else {
-                        Err(peer_failure_without_details("get_bucket_info", Some(bucket)))
+                        Err(Error::other(""))
                     };
                 }
                 let bucket_info = serde_json::from_str::<BucketInfo>(&response.bucket_info)?;
@@ -1203,7 +1190,7 @@ impl PeerS3Client for RemotePeerS3Client {
                     return if let Some(err) = response.error {
                         Err(err.into())
                     } else {
-                        Err(peer_failure_without_details("delete_bucket", Some(bucket)))
+                        Err(Error::other(""))
                     };
                 }
 
@@ -2327,37 +2314,4 @@ mod tests {
             .collect::<Vec<_>>();
         assert_eq!(calls, vec![1, 1, 0, 0, 0, 0, 0, 0]);
     }
-
-    #[test]
-    fn peer_failure_without_details_names_operation_and_bucket() {
-        for op in ["heal_bucket", "make_bucket", "get_bucket_info", "delete_bucket"] {
-            let message = peer_failure_without_details(op, Some("ops-bucket")).to_string();
-            assert!(message.contains(op), "{op} message must name the operation: {message}");
-            assert!(message.contains("ops-bucket"), "{op} message must name the bucket: {message}");
-        }
-
-        let message = peer_failure_without_details("list_bucket", None).to_string();
-        assert!(message.contains("list_bucket"), "cluster-wide message must name the operation");
-        assert!(!message.trim().is_empty());
-    }
-
-    #[test]
-    fn peer_failure_without_details_keeps_one_reduce_errs_bucket_per_operation() {
-        // reduce_errs groups Io errors by kind plus rendered message: peers failing the
-        // same operation on the same bucket must still reach quorum as one dominant error.
-        let per_pool_errs = vec![
-            Some(peer_failure_without_details("delete_bucket", Some("shared"))),
-            Some(peer_failure_without_details("delete_bucket", Some("shared"))),
-            Some(peer_failure_without_details("delete_bucket", Some("shared"))),
-        ];
-        assert_eq!(
-            reduce_pool_write_quorum_errs(&per_pool_errs),
-            Some(peer_failure_without_details("delete_bucket", Some("shared")))
-        );
-
-        assert_ne!(
-            peer_failure_without_details("delete_bucket", Some("shared")),
-            peer_failure_without_details("get_bucket_info", Some("shared"))
-        );
-    }
 }

crates/ecstore/src/config/audit.rs

@@ -39,6 +39,7 @@ use rustfs_config::{
 };
 use std::sync::LazyLock;
 
+#[allow(dead_code)]
 #[allow(clippy::declare_interior_mutable_const)]
 /// Default KVS for audit webhook settings.
 pub static DEFAULT_AUDIT_WEBHOOK_KVS: LazyLock<KVS> = LazyLock::new(|| {
@@ -116,6 +117,7 @@ pub static DEFAULT_AUDIT_WEBHOOK_KVS: LazyLock<KVS> = LazyLock::new(|| {
     ])
 });
 
+#[allow(dead_code)]
 #[allow(clippy::declare_interior_mutable_const)]
 /// Default KVS for audit MQTT settings.
 pub static DEFAULT_AUDIT_MQTT_KVS: LazyLock<KVS> = LazyLock::new(|| {
@@ -373,6 +375,7 @@ pub static DEFAULT_AUDIT_NATS_KVS: LazyLock<KVS> = LazyLock::new(|| {
     ])
 });
 
+#[allow(dead_code)]
 pub static DEFAULT_AUDIT_PULSAR_KVS: LazyLock<KVS> = LazyLock::new(|| {
     KVS(vec![
         KV {

crates/ecstore/src/config/heal.rs

@@ -12,9 +12,12 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
+use crate::error::{Error, Result};
 use rustfs_config::server_config::{KV, KVS};
 use rustfs_config::{DEFAULT_HEAL_BITROT_CYCLE_SECS, HEAL_BITROT_CYCLE};
+use rustfs_utils::string::parse_bool;
 use std::sync::LazyLock;
+use std::time::Duration;
 
 pub static DEFAULT_KVS: LazyLock<KVS> = LazyLock::new(|| {
     KVS(vec![KV {
@@ -23,3 +26,59 @@ pub static DEFAULT_KVS: LazyLock<KVS> = LazyLock::new(|| {
         hidden_if_empty: false,
     }])
 });
+
+#[derive(Debug, Default)]
+pub struct Config {
+    pub bitrot: String,
+    pub sleep: Duration,
+    pub io_count: usize,
+    pub drive_workers: usize,
+    pub cache: Duration,
+}
+
+impl Config {
+    pub fn bitrot_scan_cycle(&self) -> Duration {
+        self.cache
+    }
+
+    pub fn get_workers(&self) -> usize {
+        self.drive_workers
+    }
+
+    pub fn update(&mut self, nopts: &Config) {
+        self.bitrot = nopts.bitrot.clone();
+        self.io_count = nopts.io_count;
+        self.sleep = nopts.sleep;
+        self.drive_workers = nopts.drive_workers;
+    }
+}
+
+const RUSTFS_BITROT_CYCLE_IN_MONTHS: u64 = 1;
+
+fn parse_bitrot_config(s: &str) -> Result<Duration> {
+    match parse_bool(s) {
+        Ok(enabled) => {
+            if enabled {
+                Ok(Duration::from_secs_f64(0.0))
+            } else {
+                Ok(Duration::from_secs_f64(-1.0))
+            }
+        }
+        Err(_) => {
+            if !s.ends_with("m") {
+                return Err(Error::other("unknown format"));
+            }
+
+            match s.trim_end_matches('m').parse::<u64>() {
+                Ok(months) => {
+                    if months < RUSTFS_BITROT_CYCLE_IN_MONTHS {
+                        return Err(Error::other(format!("minimum bitrot cycle is {RUSTFS_BITROT_CYCLE_IN_MONTHS} month(s)")));
+                    }
+
+                    Ok(Duration::from_secs(months * 30 * 24 * 60))
+                }
+                Err(err) => Err(Error::other(err)),
+            }
+        }
+    }
+}

crates/ecstore/src/config/mod.rs

@@ -16,6 +16,7 @@
 
 mod audit;
 pub mod com;
+#[allow(dead_code)]
 pub mod heal;
 mod notify;
 mod oidc;

crates/ecstore/src/core/pools.rs

@@ -16,7 +16,6 @@ use crate::bucket::replication::replication_state_from_filemeta;
 use crate::bucket::versioning_sys::BucketVersioningSys;
 use crate::bucket::{
     lifecycle::{
-        LifecycleExpiryConfigs,
         bucket_lifecycle_audit::LcEventSrc,
         bucket_lifecycle_ops::{
             LifecycleOps, apply_expiry_on_transitioned_object, apply_expiry_rule_in, eval_action_from_lifecycle,
@@ -1997,11 +1996,11 @@ impl PoolMeta {
         Ok(false)
     }
 
+    #[allow(dead_code)]
     pub fn validate(&self, pools: Vec<Arc<Sets>>) -> Result<bool> {
         struct PoolInfo {
             position: usize,
             completed: bool,
-            #[allow(dead_code, reason = "written but never read back (backlog#1823)")]
             decom_started: bool,
         }
 
@@ -2336,10 +2335,6 @@ fn lifecycle_action_removes_data_movement_version(action: IlmAction) -> bool {
     )
 }
 
-fn lifecycle_action_skips_heal_version(action: IlmAction) -> bool {
-    action.delete()
-}
-
 fn resolve_data_movement_lifecycle_expiry_result(action: IlmAction, apply_actions: bool, applied: bool) -> Result<bool> {
     if !apply_actions || applied {
         return Ok(true);
@@ -2390,80 +2385,7 @@ pub(crate) async fn should_skip_lifecycle_for_data_movement(
     }
 }
 
-pub struct HealLifecycleExpiryContext {
-    configs: LifecycleExpiryConfigs,
-}
-
 impl ECStore {
-    pub async fn load_heal_lifecycle_expiry_context(&self, bucket: &str) -> Result<Option<HealLifecycleExpiryContext>> {
-        if bucket == RUSTFS_META_BUCKET {
-            return Ok(None);
-        }
-
-        let configs = get_expiry_configs(self, bucket).await?;
-        if configs.lifecycle.is_none() {
-            return Ok(None);
-        }
-
-        Ok(Some(HealLifecycleExpiryContext { configs }))
-    }
-
-    pub async fn enqueue_heal_lifecycle_expiry(
-        self: &Arc<Self>,
-        context: &HealLifecycleExpiryContext,
-        bucket: &str,
-        object: &str,
-        version_id: Option<&str>,
-        object_info: Option<&crate::object_api::ObjectInfo>,
-    ) -> Result<bool> {
-        let Some(lifecycle_config) = context.configs.lifecycle.as_ref() else {
-            return Ok(false);
-        };
-
-        let object_info = if let Some(object_info) = object_info {
-            if object_info.bucket != bucket || object_info.name != object {
-                return Ok(false);
-            }
-            let snapshot_version_id = object_info
-                .version_id
-                .filter(|version_id| !version_id.is_nil())
-                .map(|version_id| version_id.to_string());
-            if snapshot_version_id.as_deref() != version_id {
-                return Ok(false);
-            }
-            object_info.clone()
-        } else {
-            match self
-                .get_object_info(
-                    bucket,
-                    object,
-                    &ObjectOptions {
-                        version_id: version_id.map(str::to_string),
-                        versioned: version_id.is_some(),
-                        expected_bucket_incarnation_id: Some(context.configs.bucket_incarnation_id),
-                        ..Default::default()
-                    },
-                )
-                .await
-            {
-                Ok(object_info) => object_info,
-                Err(err) if is_err_object_not_found(&err) || is_err_version_not_found(&err) => return Ok(false),
-                Err(err) => return Err(err),
-            }
-        };
-
-        let event = eval_action_from_lifecycle(lifecycle_config, context.configs.object_lock.as_deref(), &object_info).await;
-        if !lifecycle_action_skips_heal_version(event.action) {
-            return Ok(false);
-        }
-
-        if lifecycle_delete_all_versions_blocked_by_replication(self.clone(), bucket, &object_info.name, event.action).await? {
-            return Ok(false);
-        }
-
-        Ok(apply_expiry_rule_in(self.clone(), &event, &LcEventSrc::Scanner, &object_info).await)
-    }
-
     async fn save_current_pool_meta(&self) -> Result<()> {
         let _save_guard = self.pool_meta_save_gate.lock().await;
         let snapshot = {
@@ -4365,19 +4287,6 @@ mod tests {
         ));
     }
 
-    #[test]
-    fn lifecycle_action_skips_heal_version_for_every_delete_action() {
-        assert!(lifecycle_action_skips_heal_version(IlmAction::DeleteAction));
-        assert!(lifecycle_action_skips_heal_version(IlmAction::DeleteVersionAction));
-        assert!(lifecycle_action_skips_heal_version(IlmAction::DeleteRestoredAction));
-        assert!(lifecycle_action_skips_heal_version(IlmAction::DeleteRestoredVersionAction));
-        assert!(lifecycle_action_skips_heal_version(IlmAction::DeleteAllVersionsAction));
-        assert!(lifecycle_action_skips_heal_version(IlmAction::DelMarkerDeleteAllVersionsAction));
-        assert!(!lifecycle_action_skips_heal_version(IlmAction::TransitionAction));
-        assert!(!lifecycle_action_skips_heal_version(IlmAction::TransitionVersionAction));
-        assert!(!lifecycle_action_skips_heal_version(IlmAction::NoneAction));
-    }
-
     #[test]
     fn resolve_data_movement_lifecycle_expiry_result_allows_dry_run_skip() {
         let skip = resolve_data_movement_lifecycle_expiry_result(IlmAction::DeleteVersionAction, false, false)
@@ -5049,19 +4958,13 @@ fn is_disk_online_state(state: &str) -> bool {
 }
 
 #[deprecated(since = "0.1.0", note = "Use fallback_total_capacity_dedup instead")]
-#[allow(
-    dead_code,
-    reason = "superseded by the replacement named in the comment at pools.rs:5071 (backlog#1823)"
-)]
+#[allow(dead_code)]
 fn fallback_total_capacity(disks: &[rustfs_madmin::Disk]) -> usize {
     fallback_total_capacity_dedup(disks)
 }
 
 #[deprecated(since = "0.1.0", note = "Use fallback_free_capacity_dedup instead")]
-#[allow(
-    dead_code,
-    reason = "superseded by the replacement named in the comment at pools.rs:5071 (backlog#1823)"
-)]
+#[allow(dead_code)]
 fn fallback_free_capacity(disks: &[rustfs_madmin::Disk]) -> usize {
     fallback_free_capacity_dedup(disks)
 }

crates/ecstore/src/core/sets.rs

@@ -1140,11 +1140,11 @@ impl crate::storage_api_contracts::heal::HealOperations for Sets {
 
         Err(Error::DiskNotFound)
     }
-    #[tracing::instrument(level = "debug", skip(self, opts), fields(bucket = %bucket, object = %object, dry_run = opts.dry_run))]
-    async fn check_abandoned_parts(&self, bucket: &str, object: &str, opts: &HealOpts) -> Result<()> {
-        self.get_disks_for_heal_object(object, opts)?
-            .check_abandoned_parts(bucket, object, opts)
-            .await
+    #[tracing::instrument(skip(self))]
+    async fn check_abandoned_parts(&self, _bucket: &str, _object: &str, _opts: &HealOpts) -> Result<()> {
+        // Multipart orphan reconciliation is intentionally retained above the pool/set layers
+        // until there is a concrete caller and a stable lower-level contract to implement.
+        Err(StorageError::NotImplemented)
     }
 }
 
@@ -1996,7 +1996,7 @@ mod tests {
     }
 
     #[tokio::test]
-    async fn sets_check_abandoned_parts_rejects_invalid_set_scope() {
+    async fn sets_check_abandoned_parts_returns_typed_not_implemented_error() {
         let format = FormatV3::new(1, 1);
         let sets = Sets {
             id: format.id,
@@ -2021,21 +2021,10 @@ mod tests {
         };
 
         let err = sets
-            .check_abandoned_parts(
-                "bucket",
-                "object",
-                &HealOpts {
-                    set: Some(1),
-                    ..Default::default()
-                },
-            )
+            .check_abandoned_parts("bucket", "object", &HealOpts::default())
             .await
-            .expect_err("out-of-range abandoned-parts set scope must fail closed");
-        assert!(
-            matches!(err, StorageError::InvalidArgument(_, ref field, ref reason)
-                if field == "set" && reason.contains("invalid heal set index 1")),
-            "unexpected invalid set error: {err:?}"
-        );
+            .expect_err("abandoned-parts ownership should stay above the pool/set storage layers");
+        assert!(matches!(err, StorageError::NotImplemented));
     }
 
     // Builds a single-set `Sets` over `SET_DRIVE_COUNT` local temp-dir disks,

crates/ecstore/src/disk/disk_store.rs

@@ -418,17 +418,6 @@ pub struct DiskHealthTracker {
     pub last_capacity_free: AtomicU64,
     /// Last successful capacity probe timestamp
     pub last_capacity_probe_unix_secs: AtomicI64,
-    /// Authoritative atomically published runtime/status pair.
-    state_snapshot: AtomicU64,
-    transition_lock: std::sync::Mutex<()>,
-}
-
-fn pack_health_state(runtime_state: RuntimeDriveHealthState, status: u32) -> u64 {
-    (u64::from(runtime_state as u32) << 32) | u64::from(status)
-}
-
-fn unpack_health_state(snapshot: u64) -> (RuntimeDriveHealthState, u32) {
-    (RuntimeDriveHealthState::from_u32((snapshot >> 32) as u32), snapshot as u32)
 }
 
 #[derive(Debug)]
@@ -750,8 +739,6 @@ impl DiskHealthTracker {
             last_capacity_used: AtomicU64::new(0),
             last_capacity_free: AtomicU64::new(0),
             last_capacity_probe_unix_secs: AtomicI64::new(0),
-            state_snapshot: AtomicU64::new(pack_health_state(RuntimeDriveHealthState::Online, DISK_HEALTH_OK)),
-            transition_lock: std::sync::Mutex::new(()),
         }
     }
 
@@ -788,52 +775,39 @@ impl DiskHealthTracker {
 
     /// Check if disk is faulty
     pub fn is_faulty(&self) -> bool {
-        unpack_health_state(self.state_snapshot.load(Ordering::Acquire)).1 == DISK_HEALTH_FAULTY
-    }
-
-    fn publish_state(&self, runtime_state: RuntimeDriveHealthState, status: u32) {
-        self.state_snapshot
-            .store(pack_health_state(runtime_state, status), Ordering::Release);
-        self.runtime_state.store(runtime_state as u32, Ordering::Release);
-        self.status.store(status, Ordering::Release);
+        self.status.load(Ordering::Acquire) == DISK_HEALTH_FAULTY
     }
 
     /// Set disk as faulty
     #[allow(dead_code, reason = "asserted by this file's tests (backlog#1823)")]
     pub fn set_faulty(&self) {
-        let _guard = self.transition_lock.lock().unwrap_or_else(|poisoned| poisoned.into_inner());
-        self.publish_state(RuntimeDriveHealthState::Offline, DISK_HEALTH_FAULTY);
+        self.status.store(DISK_HEALTH_FAULTY, Ordering::Release);
     }
 
     /// Set disk as OK
     pub fn set_ok(&self) {
-        let _guard = self.transition_lock.lock().unwrap_or_else(|poisoned| poisoned.into_inner());
-        self.publish_state(RuntimeDriveHealthState::Online, DISK_HEALTH_OK);
+        self.status.store(DISK_HEALTH_OK, Ordering::Release);
     }
 
     #[cfg(test)]
     pub fn force_runtime_state_for_test(&self, state: RuntimeDriveHealthState) {
-        let _guard = self.transition_lock.lock().unwrap_or_else(|poisoned| poisoned.into_inner());
-        let status = if state == RuntimeDriveHealthState::Offline {
-            DISK_HEALTH_FAULTY
-        } else {
-            DISK_HEALTH_OK
-        };
-        self.publish_state(state, status);
+        self.runtime_state.store(state as u32, Ordering::Release);
+        match state {
+            RuntimeDriveHealthState::Offline => self.set_faulty(),
+            RuntimeDriveHealthState::Online | RuntimeDriveHealthState::Suspect | RuntimeDriveHealthState::Returning => {
+                self.set_ok();
+            }
+        }
     }
 
     pub fn swap_ok_to_faulty(&self) -> bool {
-        let _guard = self.transition_lock.lock().unwrap_or_else(|poisoned| poisoned.into_inner());
-        let (_, status) = unpack_health_state(self.state_snapshot.load(Ordering::Acquire));
-        if status != DISK_HEALTH_OK {
-            return false;
-        }
-        self.publish_state(RuntimeDriveHealthState::Offline, DISK_HEALTH_FAULTY);
-        true
+        self.status
+            .compare_exchange(DISK_HEALTH_OK, DISK_HEALTH_FAULTY, Ordering::AcqRel, Ordering::Relaxed)
+            .is_ok()
     }
 
     pub fn runtime_state(&self) -> RuntimeDriveHealthState {
-        unpack_health_state(self.state_snapshot.load(Ordering::Acquire)).0
+        RuntimeDriveHealthState::from_u32(self.runtime_state.load(Ordering::Acquire))
     }
 
     pub fn offline_duration(&self) -> Option<Duration> {
@@ -849,7 +823,6 @@ impl DiskHealthTracker {
     }
 
     pub fn mark_failure(&self, endpoint: &Endpoint, reason: &'static str) -> bool {
-        let _guard = self.transition_lock.lock().unwrap_or_else(|poisoned| poisoned.into_inner());
         let current = self.runtime_state();
         let now = current_unix_secs();
         let next = match current {
@@ -878,19 +851,24 @@ impl DiskHealthTracker {
         };
 
         let became_offline = next == RuntimeDriveHealthState::Offline && current != RuntimeDriveHealthState::Offline;
+        if next == RuntimeDriveHealthState::Offline {
+            self.status.store(DISK_HEALTH_FAULTY, Ordering::Release);
+        } else {
+            self.status.store(DISK_HEALTH_OK, Ordering::Release);
+        }
         self.transition_state(endpoint, current, next, reason);
         became_offline
     }
 
     #[allow(dead_code, reason = "asserted by this file's tests (backlog#1823)")]
     pub fn mark_offline(&self, endpoint: &Endpoint, reason: &'static str) -> bool {
-        let _guard = self.transition_lock.lock().unwrap_or_else(|poisoned| poisoned.into_inner());
         let current = self.runtime_state();
         if current == RuntimeDriveHealthState::Offline {
             return false;
         }
 
         self.consecutive_successes.store(0, Ordering::Release);
+        self.status.store(DISK_HEALTH_FAULTY, Ordering::Release);
         self.transition_state(endpoint, current, RuntimeDriveHealthState::Offline, reason);
         true
     }
@@ -904,10 +882,11 @@ impl DiskHealthTracker {
     }
 
     fn reset_for_store_init_retry_at(&self, endpoint: &Endpoint, now: Duration) {
-        let _guard = self.transition_lock.lock().unwrap_or_else(|poisoned| poisoned.into_inner());
         let now_nanos = unix_nanos(now);
         let now_secs = unix_secs_i64(now);
-        self.publish_state(RuntimeDriveHealthState::Online, DISK_HEALTH_OK);
+        self.status.store(DISK_HEALTH_OK, Ordering::Release);
+        self.runtime_state
+            .store(RuntimeDriveHealthState::Online as u32, Ordering::Release);
         self.consecutive_failures.store(0, Ordering::Release);
         self.consecutive_successes.store(0, Ordering::Release);
         self.offline_since_unix_secs.store(0, Ordering::Release);
@@ -919,7 +898,6 @@ impl DiskHealthTracker {
     }
 
     pub fn mark_recovery_success(&self, endpoint: &Endpoint, reason: &'static str) -> bool {
-        let _guard = self.transition_lock.lock().unwrap_or_else(|poisoned| poisoned.into_inner());
         let current = self.runtime_state();
         let next = match current {
             RuntimeDriveHealthState::Online => RuntimeDriveHealthState::Online,
@@ -940,6 +918,7 @@ impl DiskHealthTracker {
 
         let became_online = next == RuntimeDriveHealthState::Online;
         if became_online {
+            self.status.store(DISK_HEALTH_OK, Ordering::Release);
             self.consecutive_failures.store(0, Ordering::Release);
             self.consecutive_successes.store(0, Ordering::Release);
         }
@@ -969,13 +948,7 @@ impl DiskHealthTracker {
             return;
         }
 
-        let current_status = unpack_health_state(self.state_snapshot.load(Ordering::Acquire)).1;
-        let status = match next {
-            RuntimeDriveHealthState::Offline => DISK_HEALTH_FAULTY,
-            RuntimeDriveHealthState::Returning => current_status,
-            RuntimeDriveHealthState::Online | RuntimeDriveHealthState::Suspect => DISK_HEALTH_OK,
-        };
-        self.publish_state(next, status);
+        self.runtime_state.store(next as u32, Ordering::Release);
         self.last_transition_unix_secs
             .store(current_unix_secs() as i64, Ordering::Release);
 
@@ -1244,7 +1217,7 @@ impl LocalDiskWrapper {
                         return;
                     }
 
-                    if health.is_faulty() {
+                    if health.status.load(Ordering::Relaxed) != DISK_HEALTH_OK {
                         continue;
                     }
 
@@ -2936,57 +2909,6 @@ mod tests {
         });
     }
 
-    #[test]
-    #[serial_test::serial]
-    fn concurrent_failure_and_recovery_publish_one_health_snapshot() {
-        temp_env::with_var(rustfs_config::ENV_DRIVE_SUSPECT_FAILURE_THRESHOLD, Some("2"), || {
-            let endpoint = Endpoint::try_from("/tmp/concurrent-health-snapshot").expect("endpoint should parse");
-            let health = Arc::new(DiskHealthTracker::new());
-            let transition_guard = health
-                .transition_lock
-                .lock()
-                .expect("health transition lock should not be poisoned");
-            let start = Arc::new(std::sync::Barrier::new(3));
-            let (completed_tx, completed_rx) = std::sync::mpsc::channel();
-            let workers = (0..2)
-                .map(|_| {
-                    let health = Arc::clone(&health);
-                    let endpoint = endpoint.clone();
-                    let start = Arc::clone(&start);
-                    let completed_tx = completed_tx.clone();
-                    std::thread::spawn(move || {
-                        start.wait();
-                        health.mark_failure(&endpoint, "concurrent_test");
-                        completed_tx.send(()).expect("completion receiver should remain available");
-                    })
-                })
-                .collect::<Vec<_>>();
-
-            start.wait();
-            assert!(
-                matches!(
-                    completed_rx.recv_timeout(Duration::from_millis(250)),
-                    Err(std::sync::mpsc::RecvTimeoutError::Timeout)
-                ),
-                "concurrent transitions must wait for the serialization lock"
-            );
-            drop(transition_guard);
-            completed_rx
-                .recv_timeout(Duration::from_secs(1))
-                .expect("first failure transition should complete after lock release");
-            completed_rx
-                .recv_timeout(Duration::from_secs(1))
-                .expect("second failure transition should complete after lock release");
-            for worker in workers {
-                worker.join().expect("health transition worker should not panic");
-            }
-
-            assert_eq!(health.runtime_state(), RuntimeDriveHealthState::Offline);
-            assert!(health.is_faulty());
-            assert_eq!(health.consecutive_failures.load(Ordering::Acquire), 2);
-        });
-    }
-
     #[test]
     fn operation_success_recovers_suspect_drive_without_faulting() {
         let endpoint = Endpoint::try_from("/tmp/runtime-state-suspect-success").expect("endpoint should parse");

crates/ecstore/src/disk/local.rs

@@ -6562,7 +6562,7 @@ impl LocalDisk {
         Ok(f)
     }
 
-    #[allow(dead_code, reason = "MinIO-parity surface with no caller in this port (backlog#1823)")]
+    #[allow(dead_code)]
     fn get_metrics(&self) -> DiskMetrics {
         DiskMetrics::default()
     }

crates/ecstore/src/erasure/coding/bitrot.rs

@@ -820,263 +820,10 @@ impl BitrotWriterWrapper {
     }
 }
 
-// --- startup bitrot self-test (rustfs/backlog#1873, MinIO bitrotSelfTest parity) ---
-//
-// A broken hash implementation (bad SIMD feature combination, platform drift, a
-// key-handling regression) fails silently: every shard reads back "corrupt",
-// heal rewrites data that was fine, and cross-platform clusters disagree about
-// which copy is healthy. The self-test below pins the algorithms the moment a
-// process starts, so a drifted build announces itself instead of quietly
-// rewriting objects. See docs/rustfs-heal-scanner-vs-minio-comprehensive-
-// analysis-2026-08-16.md §6 HS-11.
-
-/// Length of the deterministic self-test payload.
-pub const BITROT_SELF_TEST_PAYLOAD_LEN: usize = 4096;
-
-/// Known-answer digest of [`bitrot_self_test_payload`] under `HighwayHash256S`
-/// (the production default). Pinned so any platform or build where the
-/// implementation drifts fails startup instead of miss-hashing shards.
-const BITROT_SELF_TEST_KAT_HIGHWAY_HASH256S: [u8; 32] = [
-    0xb9, 0x32, 0xa2, 0xaa, 0x4a, 0xb7, 0x33, 0x6a, 0xa3, 0xca, 0x7e, 0x61, 0x9d, 0x86, 0x52, 0x14, 0x6e, 0x7f, 0xd8, 0x9e, 0xea,
-    0x08, 0xd9, 0x8c, 0x33, 0x85, 0x87, 0x19, 0x30, 0xd6, 0xed, 0x06,
-];
-
-/// Known-answer digest of the same payload under `HighwayHash256SLegacy`.
-const BITROT_SELF_TEST_KAT_HIGHWAY_HASH256S_LEGACY: [u8; 32] = [
-    0x98, 0x24, 0x71, 0x4f, 0x16, 0xbb, 0x48, 0x39, 0xed, 0x68, 0xfa, 0x63, 0x5e, 0xd9, 0x07, 0x61, 0xdf, 0x0a, 0xff, 0xcf, 0x7d,
-    0x8c, 0xa8, 0xc7, 0xc0, 0xb6, 0x6f, 0x05, 0xdb, 0xda, 0x5a, 0x22,
-];
-
-/// FIPS 180-2 test vector: SHA-256 of the ASCII string "abc". Unlike the
-/// Highway digests above this one is externally verifiable, so it guards the
-/// whole `HashAlgorithm` plumbing even for readers who distrust pinned
-/// self-computed constants.
-const BITROT_SELF_TEST_KAT_SHA256_ABC: [u8; 32] = [
-    0xba, 0x78, 0x16, 0xbf, 0x8f, 0x01, 0xcf, 0xea, 0x41, 0x41, 0x40, 0xde, 0x5d, 0xae, 0x22, 0x23, 0xb0, 0x03, 0x61, 0xa3, 0x96,
-    0x17, 0x7a, 0x9c, 0xb4, 0x10, 0xff, 0x61, 0xf2, 0x00, 0x15, 0xad,
-];
-
-/// Deterministic self-test payload: xorshift64* from a fixed seed, so every
-/// platform and every run hashes the same 4096 bytes.
-fn bitrot_self_test_payload() -> [u8; BITROT_SELF_TEST_PAYLOAD_LEN] {
-    let mut state = 0x9E37_79B9_7F4A_7C15u64;
-    let mut payload = [0u8; BITROT_SELF_TEST_PAYLOAD_LEN];
-    for byte in payload.iter_mut() {
-        state ^= state >> 12;
-        state ^= state << 25;
-        state ^= state >> 27;
-        *byte = state.wrapping_mul(0x2545_F491_4F6C_DD1D) as u8;
-    }
-    payload
-}
-
-/// Why a bitrot self-test failed.
-#[derive(Debug)]
-pub enum BitrotSelfTestError {
-    /// A known-answer digest mismatched the pinned constant.
-    KnownAnswerMismatch {
-        algorithm: &'static str,
-        got: String,
-        want: String,
-    },
-    /// A freshly encoded shard failed `bitrot_verify`.
-    RoundtripVerify { algorithm: &'static str, detail: String },
-    /// A verified roundtrip read back different bytes than were written.
-    RoundtripReadback { algorithm: &'static str },
-    /// A deliberately tampered shard was not rejected by `bitrot_verify`.
-    TamperNotRejected {
-        algorithm: &'static str,
-        tampered: &'static str,
-    },
-}
-
-impl std::fmt::Display for BitrotSelfTestError {
-    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
-        match self {
-            Self::KnownAnswerMismatch { algorithm, got, want } => {
-                write!(f, "known-answer mismatch for {algorithm}: got {got}, want {want}")
-            }
-            Self::RoundtripVerify { algorithm, detail } => write!(f, "{algorithm} roundtrip shard failed verification: {detail}"),
-            Self::RoundtripReadback { algorithm } => write!(f, "{algorithm} roundtrip read back different bytes"),
-            Self::TamperNotRejected { algorithm, tampered } => {
-                write!(f, "{algorithm} tampered shard ({tampered}) was not rejected")
-            }
-        }
-    }
-}
-
-impl std::error::Error for BitrotSelfTestError {}
-
-fn self_test_hex(bytes: &[u8]) -> String {
-    rustfs_utils::hex(bytes)
-}
-
-// (kept as a named one-liner so every KAT failure site reads the same; the
-// underlying formatter is the shared `rustfs_utils::hex`)
-
-/// Compare a digest against its pinned constant. Split out so a test can drive
-/// it with a wrong constant and prove the mismatch path fires.
-fn bitrot_kat_check(
-    algorithm: &'static str,
-    algo: &HashAlgorithm,
-    payload: &[u8],
-    expected: &[u8; 32],
-) -> Result<(), BitrotSelfTestError> {
-    let digest = algo.hash_encode(payload);
-    let digest = digest.as_ref();
-    if digest.len() != expected.len() || digest != expected.as_slice() {
-        return Err(BitrotSelfTestError::KnownAnswerMismatch {
-            algorithm,
-            got: self_test_hex(digest),
-            want: self_test_hex(expected),
-        });
-    }
-    Ok(())
-}
-
-/// Encode `payload` with `shard_size` blocks, verify it end to end, and read
-/// every block back through `BitrotReader` comparing bytes.
-async fn bitrot_roundtrip_check(
-    algorithm: &'static str,
-    algo: HashAlgorithm,
-    payload: &[u8],
-    shard_size: usize,
-) -> Result<(), BitrotSelfTestError> {
-    let mut writer = BitrotWriter::new(std::io::Cursor::new(Vec::<u8>::new()), shard_size, algo.clone());
-    for chunk in payload.chunks(shard_size) {
-        writer
-            .write(chunk)
-            .await
-            .map_err(|err| BitrotSelfTestError::RoundtripVerify {
-                algorithm,
-                detail: format!("encode failed: {err}"),
-            })?;
-    }
-    let encoded = writer.into_inner().into_inner();
-
-    let on_disk = bitrot_shard_file_size(payload.len(), shard_size, algo.clone());
-    if encoded.len() != on_disk {
-        return Err(BitrotSelfTestError::RoundtripVerify {
-            algorithm,
-            detail: format!("encoded {} bytes, size formula says {on_disk}", encoded.len()),
-        });
-    }
-    bitrot_verify(std::io::Cursor::new(encoded.clone()), on_disk, payload.len(), algo.clone(), shard_size)
-        .await
-        .map_err(|err| BitrotSelfTestError::RoundtripVerify {
-            algorithm,
-            detail: err.to_string(),
-        })?;
-
-    let mut reader = BitrotReader::new(std::io::Cursor::new(encoded), shard_size, algo, false);
-    let mut offset = 0usize;
-    while offset < payload.len() {
-        let want = shard_size.min(payload.len() - offset);
-        let mut buf = vec![0u8; want];
-        let read = reader
-            .read(&mut buf)
-            .await
-            .map_err(|err| BitrotSelfTestError::RoundtripVerify {
-                algorithm,
-                detail: format!("read back failed at offset {offset}: {err}"),
-            })?;
-        if read != want || buf[..read] != payload[offset..offset + read] {
-            return Err(BitrotSelfTestError::RoundtripReadback { algorithm });
-        }
-        offset += read;
-    }
-    Ok(())
-}
-
-/// Flip one byte and require `bitrot_verify` to reject the result.
-async fn bitrot_tamper_check(
-    algorithm: &'static str,
-    algo: HashAlgorithm,
-    payload: &[u8],
-    shard_size: usize,
-    tampered: &'static str,
-    flip_at: usize,
-) -> Result<(), BitrotSelfTestError> {
-    let mut writer = BitrotWriter::new(std::io::Cursor::new(Vec::<u8>::new()), shard_size, algo.clone());
-    for chunk in payload.chunks(shard_size) {
-        writer.write(chunk).await.expect("self-test encode should not fail");
-    }
-    let mut corrupt = writer.into_inner().into_inner();
-    let flip_index = flip_at % corrupt.len();
-    corrupt[flip_index] ^= 0x80;
-
-    let on_disk = bitrot_shard_file_size(payload.len(), shard_size, algo.clone());
-    match bitrot_verify(std::io::Cursor::new(corrupt), on_disk, payload.len(), algo, shard_size).await {
-        // The flipped byte must be rejected as a hash mismatch specifically, not
-        // by any incidental read error: an in-memory cursor cannot fail reads,
-        // so accepting any other failure here would mask a verify path that
-        // errors out before it ever compares hashes.
-        Err(err) if err.to_string().contains("hash mismatch") => Ok(()),
-        Ok(()) => Err(BitrotSelfTestError::TamperNotRejected { algorithm, tampered }),
-        Err(err) => Err(BitrotSelfTestError::RoundtripVerify {
-            algorithm,
-            detail: format!("tampered shard rejected with an unexpected error: {err}"),
-        }),
-    }
-}
-
-/// Verify every bitrot algorithm this crate can write or verify in production:
-/// both streaming Highway variants roundtrip end to end (encode → size formula
-/// → `bitrot_verify` → read back) and reject a flipped byte in both the data
-/// and the leading hash, while all three hashed algorithms reproduce their
-/// pinned known-answer digests.
-///
-/// Runs in well under a millisecond on 4 KiB of data; callers may run it inline
-/// at startup. Pure CPU, no allocation beyond a few KiB of scratch.
-pub async fn bitrot_self_test() -> Result<(), BitrotSelfTestError> {
-    let payload = bitrot_self_test_payload();
-
-    // Externally verifiable vector first: it guards the HashAlgorithm plumbing
-    // itself, before any self-pinned constants are consulted.
-    let abc = HashAlgorithm::SHA256.hash_encode(b"abc");
-    if abc.as_ref() != BITROT_SELF_TEST_KAT_SHA256_ABC.as_slice() {
-        return Err(BitrotSelfTestError::KnownAnswerMismatch {
-            algorithm: "SHA256",
-            got: self_test_hex(abc.as_ref()),
-            want: self_test_hex(&BITROT_SELF_TEST_KAT_SHA256_ABC),
-        });
-    }
-
-    bitrot_kat_check(
-        "HighwayHash256S",
-        &HashAlgorithm::HighwayHash256S,
-        &payload,
-        &BITROT_SELF_TEST_KAT_HIGHWAY_HASH256S,
-    )?;
-    bitrot_kat_check(
-        "HighwayHash256SLegacy",
-        &HashAlgorithm::HighwayHash256SLegacy,
-        &payload,
-        &BITROT_SELF_TEST_KAT_HIGHWAY_HASH256S_LEGACY,
-    )?;
-
-    for (algorithm, algo) in [
-        ("HighwayHash256S", HashAlgorithm::HighwayHash256S),
-        ("HighwayHash256SLegacy", HashAlgorithm::HighwayHash256SLegacy),
-    ] {
-        // Full blocks plus a partial tail, exactly like a real part stripe.
-        let tail_len = 2 * 1024 + 333;
-        bitrot_roundtrip_check(algorithm, algo.clone(), &payload, 1024).await?;
-        bitrot_roundtrip_check(algorithm, algo.clone(), &payload[..tail_len], 1024).await?;
-        // One flipped byte in the final data block, one in the first leading
-        // hash: both must fail verification.
-        bitrot_tamper_check(algorithm, algo.clone(), &payload, 1024, "final data byte", payload.len() - 1).await?;
-        bitrot_tamper_check(algorithm, algo, &payload, 1024, "leading hash byte", 0).await?;
-    }
-
-    Ok(())
-}
-
 #[cfg(test)]
 mod tests {
     use super::{
-        BitrotReader, BitrotWriter, BitrotWriterWrapper, CustomWriter, bitrot_kat_check, bitrot_self_test,
-        bitrot_self_test_payload, bitrot_shard_file_size, bitrot_verify, write_all_vectored,
+        BitrotReader, BitrotWriter, BitrotWriterWrapper, CustomWriter, bitrot_shard_file_size, bitrot_verify, write_all_vectored,
     };
     use super::{MAX_RETAINED_CHUNKS_PER_BLOCK, ShardChunkRead, ShardSource};
     use bytes::Bytes;
@@ -1343,32 +1090,6 @@ mod tests {
         }
     }
 
-    #[test]
-    fn bitrot_self_test_payload_is_deterministic() {
-        // Two independent builds of the payload must agree byte for byte, or
-        // the pinned known-answer digests below would be meaningless.
-        assert_eq!(bitrot_self_test_payload(), bitrot_self_test_payload());
-    }
-
-    #[test]
-    fn bitrot_self_test_rejects_a_wrong_known_answer_digest() {
-        let payload = bitrot_self_test_payload();
-        let wrong = [0u8; 32];
-        let err = bitrot_kat_check("HighwayHash256S", &HashAlgorithm::HighwayHash256S, &payload, &wrong)
-            .expect_err("a zeroed digest must never match");
-        match err {
-            super::BitrotSelfTestError::KnownAnswerMismatch { algorithm, .. } => assert_eq!(algorithm, "HighwayHash256S"),
-            other => panic!("expected KnownAnswerMismatch, got {other:?}"),
-        }
-    }
-
-    #[tokio::test]
-    async fn bitrot_self_test_passes() {
-        bitrot_self_test()
-            .await
-            .expect("the pinned digests and roundtrip checks must all pass on this platform");
-    }
-
     #[tokio::test]
     async fn vectored_test_writers_cover_fallback_flush_and_shutdown_paths() {
         let mut counting = VectoredCountingWriter::default();
@@ -1468,7 +1189,7 @@ mod tests {
         let last = corrupt.len() - 1;
         corrupt[last] ^= 0x80;
         let err = bitrot_verify(
-            std::io::Cursor::new(corrupt),
+            Cursor::new(corrupt),
             super::bitrot_shard_file_size(data.len(), shard_size, algo.clone()),
             data.len(),
             algo,
@@ -1561,7 +1282,7 @@ mod tests {
 
     #[tokio::test]
     async fn bitrot_reader_rejects_output_buffers_larger_than_shard_size() {
-        let mut reader = BitrotReader::new(std::io::Cursor::new(Vec::<u8>::new()), 4, HashAlgorithm::None, false);
+        let mut reader = BitrotReader::new(Cursor::new(Vec::<u8>::new()), 4, HashAlgorithm::None, false);
         let mut out = [0u8; 5];
         let err = reader
             .read(&mut out)
@@ -1686,7 +1407,7 @@ mod tests {
             (HashAlgorithm::HighwayHash256, true),
         ] {
             let label = format!("{algo:?}");
-            let writer = std::io::Cursor::new(Vec::<u8>::new());
+            let writer = Cursor::new(Vec::<u8>::new());
             let mut w = BitrotWriter::new(writer, shard_size, algo.clone());
             w.write(&[7u8; 16]).await.unwrap();
             let written = w.into_inner().into_inner();
@@ -1771,7 +1492,7 @@ mod tests {
     }
 
     async fn encode_one_block(payload: &[u8], shard_size: usize, algo: HashAlgorithm) -> Vec<u8> {
-        let mut w = BitrotWriter::new(std::io::Cursor::new(Vec::<u8>::new()), shard_size, algo);
+        let mut w = BitrotWriter::new(Cursor::new(Vec::<u8>::new()), shard_size, algo);
         w.write(payload).await.unwrap();
         w.into_inner().into_inner()
     }
@@ -1879,7 +1600,7 @@ mod tests {
         for algo in [HashAlgorithm::HighwayHash256S, HashAlgorithm::HighwayHash256SLegacy] {
             for &size in &[1usize, 16, 17, 32, 40, 48] {
                 let payload: Vec<u8> = (0..size).map(|i| i as u8).collect();
-                let mut w = BitrotWriter::new(std::io::Cursor::new(Vec::<u8>::new()), shard_size, algo.clone());
+                let mut w = BitrotWriter::new(Cursor::new(Vec::<u8>::new()), shard_size, algo.clone());
                 for chunk in payload.chunks(shard_size) {
                     w.write(chunk).await.unwrap();
                 }
@@ -1953,14 +1674,14 @@ mod tests {
             w.write(&data).await.expect("write shard");
 
             let mut via_read = vec![0u8; SHARD];
-            let n1 = BitrotReader::new(std::io::Cursor::new(encoded.clone()), SHARD, algo.clone(), false)
+            let n1 = BitrotReader::new(Cursor::new(encoded.clone()), SHARD, algo.clone(), false)
                 .read(&mut via_read)
                 .await
                 .expect("read");
 
             // A buffer with only capacity — no initialized bytes at all.
             let mut via_append: Vec<u8> = Vec::with_capacity(SHARD);
-            let n2 = BitrotReader::new(std::io::Cursor::new(encoded), SHARD, algo.clone(), false)
+            let n2 = BitrotReader::new(Cursor::new(encoded), SHARD, algo.clone(), false)
                 .read_appending(&mut via_append, SHARD)
                 .await
                 .expect("read_appending");
@@ -1985,7 +1706,7 @@ mod tests {
             encoded.truncate(encoded.len() - 1);
 
             let mut out: Vec<u8> = Vec::with_capacity(SHARD);
-            let err = BitrotReader::new(std::io::Cursor::new(encoded), SHARD, algo.clone(), false)
+            let err = BitrotReader::new(Cursor::new(encoded), SHARD, algo.clone(), false)
                 .read_appending(&mut out, SHARD)
                 .await
                 .expect_err("a truncated shard must not succeed");
@@ -2011,7 +1732,7 @@ mod tests {
         encoded[last] ^= 0xff;
 
         let mut out: Vec<u8> = Vec::with_capacity(SHARD);
-        let err = BitrotReader::new(std::io::Cursor::new(encoded), SHARD, algo, false)
+        let err = BitrotReader::new(Cursor::new(encoded), SHARD, algo, false)
             .read_appending(&mut out, SHARD)
             .await
             .expect_err("a corrupt shard must not verify");
@@ -2123,7 +1844,7 @@ mod tests {
             "Cursor<Bytes> must be able to hand out a block, otherwise the fast path is dead code"
         );
         assert_eq!(mem.position(), 8, "taking a block must advance like a read of the same length");
-        let mut streamed = std::io::Cursor::new(encoded.clone());
+        let mut streamed = Cursor::new(encoded.clone());
         assert!(
             ShardSource::try_take_block(&mut streamed, 8).is_none(),
             "a non-Bytes source must stay on the streaming path"
@@ -2151,7 +1872,7 @@ mod tests {
         );
 
         let mut via_stream: Vec<u8> = Vec::with_capacity(SHARD);
-        BitrotReader::new(std::io::Cursor::new(encoded), SHARD, algo, false)
+        BitrotReader::new(Cursor::new(encoded), SHARD, algo, false)
             .read_appending(&mut via_stream, SHARD)
             .await
             .expect("streaming read");

crates/ecstore/src/error/mod.rs

@@ -1116,14 +1116,6 @@ mod tests {
         assert!(encoder_source.is::<reed_solomon_erasure::Error>());
     }
 
-    // The lifecycle transition worker relies on this arm alone to suppress the
-    // closed-connection noise (`bucket_lifecycle_ops.rs`); dropping it here would
-    // silently turn shutdown races back into `error!` log spam.
-    #[test]
-    fn is_network_or_host_down_covers_closed_network_connection() {
-        assert!(is_network_or_host_down("transition failed: use of closed network connection", false));
-    }
-
     // Regression for #952 (ECA-11): an all-`DiskNotFound` slice (every drive in
     // every set unreachable) must NOT be classified as "all not found",
     // otherwise ListObjects silently returns an empty listing and masks a full

crates/ecstore/src/services/rebalance/types.rs

@@ -132,6 +132,7 @@ impl RebalanceStopPropagationRecord {
     }
 }
 
+#[allow(dead_code)]
 #[derive(Debug, Clone, Default)]
 pub struct DiskStat {
     pub total_space: u64,

crates/ecstore/src/services/tier/tier_config.rs

@@ -16,16 +16,8 @@ use serde::{Deserialize, Serialize};
 use std::{fmt::Display, io};
 use tracing::info;
 
-#[allow(
-    dead_code,
-    reason = "tier config wire version stamped by the parity constructors below (backlog#1823)"
-)]
 const C_TIER_CONFIG_VER: &str = "v1";
 
-#[allow(
-    dead_code,
-    reason = "tier-name validation message reached only from the parity constructors below (backlog#1823)"
-)]
 const ERR_TIER_NAME_EMPTY: &str = "remote tier name empty";
 const WASABI_US_EAST_ENDPOINT: &str = "https://s3.wasabisys.com";
 const WASABI_ALTERNATIVE_ENDPOINTS: &[(&str, &str)] = &[
@@ -272,6 +264,7 @@ impl Clone for TierConfig {
     }
 }
 
+#[allow(dead_code)]
 impl TierConfig {
     pub(crate) fn clone_with_credentials(&self) -> Self {
         Self {
@@ -291,7 +284,6 @@ impl TierConfig {
         }
     }
 
-    #[allow(dead_code, reason = "MinIO-parity surface with no caller in this port (backlog#1823)")]
     fn endpoint(&self) -> String {
         match self.tier_type {
             TierType::S3 => self.s3.as_ref().map(|s| s.endpoint.clone()).unwrap_or_default(),
@@ -311,7 +303,6 @@ impl TierConfig {
         }
     }
 
-    #[allow(dead_code, reason = "MinIO-parity surface with no caller in this port (backlog#1823)")]
     fn bucket(&self) -> String {
         match self.tier_type {
             TierType::S3 => self.s3.as_ref().map(|s| s.bucket.clone()).unwrap_or_default(),
@@ -331,7 +322,6 @@ impl TierConfig {
         }
     }
 
-    #[allow(dead_code, reason = "MinIO-parity surface with no caller in this port (backlog#1823)")]
     fn prefix(&self) -> String {
         match self.tier_type {
             TierType::S3 => self.s3.as_ref().map(|s| s.prefix.clone()).unwrap_or_default(),
@@ -351,7 +341,6 @@ impl TierConfig {
         }
     }
 
-    #[allow(dead_code, reason = "MinIO-parity surface with no caller in this port (backlog#1823)")]
     fn region(&self) -> String {
         match self.tier_type {
             TierType::S3 => self.s3.as_ref().map(|s| s.region.clone()).unwrap_or_default(),
@@ -468,7 +457,7 @@ impl TierWasabi {
 }
 
 impl TierS3 {
-    #[allow(dead_code, reason = "MinIO-parity surface with no caller in this port (backlog#1823)")]
+    #[allow(dead_code)]
     fn create<F>(
         name: &str,
         access_key: &str,
@@ -539,7 +528,7 @@ pub struct TierMinIO {
 }
 
 impl TierMinIO {
-    #[allow(dead_code, reason = "MinIO-parity surface with no caller in this port (backlog#1823)")]
+    #[allow(dead_code)]
     fn create<F>(
         name: &str,
         endpoint: &str,

crates/ecstore/src/services/tier/tier_gen.rs

@@ -14,6 +14,7 @@
 
 use crate::services::tier::tier::TierConfigMgr;
 
+#[allow(dead_code)]
 impl TierConfigMgr {
     pub fn msg_size(&self) -> usize {
         100

crates/ecstore/src/set_disk/core/io_primitives.rs

@@ -4860,14 +4860,6 @@ impl SetDisks {
     /// is best-effort maintenance: individual delete failures are logged and
     /// skipped rather than propagated.
     pub(crate) async fn reclaim_orphan_data_dirs(&self, bucket: &str, object: &str) -> disk::error::Result<usize> {
-        self.reclaim_orphan_data_dirs_inner(bucket, object, false).await
-    }
-
-    pub(crate) async fn dry_run_reclaim_orphan_data_dirs(&self, bucket: &str, object: &str) -> disk::error::Result<usize> {
-        self.reclaim_orphan_data_dirs_inner(bucket, object, true).await
-    }
-
-    async fn reclaim_orphan_data_dirs_inner(&self, bucket: &str, object: &str, dry_run: bool) -> disk::error::Result<usize> {
         let disks = self.get_disks_internal().await;
 
         // Phase 1 (read-only): build the referenced-data-dir union and record the
@@ -4975,20 +4967,6 @@ impl SetDisks {
                     continue;
                 }
                 let stray = format!("{object}/{dir}");
-                if dry_run {
-                    removed += 1;
-                    debug!(
-                        target: "rustfs_ecstore::set_disk",
-                        event = "heal_abandoned_parts",
-                        component = "ecstore",
-                        subsystem = "heal",
-                        state = "dry_run_matched",
-                        result = "matched",
-                        bucket, object, data_dir = %dir,
-                        "Heal abandoned parts dry-run matched orphaned data directory"
-                    );
-                    continue;
-                }
                 match disk
                     .delete(
                         bucket,

crates/ecstore/src/set_disk/mod.rs

@@ -6998,100 +6998,6 @@ mod tests {
         assert!(object_dir.join(STORAGE_FORMAT_FILE).exists(), "metadata must be preserved");
     }
 
-    async fn recv_abandoned_parts_trace(
-        trace: &mut rustfs_common::trace_bus::TraceSubscription,
-        bucket: &str,
-        object: &str,
-        state: &str,
-    ) -> rustfs_common::trace_bus::TraceEvent {
-        for _ in 0..32 {
-            let event = tokio::time::timeout(std::time::Duration::from_secs(1), trace.recv())
-                .await
-                .expect("abandoned-parts trace event should arrive")
-                .expect("trace bus should stay open");
-            if event.kind == rustfs_common::trace_bus::TraceKind::Heal
-                && event.func == rustfs_common::trace_bus::TraceFunc::HealCheckAbandonedParts
-                && event.bucket.as_deref() == Some(bucket)
-                && event.object.as_deref() == Some(object)
-                && trace_attr_string(&event, "state").as_deref() == Some(state)
-            {
-                return (*event).clone();
-            }
-        }
-
-        panic!("expected abandoned-parts trace state {state} for {bucket}/{object}");
-    }
-
-    fn trace_attr_string(event: &rustfs_common::trace_bus::TraceEvent, key: &str) -> Option<String> {
-        event.attrs.iter().find_map(|attr| {
-            if attr.key != key {
-                return None;
-            }
-            Some(match &attr.value {
-                rustfs_common::trace_bus::TraceVal::Bool(value) => value.to_string(),
-                rustfs_common::trace_bus::TraceVal::U64(value) => value.to_string(),
-                rustfs_common::trace_bus::TraceVal::I64(value) => value.to_string(),
-                rustfs_common::trace_bus::TraceVal::Str(value) => value.to_string(),
-            })
-        })
-    }
-
-    #[tokio::test]
-    async fn check_abandoned_parts_dry_run_counts_without_deleting() {
-        let mut trace = rustfs_common::trace_bus::subscribe_trace_events();
-        let (dir, disk) = make_single_local_disk().await;
-        let live = Uuid::new_v4();
-        let orphan = Uuid::new_v4();
-
-        let object_dir = dir.path().join("bucket").join("obj");
-        write_object_meta_with_data_dirs(&object_dir, "bucket", "obj", &[live]).await;
-        fs::create_dir_all(object_dir.join(live.to_string()))
-            .await
-            .expect("live data dir should be created");
-        fs::create_dir_all(object_dir.join(orphan.to_string()))
-            .await
-            .expect("orphan data dir should be created");
-
-        let set = make_set_disks_with(vec![Some(disk)]).await;
-        set.check_abandoned_parts(
-            "bucket",
-            "obj",
-            &HealOpts {
-                dry_run: true,
-                no_lock: true,
-                ..Default::default()
-            },
-        )
-        .await
-        .expect("dry-run abandoned-parts check should succeed");
-        let dry_run_trace = recv_abandoned_parts_trace(&mut trace, "bucket", "obj", "dry_run_matched").await;
-        assert_eq!(trace_attr_string(&dry_run_trace, "dry_run").as_deref(), Some("true"));
-        assert_eq!(trace_attr_string(&dry_run_trace, "data_dirs").as_deref(), Some("1"));
-
-        assert!(object_dir.join(live.to_string()).exists(), "referenced data dir must be preserved");
-        assert!(object_dir.join(orphan.to_string()).exists(), "dry-run must not remove orphaned data dir");
-
-        set.check_abandoned_parts(
-            "bucket",
-            "obj",
-            &HealOpts {
-                no_lock: true,
-                ..Default::default()
-            },
-        )
-        .await
-        .expect("abandoned-parts check should reclaim stale data dir");
-        let reclaim_trace = recv_abandoned_parts_trace(&mut trace, "bucket", "obj", "reclaimed").await;
-        assert_eq!(trace_attr_string(&reclaim_trace, "dry_run").as_deref(), Some("false"));
-        assert_eq!(trace_attr_string(&reclaim_trace, "data_dirs").as_deref(), Some("1"));
-
-        assert!(
-            object_dir.join(live.to_string()).exists(),
-            "referenced data dir must remain after reclaim"
-        );
-        assert!(!object_dir.join(orphan.to_string()).exists(), "orphaned data dir must be removed");
-    }
-
     #[tokio::test]
     async fn reclaim_orphan_data_dirs_recovers_deferred_cleanup_after_restart() {
         let (dir, disk) = make_single_local_disk().await;
@@ -12327,18 +12233,11 @@ mod tests {
             .expect_err("unsupported copy_object_part should return a typed error");
         assert!(matches!(copy_part_err, StorageError::NotImplemented));
 
-        set_disks
-            .check_abandoned_parts(
-                "bucket",
-                "object",
-                &HealOpts {
-                    dry_run: true,
-                    no_lock: true,
-                    ..Default::default()
-                },
-            )
+        let abandoned_err = set_disks
+            .check_abandoned_parts("bucket", "object", &HealOpts::default())
             .await
-            .expect("abandoned-parts check should be callable on empty disk sets");
+            .expect_err("abandoned-parts check should stay in the upper reconciliation layer");
+        assert!(matches!(abandoned_err, StorageError::NotImplemented));
     }
 
     #[tokio::test]

crates/ecstore/src/set_disk/ops/heal.rs

@@ -16,7 +16,6 @@ use super::super::*;
 use crate::disk::disk_store::DiskStoreRenameDataExt;
 use crate::io_support::bitrot::object_mmap_read_enabled;
 use crate::storage_api_contracts::namespace::NamespaceLocking as _;
-use rustfs_common::trace_bus::{TraceEvent, TraceFunc, TraceKind, trace_emit};
 use tracing::trace;
 
 const LOG_COMPONENT_ECSTORE: &str = "ecstore";
@@ -2058,61 +2057,11 @@ impl crate::storage_api_contracts::heal::HealOperations for SetDisks {
         Err(Error::DiskNotFound)
     }
 
-    #[tracing::instrument(level = "debug", skip(self, opts), fields(bucket = %bucket, object = %object, dry_run = opts.dry_run))]
-    async fn check_abandoned_parts(&self, bucket: &str, object: &str, opts: &HealOpts) -> Result<()> {
-        let started_at = std::time::Instant::now();
-        let _write_lock_guard = if !opts.no_lock {
-            let ns_lock = self.new_ns_lock(bucket, object).await?;
-            Some(
-                ns_lock
-                    .get_write_lock(get_lock_acquire_timeout())
-                    .await
-                    .map_err(|e| self.map_namespace_lock_error(bucket, object, "write", e))?,
-            )
-        } else {
-            None
-        };
-
-        let removed = if opts.dry_run {
-            self.dry_run_reclaim_orphan_data_dirs(bucket, object).await?
-        } else {
-            self.reclaim_orphan_data_dirs(bucket, object).await?
-        };
-        let state = if opts.dry_run && removed > 0 {
-            "dry_run_matched"
-        } else if removed > 0 {
-            "reclaimed"
-        } else {
-            "checked"
-        };
-        let data_dirs = u64::try_from(removed).unwrap_or(u64::MAX);
-
-        trace_emit(|| {
-            TraceEvent::new(TraceKind::Heal, TraceFunc::HealCheckAbandonedParts)
-                .with_bucket(bucket)
-                .with_object(object)
-                .with_duration(started_at.elapsed())
-                .with_attr("state", state)
-                .with_attr("dry_run", opts.dry_run)
-                .with_attr("data_dirs", data_dirs)
-        });
-
-        if removed > 0 {
-            trace!(
-                event = "heal_abandoned_parts",
-                component = LOG_COMPONENT_ECSTORE,
-                subsystem = LOG_SUBSYSTEM_HEAL,
-                state = if opts.dry_run { "dry_run_matched" } else { "reclaimed" },
-                result = "ok",
-                bucket,
-                object,
-                dry_run = opts.dry_run,
-                data_dirs = removed,
-                "Heal abandoned parts checked object data directories"
-            );
-        }
-
-        Ok(())
+    #[tracing::instrument(skip(self))]
+    async fn check_abandoned_parts(&self, _bucket: &str, _object: &str, _opts: &HealOpts) -> Result<()> {
+        // Multipart orphan reconciliation is intentionally retained above the set layer
+        // until there is a concrete caller and a stable lower-level contract to implement.
+        Err(StorageError::NotImplemented)
     }
 }
 
@@ -3297,223 +3246,4 @@ mod heal_result_report_tests {
         assert!(result.detail.contains("part 1"));
         assert!(result.detail.contains("bitrot_failure=true"));
     }
-
-    // HS-12 (backlog#1874): a versioned DELETE racing an object heal must never
-    // resurrect the deleted version. The heal has real reconstruction work (a
-    // shard of the doomed version is removed), so both sides touch the same
-    // (bucket, object, data_dir); whichever order the ns write lock serializes
-    // them in, the committed delete must win.
-    #[tokio::test]
-    #[serial_test::serial]
-    async fn heal_racing_version_delete_never_resurrects_the_deleted_version() {
-        let (temp_dirs, disks, set) = hermetic_set_disks_isolated(4).await;
-        let bucket = "heal-race-delete-no-resurrect";
-        let object = "object.bin";
-        set.make_bucket(
-            bucket,
-            &MakeBucketOptions {
-                versioning_enabled: true,
-                ..Default::default()
-            },
-        )
-        .await
-        .expect("versioned bucket should be created");
-
-        let mut first_reader = PutObjReader::from_vec(vec![0x11; 1024 * 1024]);
-        let first_info = set
-            .put_object(
-                bucket,
-                object,
-                &mut first_reader,
-                &ObjectOptions {
-                    versioned: true,
-                    ..Default::default()
-                },
-            )
-            .await
-            .expect("first version should be written");
-        let first_version = first_info
-            .version_id
-            .expect("versioned put should return the first version id")
-            .to_string();
-
-        let mut second_reader = PutObjReader::from_vec(vec![0x22; 1024 * 1024]);
-        let second_info = set
-            .put_object(
-                bucket,
-                object,
-                &mut second_reader,
-                &ObjectOptions {
-                    versioned: true,
-                    ..Default::default()
-                },
-            )
-            .await
-            .expect("second version should be written");
-        let second_version = second_info
-            .version_id
-            .expect("versioned put should return the second version id")
-            .to_string();
-
-        // Damage one shard of the doomed version so the racing heal performs an
-        // actual reconstruction over its data dir instead of an early exit.
-        let doomed_source = disks[0]
-            .read_version("", bucket, object, &first_version, &ReadOptions::default())
-            .await
-            .expect("doomed version metadata should be readable");
-        let doomed_data_dir = doomed_source
-            .data_dir
-            .expect("non-inline version should have a data directory");
-        tokio::fs::remove_file(
-            temp_dirs[1]
-                .path()
-                .join(bucket)
-                .join(object)
-                .join(doomed_data_dir.to_string())
-                .join("part.1"),
-        )
-        .await
-        .expect("shard damage should be injected before the race");
-
-        let delete_set = set.clone();
-        let (delete_res, heal_res) = tokio::join!(
-            async {
-                delete_set
-                    .delete_object(
-                        bucket,
-                        object,
-                        ObjectOptions {
-                            versioned: true,
-                            version_id: Some(first_version.clone()),
-                            object_lock_config_snapshot: Some(Arc::new(crate::set_disk::ObjectLockConfigSnapshot::new(
-                                crate::bucket::metadata_sys::ObjectLockConfigState::ConfirmedAbsent,
-                            ))),
-                            ..Default::default()
-                        },
-                    )
-                    .await
-            },
-            async {
-                set.heal_object(
-                    bucket,
-                    object,
-                    "",
-                    &HealOpts {
-                        scan_mode: HealScanMode::Deep,
-                        ..Default::default()
-                    },
-                )
-                .await
-            },
-        );
-        delete_res.expect("version delete must succeed under lock serialization");
-        // The heal may legitimately report a transient failure when the version
-        // it was rebuilding disappears mid-flight; only the end state matters.
-        drop(heal_res);
-
-        let resurrected = set
-            .get_object_info(
-                bucket,
-                object,
-                &ObjectOptions {
-                    versioned: true,
-                    version_id: Some(first_version.clone()),
-                    ..Default::default()
-                },
-            )
-            .await;
-        assert!(
-            matches!(&resurrected, Err(Error::FileVersionNotFound) | Err(Error::ObjectNotFound(..))),
-            "a racing heal must not resurrect the deleted version: {resurrected:?}"
-        );
-
-        let survivor = set
-            .get_object_info(
-                bucket,
-                object,
-                &ObjectOptions {
-                    versioned: true,
-                    version_id: Some(second_version.clone()),
-                    ..Default::default()
-                },
-            )
-            .await
-            .expect("surviving version must remain readable after the race");
-        assert_eq!(survivor.size, 1024 * 1024, "survivor size must be intact");
-    }
-
-    // HS-12 (backlog#1874): unversioned overwrite commits race a Deep heal on
-    // the same object. The overwrite's post-commit tail deletes the replaced
-    // data dir without the ns lock (object.rs commit tail), which is exactly
-    // the intersection the audit flagged: the heal must tolerate the tail race
-    // (retryable outcome) and every committed overwrite must survive — the
-    // final current version is exactly the last payload written.
-    #[tokio::test]
-    #[serial_test::serial]
-    async fn heal_racing_unversioned_overwrites_preserves_the_last_commit() {
-        let (temp_dirs, disks, set) = hermetic_set_disks_isolated(4).await;
-        let bucket = "heal-race-put-overwrite";
-        let object = "object.bin";
-        set.make_bucket(bucket, &MakeBucketOptions::default())
-            .await
-            .expect("bucket should be created");
-
-        const ROUNDS: usize = 8;
-        const PAYLOAD_SIZE: usize = 256 * 1024;
-        let mut last_etag = String::new();
-        for round in 0..ROUNDS {
-            // Give the heal something to rebuild on alternating rounds: remove a
-            // shard of the current data dir right before the race.
-            if round % 2 == 1 {
-                let current = disks[2]
-                    .read_version("", bucket, object, "", &ReadOptions::default())
-                    .await
-                    .expect("current metadata should be readable");
-                if let Some(data_dir) = current.data_dir {
-                    let shard = temp_dirs[3]
-                        .path()
-                        .join(bucket)
-                        .join(object)
-                        .join(data_dir.to_string())
-                        .join("part.1");
-                    if shard.exists() {
-                        tokio::fs::remove_file(&shard)
-                            .await
-                            .expect("shard damage should be injectable mid-race");
-                    }
-                }
-            }
-
-            let payload = vec![round as u8; PAYLOAD_SIZE];
-            let mut put_reader = PutObjReader::from_vec(payload);
-            let put_opts = ObjectOptions::default();
-            let heal_opts = HealOpts {
-                scan_mode: HealScanMode::Deep,
-                ..Default::default()
-            };
-            let (put_res, heal_res) = tokio::join!(
-                set.put_object(bucket, object, &mut put_reader, &put_opts),
-                set.heal_object(bucket, object, "", &heal_opts),
-            );
-            let put_info = put_res.expect("overwrite must succeed under lock serialization");
-            last_etag = put_info.etag.clone().unwrap_or_default();
-            // Heal outcome is unconstrained (may hit the tail race and report a
-            // retryable error); the invariant is checked on the end state.
-            drop(heal_res);
-        }
-
-        let final_info = set
-            .get_object_info(bucket, object, &ObjectOptions::default())
-            .await
-            .expect("object must remain readable after the race loop");
-        assert_eq!(
-            final_info.size, PAYLOAD_SIZE as i64,
-            "final current version must be the last committed overwrite"
-        );
-        assert_eq!(
-            final_info.etag.unwrap_or_default(),
-            last_etag,
-            "the racing heal loop must never leave a stale or resurrected current version"
-        );
-    }
 }

crates/ecstore/src/set_disk/ops/heal_walk.rs

@@ -23,7 +23,6 @@
 //! per-version `SetDisks::heal_object`.
 
 use super::super::*;
-use crate::object_api::ObjectInfo;
 use std::collections::HashSet;
 use std::sync::Mutex;
 use std::sync::atomic::{AtomicBool, AtomicUsize, Ordering};
@@ -40,16 +39,12 @@ const BACKGROUND_WALKDIR_STALL_TIMEOUT: Duration = Duration::from_secs(60);
 /// it must not gate healing logic — the delete-marker vs data path is chosen
 /// inside `ops/heal.rs` from the resolved latest metadata. `version_id` is
 /// normalized (nil/absent UUID => `None`).
-#[derive(Debug, Clone)]
+#[derive(Debug, Clone, PartialEq, Eq)]
 pub struct HealWalkVersion {
     /// object key
     pub name: String,
     /// normalized version id (`None` when the version is nil/absent)
     pub version_id: Option<String>,
-    /// version modification time as Unix nanoseconds
-    pub mod_time_unix_nanos: Option<i128>,
-    /// object snapshot for lifecycle evaluation
-    pub lifecycle_object_info: Option<ObjectInfo>,
     /// whether this version is a delete marker (observability only)
     pub is_delete_marker: bool,
 }
@@ -68,7 +63,6 @@ struct HealWalkCollector {
     bucket: String,
     batch_objects: usize,
     version_budget: usize,
-    include_lifecycle_object_info: bool,
     objects: Mutex<Vec<HealWalkObject>>,
     decode_error: Mutex<Option<DiskError>>,
     version_total: AtomicUsize,
@@ -122,25 +116,10 @@ impl HealWalkCollector {
 
         let mut versions = Vec::with_capacity(fiv.versions.len() + fiv.free_versions.len());
         for fi in fiv.versions.iter().chain(fiv.free_versions.iter()) {
-            let version_uuid = fi.version_id.filter(|version_id| !version_id.is_nil());
-            let lifecycle_object_info = if self.include_lifecycle_object_info {
-                let mut lifecycle_fi = fi.clone();
-                lifecycle_fi.version_id = version_uuid;
-                Some(ObjectInfo::from_file_info(
-                    &lifecycle_fi,
-                    &self.bucket,
-                    &entry.name,
-                    version_uuid.is_some(),
-                ))
-            } else {
-                None
-            };
             versions.push(HealWalkVersion {
                 name: entry.name.clone(),
                 // Normalize: nil/absent version id => None.
-                version_id: version_uuid.map(|u| u.to_string()),
-                mod_time_unix_nanos: fi.mod_time.map(|mod_time| mod_time.unix_timestamp_nanos()),
-                lifecycle_object_info,
+                version_id: fi.version_id.filter(|u| !u.is_nil()).map(|u| u.to_string()),
                 is_delete_marker: fi.deleted,
             });
         }
@@ -194,26 +173,11 @@ impl HealWalkCollector {
                 }
             };
             for fi in fiv.versions.iter().chain(fiv.free_versions.iter()) {
-                let version_uuid = fi.version_id.filter(|version_id| !version_id.is_nil());
-                let vid = version_uuid.map(|u| u.to_string());
+                let vid = fi.version_id.filter(|u| !u.is_nil()).map(|u| u.to_string());
                 if seen.insert(vid.clone()) {
-                    let lifecycle_object_info = if self.include_lifecycle_object_info {
-                        let mut lifecycle_fi = fi.clone();
-                        lifecycle_fi.version_id = version_uuid;
-                        Some(ObjectInfo::from_file_info(
-                            &lifecycle_fi,
-                            &self.bucket,
-                            &entry.name,
-                            version_uuid.is_some(),
-                        ))
-                    } else {
-                        None
-                    };
                     versions.push(HealWalkVersion {
                         name: entry.name.clone(),
                         version_id: vid,
-                        mod_time_unix_nanos: fi.mod_time.map(|mod_time| mod_time.unix_timestamp_nanos()),
-                        lifecycle_object_info,
                         is_delete_marker: fi.deleted,
                     });
                 }
@@ -291,7 +255,6 @@ impl SetDisks {
         forward_to: Option<&str>,
         batch_objects: usize,
         version_budget: usize,
-        include_lifecycle_object_info: bool,
     ) -> disk::error::Result<(Vec<HealWalkVersion>, Option<String>, bool)> {
         assert!(batch_objects >= 2, "heal_walk_versions_page requires batch_objects >= 2");
 
@@ -301,7 +264,6 @@ impl SetDisks {
             bucket: bucket.to_string(),
             batch_objects,
             version_budget: version_budget.max(1),
-            include_lifecycle_object_info,
             objects: Mutex::new(Vec::new()),
             decode_error: Mutex::new(None),
             version_total: AtomicUsize::new(0),
@@ -385,7 +347,6 @@ mod tests {
             bucket: "bucket".to_string(),
             batch_objects: 2,
             version_budget: 2,
-            include_lifecycle_object_info: false,
             objects: Mutex::new(Vec::new()),
             decode_error: Mutex::new(None),
             version_total: AtomicUsize::new(0),
@@ -427,8 +388,6 @@ mod tests {
         HealWalkVersion {
             name: name.to_string(),
             version_id: Some(id.to_string()),
-            mod_time_unix_nanos: None,
-            lifecycle_object_info: None,
             is_delete_marker: dm,
         }
     }
@@ -532,7 +491,6 @@ mod tests {
             bucket: "bucket".to_string(),
             batch_objects: 1000,
             version_budget: 10_000,
-            include_lifecycle_object_info: false,
             objects: Mutex::new(Vec::new()),
             version_total: AtomicUsize::new(0),
             decode_error: Mutex::new(None),
@@ -609,7 +567,7 @@ mod tests {
         .expect("corrupt test metadata should be written");
 
         let error = set_disks
-            .heal_walk_versions_page(bucket, "", None, 2, 2, false)
+            .heal_walk_versions_page(bucket, "", None, 2, 2)
             .await
             .expect_err("semantic metadata corruption must fail the heal disk walk");
 

crates/ecstore/src/set_disk/ops/object.rs

@@ -5845,14 +5845,6 @@ impl crate::storage_api_contracts::object::ObjectOperations for SetDisks {
 
     #[tracing::instrument(skip(self))]
     async fn add_partial(&self, bucket: &str, object: &str, version_id: &str) -> Result<()> {
-        // MRF journal intent: partial-write recovery must survive a restart
-        // (HS-01); the heal request below remains the in-memory fast path.
-        rustfs_common::mrf_channel::try_send_mrf_intent(
-            rustfs_common::mrf_channel::MrfKind::PartialWrite,
-            bucket,
-            object,
-            uuid::Uuid::try_parse(version_id).ok(),
-        );
         let mut request = rustfs_common::heal_channel::create_heal_request_with_options(
             bucket.to_string(),
             Some(object.to_string()),

crates/ecstore/src/set_disk/read.rs

@@ -1077,15 +1077,6 @@ impl SetDisks {
                             "Recoverable decode error triggered read repair"
                         );
                         let version_id = fi.version_id.as_ref().map(ToString::to_string);
-                        // MRF journal intent: keeps a durable Urgent ECDecode
-                        // request alive across restarts even when the in-memory
-                        // read-repair request is dropped or lost (HS-01).
-                        rustfs_common::mrf_channel::try_send_mrf_intent(
-                            rustfs_common::mrf_channel::MrfKind::DecodeFailure,
-                            bucket,
-                            object,
-                            fi.version_id,
-                        );
                         submit_read_repair_heal(
                             bucket,
                             object,

crates/ecstore/src/store/heal.rs

@@ -18,7 +18,6 @@ use tracing::trace;
 
 const LOG_COMPONENT_ECSTORE: &str = "ecstore";
 const LOG_SUBSYSTEM_HEAL: &str = "heal";
-const EVENT_HEAL_ABANDONED_PARTS: &str = "heal_abandoned_parts";
 const EVENT_HEAL_FORMAT_COMPLETED: &str = "heal_format_completed";
 const EVENT_HEAL_OBJECT_STARTED: &str = "heal_object_started";
 
@@ -257,40 +256,13 @@ impl ECStore {
 
     #[instrument(skip(self))]
     pub(super) async fn handle_check_abandoned_parts(&self, bucket: &str, object: &str, opts: &HealOpts) -> Result<()> {
-        let object = encode_dir_object(object);
-        let pools = self.get_pools_for_heal_object(opts)?;
-
-        let mut futures = Vec::with_capacity(pools.len());
-        for pool in pools.iter() {
-            futures.push(pool.check_abandoned_parts(bucket, &object, opts));
-        }
-
-        let mut first_error = None;
-        for result in join_all(futures).await {
-            if let Err(err) = result
-                && first_error.is_none()
-            {
-                first_error = Some(err);
-            }
-        }
-
-        if let Some(err) = first_error {
-            return Err(err);
-        }
-
-        trace!(
-            event = EVENT_HEAL_ABANDONED_PARTS,
-            component = LOG_COMPONENT_ECSTORE,
-            subsystem = LOG_SUBSYSTEM_HEAL,
-            state = "completed",
-            result = "ok",
-            bucket,
-            object,
-            dry_run = opts.dry_run,
-            "Heal abandoned parts completed"
-        );
-
-        Ok(())
+        let _ = (bucket, object, opts);
+        // Stale multipart reconciliation is already owned by the lifecycle-driven
+        // background cleanup path in `bucket_lifecycle_ops.rs`. There is currently
+        // no stable object-heal contract that should fan this request out through
+        // pool/set storage layers, so keep the placeholder explicit at the ECStore
+        // boundary instead of dispatching into lower layers.
+        Err(StorageError::NotImplemented)
     }
 }
 

crates/ecstore/src/store/heal_walk.rs

@@ -34,7 +34,6 @@ impl ECStore {
         forward_to: Option<&str>,
         batch_objects: usize,
         version_budget: usize,
-        include_lifecycle_object_info: bool,
     ) -> Result<(Vec<HealWalkVersion>, Option<String>, bool)> {
         if pool_idx >= self.pools.len() || set_idx >= self.pools[pool_idx].disk_set.len() {
             return Err(Error::other(format!(
@@ -44,7 +43,7 @@ impl ECStore {
         }
 
         self.pools[pool_idx].disk_set[set_idx]
-            .heal_walk_versions_page(bucket, prefix, forward_to, batch_objects, version_budget, include_lifecycle_object_info)
+            .heal_walk_versions_page(bucket, prefix, forward_to, batch_objects, version_budget)
             .await
             .map_err(Error::from)
     }

crates/ecstore/src/store/mod.rs

@@ -216,16 +216,6 @@ impl std::fmt::Debug for ECStore {
 /// These delegate to the process-global statics. No local state — the globals
 /// remain the single source of truth until the migration is complete.
 impl ECStore {
-    /// Every erasure set across all pools, pool-major order.
-    ///
-    /// Read-only queries that must consult each set's own copy of a
-    /// per-bucket object (e.g. the scanner's `.usage-cache.bin`) iterate
-    /// this instead of the hash-routed store path, which would always land
-    /// on one set (rustfs/backlog#1872).
-    pub fn all_set_disks(&self) -> Vec<Arc<crate::set_disk::SetDisks>> {
-        self.pools.iter().flat_map(|pool| pool.disk_set.iter().cloned()).collect()
-    }
-
     /// Get server configuration (delegates to global)
     pub fn get_server_config(&self) -> Option<Config> {
         runtime_sources::server_config()

crates/heal/Cargo.toml

@@ -89,8 +89,6 @@ async-trait = { workspace = true }
 futures = { workspace = true }
 metrics = { workspace = true }
 base64 = { workspace = true }
-bytes = { workspace = true }
-crc-fast = { workspace = true }
 
 [dev-dependencies]
 serde_json = { workspace = true, features = ["raw_value"] }

crates/heal/src/heal/channel.rs

@@ -66,37 +66,21 @@ struct HealTaskStatusPayload<'a> {
     summary: &'a str,
     items: &'a [HealResultItem],
     truncated: bool,
-    /// Cursor for incremental consumption (HS-06): sequence of the next item
-    /// to be produced. Absent on responses without sequencing (0).
-    #[serde(skip_serializing_if = "u64_is_zero")]
-    next_seq: u64,
-    /// Oldest sequence still retained; with `truncated`, tells a lagging
-    /// client where to restart its cursor.
-    #[serde(skip_serializing_if = "u64_is_zero")]
-    min_seq: u64,
     #[serde(skip_serializing_if = "Option::is_none")]
     progress: Option<&'a HealProgress>,
 }
 
-fn u64_is_zero(value: &u64) -> bool {
-    *value == 0
-}
-
 fn encode_heal_task_status_payload(
     summary: &str,
     mut items: Vec<HealResultItem>,
     progress: Option<&HealProgress>,
     mut truncated: bool,
-    next_seq: u64,
-    min_seq: u64,
 ) -> Result<(Vec<u8>, bool)> {
     loop {
         let data = serde_json::to_vec(&HealTaskStatusPayload {
             summary,
             items: &items,
             truncated,
-            next_seq,
-            min_seq,
             progress,
         })
         .map_err(|e| Error::Serialization(format!("failed to serialize heal task status: {e}")))?;
@@ -125,10 +109,8 @@ fn encode_heal_status_response(
     progress: Option<&HealProgress>,
     detail: Option<String>,
     truncated: bool,
-    next_seq: u64,
-    min_seq: u64,
 ) -> Result<(Vec<u8>, Option<String>)> {
-    let (data, truncated) = encode_heal_task_status_payload(summary, items, progress, truncated, next_seq, min_seq)?;
+    let (data, truncated) = encode_heal_task_status_payload(summary, items, progress, truncated)?;
     Ok((data, heal_status_detail(detail, truncated)))
 }
 
@@ -156,19 +138,8 @@ impl HealChannelProcessor {
 
     /// Execute a token query directly against the manager.
     pub async fn execute_query_request(&self, heal_path: String, client_token: String) -> Result<HealChannelResponse> {
-        self.execute_query_request_since(heal_path, client_token, None).await
-    }
-
-    /// Incremental variant of [`Self::execute_query_request`] (HS-06).
-    pub async fn execute_query_request_since(
-        &self,
-        heal_path: String,
-        client_token: String,
-        since_seq: Option<u64>,
-    ) -> Result<HealChannelResponse> {
         let (response_tx, response_rx) = oneshot::channel();
-        self.process_query_request(heal_path, client_token, since_seq, response_tx)
-            .await?;
+        self.process_query_request(heal_path, client_token, response_tx).await?;
         response_rx
             .await
             .map_err(|err| Error::other(format!("heal query channel closed: {err}")))?
@@ -291,12 +262,8 @@ impl HealChannelProcessor {
             HealChannelCommand::Query {
                 heal_path,
                 client_token,
-                since_seq,
                 response_tx,
-            } => {
-                self.process_query_request(heal_path, client_token, since_seq, response_tx)
-                    .await
-            }
+            } => self.process_query_request(heal_path, client_token, response_tx).await,
             HealChannelCommand::Cancel {
                 heal_path,
                 client_token,
@@ -417,7 +384,6 @@ impl HealChannelProcessor {
         &self,
         heal_path: String,
         client_token: String,
-        since_seq: Option<u64>,
         response_tx: oneshot::Sender<std::result::Result<HealChannelResponse, String>>,
     ) -> Result<()> {
         debug!(
@@ -432,118 +398,72 @@ impl HealChannelProcessor {
         );
 
         let report = if heal_path.trim_matches('/').is_empty() {
-            self.heal_manager.get_task_report_since(&client_token, since_seq).await
+            self.heal_manager.get_task_report(&client_token).await
         } else {
-            self.heal_manager
-                .get_task_report_for_path_since(&heal_path, &client_token, since_seq)
-                .await
+            self.heal_manager.get_task_report_for_path(&heal_path, &client_token).await
         };
 
-        let (summary, detail, items, truncated, progress, next_seq, min_seq) = match report {
+        let (summary, detail, items, truncated, progress) = match report {
             Ok(HealTaskReport {
                 status: HealTaskStatus::Pending | HealTaskStatus::Running,
                 result_items,
                 result_items_truncated,
                 progress,
-                next_seq,
-                min_seq,
-            }) => (
-                "running".to_string(),
-                None,
-                result_items,
-                result_items_truncated,
-                progress,
-                next_seq,
-                min_seq,
-            ),
+            }) => ("running".to_string(), None, result_items, result_items_truncated, progress),
             Ok(HealTaskReport {
                 status: HealTaskStatus::Retrying { error, retry_attempt },
                 result_items,
                 result_items_truncated,
                 progress,
-                next_seq,
-                min_seq,
             }) => (
                 "running".to_string(),
                 Some(format!("heal task retrying after recoverable failure, attempt {retry_attempt}: {error}")),
                 result_items,
                 result_items_truncated,
                 progress,
-                next_seq,
-                min_seq,
             ),
             Ok(HealTaskReport {
                 status: HealTaskStatus::Completed,
                 result_items,
                 result_items_truncated,
                 progress,
-                next_seq,
-                min_seq,
-            }) => (
-                "finished".to_string(),
-                None,
-                result_items,
-                result_items_truncated,
-                progress,
-                next_seq,
-                min_seq,
-            ),
+            }) => ("finished".to_string(), None, result_items, result_items_truncated, progress),
             Ok(HealTaskReport {
                 status: HealTaskStatus::Cancelled,
                 result_items,
                 result_items_truncated,
                 progress,
-                next_seq,
-                min_seq,
             }) => (
                 "stopped".to_string(),
                 Some("heal task cancelled".to_string()),
                 result_items,
                 result_items_truncated,
                 progress,
-                next_seq,
-                min_seq,
             ),
             Ok(HealTaskReport {
                 status: HealTaskStatus::Timeout,
                 result_items,
                 result_items_truncated,
                 progress,
-                next_seq,
-                min_seq,
             }) => (
                 "stopped".to_string(),
                 Some("heal task timed out".to_string()),
                 result_items,
                 result_items_truncated,
                 progress,
-                next_seq,
-                min_seq,
             ),
             Ok(HealTaskReport {
                 status: HealTaskStatus::Failed { error },
                 result_items,
                 result_items_truncated,
                 progress,
-                next_seq,
-                min_seq,
-            }) => (
-                "stopped".to_string(),
-                Some(error),
-                result_items,
-                result_items_truncated,
-                progress,
-                next_seq,
-                min_seq,
-            ),
+            }) => ("stopped".to_string(), Some(error), result_items, result_items_truncated, progress),
             Err(crate::Error::TaskNotFound { .. }) => (
                 "notFound".to_string(),
                 Some("heal task not found or expired".to_string()),
                 Vec::new(),
                 false,
                 None,
-                0,
-                0,
             ),
             Err(crate::Error::InvalidClientToken) => {
                 let response = HealChannelResponse {
@@ -570,8 +490,7 @@ impl HealChannelProcessor {
             }
         };
 
-        let (data, detail) =
-            encode_heal_status_response(&summary, items, progress.as_ref(), detail, truncated, next_seq, min_seq)?;
+        let (data, detail) = encode_heal_status_response(&summary, items, progress.as_ref(), detail, truncated)?;
 
         let response = HealChannelResponse {
             request_id: client_token,
@@ -693,8 +612,7 @@ impl HealChannelProcessor {
             HealRequestSource::Admin
             | HealRequestSource::AutoHeal
             | HealRequestSource::Internal
-            | HealRequestSource::ReadRepair
-            | HealRequestSource::Mrf => true,
+            | HealRequestSource::ReadRepair => true,
         });
 
         // Build HealOptions with all available fields
@@ -849,7 +767,6 @@ mod tests {
             _bucket: &str,
             _prefix: &str,
             _continuation_token: Option<&str>,
-            _include_lifecycle_object_info: bool,
         ) -> crate::Result<(Vec<crate::heal::storage::HealListItem>, Option<String>, bool)> {
             Ok((vec![], None, false))
         }
@@ -886,7 +803,7 @@ mod tests {
             ..Default::default()
         }];
 
-        let (data, detail) = encode_heal_status_response("running", items, None, None, false, 0, 0).unwrap();
+        let (data, detail) = encode_heal_status_response("running", items, None, None, false).unwrap();
 
         assert!(data.len() <= MAX_HEAL_STATUS_PAYLOAD_SIZE);
         let payload: serde_json::Value = serde_json::from_slice(&data).unwrap();
@@ -1656,7 +1573,7 @@ mod tests {
         let (tx, rx) = oneshot::channel();
 
         processor
-            .process_query_request("bucket".to_string(), "completed-token".to_string(), None, tx)
+            .process_query_request("bucket".to_string(), "completed-token".to_string(), tx)
             .await
             .expect("query should process");
 
@@ -1691,7 +1608,7 @@ mod tests {
         let (tx, rx) = oneshot::channel();
 
         processor
-            .process_query_request("bucket".to_string(), task_id.clone(), None, tx)
+            .process_query_request("bucket".to_string(), task_id.clone(), tx)
             .await
             .expect("query should process");
 
@@ -1724,7 +1641,7 @@ mod tests {
         let (tx, rx) = oneshot::channel();
 
         processor
-            .process_query_request("bucket".to_string(), "wrong-token".to_string(), None, tx)
+            .process_query_request("bucket".to_string(), "wrong-token".to_string(), tx)
             .await
             .expect("query should process");
 
@@ -1749,7 +1666,7 @@ mod tests {
         let (tx, rx) = oneshot::channel();
 
         processor
-            .process_query_request(String::new(), "wrong-token".to_string(), None, tx)
+            .process_query_request(String::new(), "wrong-token".to_string(), tx)
             .await
             .expect("query should process");
 
@@ -1786,7 +1703,7 @@ mod tests {
         let (tx, rx) = oneshot::channel();
 
         processor
-            .process_query_request(String::new(), task_id.clone(), None, tx)
+            .process_query_request(String::new(), task_id.clone(), tx)
             .await
             .expect("query should process");
 

crates/heal/src/heal/erasure_healer.rs

@@ -23,14 +23,13 @@ use crate::heal::{
 };
 use crate::{Error, Result};
 use futures::{StreamExt, stream::FuturesUnordered};
-use metrics::{counter, gauge};
+use metrics::gauge;
 use rustfs_common::heal_channel::{HealOpts, HealRequestSource, HealScanMode};
 use rustfs_madmin::heal_commands::HealResultItem;
 use std::sync::{
     Arc,
     atomic::{AtomicUsize, Ordering},
 };
-use std::time::{Duration, UNIX_EPOCH};
 use tokio::sync::{RwLock, Semaphore};
 use tracing::{debug, error, warn};
 
@@ -48,21 +47,6 @@ enum HealObjectOutcome {
     Failed,
 }
 
-fn result_object_size_u64(result: &HealResultItem) -> u64 {
-    u64::try_from(result.object_size).unwrap_or(u64::MAX)
-}
-
-const NEW_VERSION_SKIP_GRACE_SECS: u64 = 60;
-const NANOS_PER_SECOND: i128 = 1_000_000_000;
-
-fn should_skip_new_version(mod_time_unix_nanos: Option<i128>, started_at_secs: u64) -> bool {
-    let Some(mod_time_unix_nanos) = mod_time_unix_nanos else {
-        return false;
-    };
-    let cutoff_secs = started_at_secs.saturating_add(NEW_VERSION_SKIP_GRACE_SECS);
-    mod_time_unix_nanos > i128::from(cutoff_secs).saturating_mul(NANOS_PER_SECOND)
-}
-
 struct PageConcurrencyGuard {
     in_flight: Arc<AtomicUsize>,
     set_label: String,
@@ -508,7 +492,6 @@ impl ErasureSetHealer {
                     &mut skipped_objects,
                     resume_manager,
                     checkpoint_manager,
-                    state.start_time,
                 )
                 .await;
 
@@ -675,7 +658,6 @@ impl ErasureSetHealer {
         skipped_objects: &mut u64,
         resume_manager: &ResumeManager,
         checkpoint_manager: &CheckpointManager,
-        started_at_secs: u64,
     ) -> Result<()> {
         debug!(
             target: "rustfs::heal::erasure_healer",
@@ -728,7 +710,6 @@ impl ErasureSetHealer {
         // The end-of-pass summary reports the full failed/skipped counts.
         let mut transient_skip_samples_logged = 0_u64;
         let mut failure_samples_logged = 0_u64;
-        let mut bytes_processed = self.progress.read().await.bytes_processed;
 
         // backlog#920: select the per-erasure-set DISK-WALK union enumerator when
         // the scan is Deep OR the request came from AutoHeal — these are the paths
@@ -737,25 +718,17 @@ impl ErasureSetHealer {
         // which stays the default.
         let use_disk_walk =
             matches!(self.heal_opts.scan_mode, HealScanMode::Deep) || matches!(self.source, HealRequestSource::AutoHeal);
-        let lifecycle_expiry_context = self.storage.load_heal_lifecycle_expiry_context(bucket).await?;
-        let include_lifecycle_object_info = lifecycle_expiry_context.is_some();
 
         loop {
             self.verify_replacement_identity_fence("page scan").await?;
             // Get one page of object versions
             let (objects, next_token, is_truncated) = if use_disk_walk {
                 self.storage
-                    .list_versions_for_heal_page_disk_walk(
-                        set_disk_id,
-                        bucket,
-                        "",
-                        continuation_token.as_deref(),
-                        include_lifecycle_object_info,
-                    )
+                    .list_versions_for_heal_page_disk_walk(set_disk_id, bucket, "", continuation_token.as_deref())
                     .await?
             } else {
                 self.storage
-                    .list_objects_for_heal_page(bucket, "", continuation_token.as_deref(), include_lifecycle_object_info)
+                    .list_objects_for_heal_page(bucket, "", continuation_token.as_deref())
                     .await?
             };
             let page_is_empty = objects.is_empty();
@@ -763,7 +736,6 @@ impl ErasureSetHealer {
             let page_resume_index = *current_object_index;
             let semaphore = Arc::new(Semaphore::new(page_concurrency_limit));
             let mut page_tasks = FuturesUnordered::new();
-            let mut completed_in_page = 0usize;
 
             // Capture the last version identity of this page for the anti-loop guard.
             let page_last = objects.last().map(|item| (item.name.clone(), item.version_id.clone()));
@@ -779,75 +751,6 @@ impl ErasureSetHealer {
                     continue;
                 }
 
-                if should_skip_new_version(item.mod_time_unix_nanos, started_at_secs) {
-                    checkpoint_manager.add_processed_object(key).await?;
-                    *processed_objects = processed_objects.saturating_add(1);
-                    completed_in_page = completed_in_page.saturating_add(1);
-                    counter!("rustfs_heal_skipped_new_versions_total").increment(1);
-                    {
-                        let mut progress = self.progress.write().await;
-                        progress.record_skipped_new_version();
-                        progress.set_current_object(Some(format!("skipped_new: {bucket}/{}", item.name)));
-                        progress.update_progress(*processed_objects, *successful_objects, *failed_objects, bytes_processed);
-                    }
-                    debug!(
-                        target: "rustfs::heal::erasure_healer",
-                        event = EVENT_HEAL_ERASURE_OBJECT_STATE,
-                        component = LOG_COMPONENT_HEAL,
-                        subsystem = LOG_SUBSYSTEM_ERASURE_HEALER,
-                        set_disk_id,
-                        bucket,
-                        object = %item.name,
-                        version_id = ?item.version_id,
-                        state = "skipped_new_version",
-                        "Erasure set object version skipped because it was written after heal started"
-                    );
-                    if completed_in_page.is_multiple_of(100) {
-                        checkpoint_manager.update_position(bucket_index, page_resume_index).await?;
-                    }
-                    continue;
-                }
-
-                if let Some(context) = lifecycle_expiry_context.as_ref()
-                    && self
-                        .storage
-                        .enqueue_heal_lifecycle_expiry(
-                            context,
-                            bucket,
-                            &item.name,
-                            item.version_id.as_deref(),
-                            item.lifecycle_object_info.as_ref(),
-                        )
-                        .await?
-                {
-                    checkpoint_manager.add_processed_object(key).await?;
-                    *processed_objects = processed_objects.saturating_add(1);
-                    completed_in_page = completed_in_page.saturating_add(1);
-                    counter!("rustfs_heal_skipped_ilm_expired_total").increment(1);
-                    {
-                        let mut progress = self.progress.write().await;
-                        progress.record_skipped_ilm_expired();
-                        progress.set_current_object(Some(format!("skipped_ilm: {bucket}/{}", item.name)));
-                        progress.update_progress(*processed_objects, *successful_objects, *failed_objects, bytes_processed);
-                    }
-                    debug!(
-                        target: "rustfs::heal::erasure_healer",
-                        event = EVENT_HEAL_ERASURE_OBJECT_STATE,
-                        component = LOG_COMPONENT_HEAL,
-                        subsystem = LOG_SUBSYSTEM_ERASURE_HEALER,
-                        set_disk_id,
-                        bucket,
-                        object = %item.name,
-                        version_id = ?item.version_id,
-                        state = "skipped_ilm_expired",
-                        "Erasure set object version skipped because lifecycle expiry was queued"
-                    );
-                    if completed_in_page.is_multiple_of(100) {
-                        checkpoint_manager.update_position(bucket_index, page_resume_index).await?;
-                    }
-                    continue;
-                }
-
                 resume_manager
                     .set_current_item(Some(bucket.to_string()), Some(item.name.clone()))
                     .await?;
@@ -874,7 +777,7 @@ impl ErasureSetHealer {
 
                     let _permit = match permit {
                         Ok(permit) => permit,
-                        Err(err) => return (dedup_key, object_name, version_id, (0, Err(err))),
+                        Err(err) => return (dedup_key, object_name, version_id, Err(err)),
                     };
 
                     let _in_flight_guard = PageConcurrencyGuard::new(in_flight, set_label);
@@ -885,7 +788,7 @@ impl ErasureSetHealer {
                     // recorded as skipped-ok rather than failed. The delete-marker
                     // vs data path is chosen internally in ops/heal.rs.
                     let result = if cancel_token.is_cancelled() {
-                        (0, Err(Error::TaskCancelled))
+                        Err(Error::TaskCancelled)
                     } else {
                         match storage
                             .heal_object(&bucket_name, &object_name, version_id.as_deref(), &heal_opts)
@@ -894,9 +797,8 @@ impl ErasureSetHealer {
                             Ok((result, None))
                                 if target_outcomes_complete(&result, &target_endpoints) =>
                             {
-                                let object_size = result_object_size_u64(&result);
                                 if !replacement_commit_evidence_required {
-                                    (object_size, Ok(true))
+                                    Ok(true)
                                 } else {
                                     match storage
                                         .replacement_targets_have_version(
@@ -908,42 +810,27 @@ impl ErasureSetHealer {
                                         )
                                         .await
                                     {
-                                        Ok(true) => (object_size, Ok(true)),
-                                        Ok(false) => (object_size, Err(Error::transient_skip(format!(
+                                        Ok(true) => Ok(true),
+                                        Ok(false) => Err(Error::transient_skip(format!(
                                             "Skipped heal for {bucket_name}/{object_name} because replacement target readback did not confirm the committed version"
-                                        )))),
-                                        Err(err) => (object_size, Err(Error::transient_skip(format!(
+                                        ))),
+                                        Err(err) => Err(Error::transient_skip(format!(
                                             "Skipped heal for {bucket_name}/{object_name} because replacement target readback failed: {err}"
-                                        )))),
+                                        ))),
                                     }
                                 }
-                            },
-                            Ok((result, None)) if !target_endpoints.is_empty() => (
-                                result_object_size_u64(&result),
-                                Err(Error::transient_skip(format!(
-                                    "Skipped heal for {bucket_name}/{object_name} because a replacement target was not committed"
-                                ))),
-                            ),
-                            Ok((result, None)) => (result_object_size_u64(&result), Ok(true)),
-                            Ok((result, Some(err))) if is_missing_object_dir_heal_result(&object_name, &err) => {
-                                (result_object_size_u64(&result), Ok(false))
                             }
-                            Ok((result, Some(err))) => {
-                                let object_size = result_object_size_u64(&result);
-                                match Self::classify_heal_object_error(&err) {
-                                    HealObjectOutcome::Absent => (object_size, Ok(false)),
-                                    HealObjectOutcome::Transient => (object_size, Err(Error::transient_skip(format!(
-                                        "Skipped heal for {bucket_name}/{object_name} due to transient error: {err}"
-                                    )))),
-                                    HealObjectOutcome::Failed => (object_size, Err(err)),
-                                }
-                            }
-                            Err(err) => match Self::classify_heal_object_error(&err) {
-                                HealObjectOutcome::Absent => (0, Ok(false)),
-                                HealObjectOutcome::Transient => (0, Err(Error::transient_skip(format!(
+                            Ok((_result, None)) if !target_endpoints.is_empty() => Err(Error::transient_skip(format!(
+                                "Skipped heal for {bucket_name}/{object_name} because a replacement target was not committed"
+                            ))),
+                            Ok((_result, None)) => Ok(true),
+                            Ok((_, Some(err))) if is_missing_object_dir_heal_result(&object_name, &err) => Ok(false),
+                            Ok((_, Some(err))) | Err(err) => match Self::classify_heal_object_error(&err) {
+                                HealObjectOutcome::Absent => Ok(false),
+                                HealObjectOutcome::Transient => Err(Error::transient_skip(format!(
                                     "Skipped heal for {bucket_name}/{object_name} due to transient error: {err}"
-                                )))),
-                                HealObjectOutcome::Failed => (0, Err(err)),
+                                ))),
+                                HealObjectOutcome::Failed => Err(err),
                             },
                         }
                     };
@@ -952,12 +839,11 @@ impl ErasureSetHealer {
                 });
             }
 
+            let mut completed_in_page = 0usize;
             while let Some((key, object, version_id, result)) = page_tasks.next().await {
-                let (object_size, result) = result;
                 match result {
                     Ok(true) => {
                         *successful_objects += 1;
-                        bytes_processed = bytes_processed.saturating_add(object_size);
                         checkpoint_manager.add_processed_object(key).await?;
                         debug!(
                             target: "rustfs::heal::erasure_healer",
@@ -975,7 +861,6 @@ impl ErasureSetHealer {
                     Ok(false) => {
                         checkpoint_manager.add_processed_object(key).await?;
                         *successful_objects += 1;
-                        bytes_processed = bytes_processed.saturating_add(object_size);
                         debug!(
                             target: "rustfs::heal::erasure_healer",
                             event = EVENT_HEAL_ERASURE_OBJECT_STATE,
@@ -992,7 +877,6 @@ impl ErasureSetHealer {
                     Err(err @ Error::TaskCancelled) | Err(err @ Error::TaskTimeout) => return Err(err),
                     Err(Error::TransientSkip { message }) => {
                         *skipped_objects += 1;
-                        bytes_processed = bytes_processed.saturating_add(object_size);
                         checkpoint_manager.add_skipped_object(key).await?;
                         demote_to_debug_when!(!take_failure_log_sample(&mut transient_skip_samples_logged), warn, target: "rustfs::heal::erasure_healer", {
                             event = EVENT_HEAL_ERASURE_OBJECT_STATE,
@@ -1009,7 +893,6 @@ impl ErasureSetHealer {
                     }
                     Err(err) => {
                         *failed_objects += 1;
-                        bytes_processed = bytes_processed.saturating_add(object_size);
                         checkpoint_manager.add_failed_object(key).await?;
                         demote_to_debug_when!(!take_failure_log_sample(&mut failure_samples_logged), warn, target: "rustfs::heal::erasure_healer", {
                             event = EVENT_HEAL_ERASURE_OBJECT_STATE,
@@ -1028,11 +911,6 @@ impl ErasureSetHealer {
 
                 *processed_objects += 1;
                 completed_in_page += 1;
-                {
-                    let mut progress = self.progress.write().await;
-                    progress.set_current_object(Some(format!("{bucket}/{object}")));
-                    progress.update_progress(*processed_objects, *successful_objects, *failed_objects, bytes_processed);
-                }
 
                 if completed_in_page.is_multiple_of(100) {
                     checkpoint_manager.update_position(bucket_index, page_resume_index).await?;
@@ -1086,9 +964,7 @@ impl ErasureSetHealer {
         progress.objects_scanned = state.total_objects;
         progress.objects_healed = state.successful_objects;
         progress.objects_failed = state.failed_objects;
-        progress.bytes_processed = 0; // Resume state tracks object counts, not byte counters.
-        progress.start_time = UNIX_EPOCH.checked_add(Duration::from_secs(state.start_time));
-        progress.last_update_time = UNIX_EPOCH.checked_add(Duration::from_secs(state.last_update));
+        progress.bytes_processed = 0; // set to 0 for now, can be extended later
         progress.set_current_object(state.current_object.clone());
     }
 }
@@ -1259,15 +1135,13 @@ mod resume_loop_tests {
     //! that emits programmable multi-version pages. These exercise the real loop
     //! logic (cursor seeding, per-version dedup, anti-loop guard, absence
     //! handling) — not merely a mock's own output.
-    use super::{
-        ErasureSetHealer, NANOS_PER_SECOND, NEW_VERSION_SKIP_GRACE_SECS, should_skip_new_version, target_outcomes_complete,
-    };
+    use super::{ErasureSetHealer, target_outcomes_complete};
     use crate::heal::progress::HealProgress;
     use crate::heal::resume::{
         CheckpointManager, RESUME_CHECKPOINT_FILE, ReplacementTargetIdentity, ResumeDeleteFailure, ResumeManager, ResumeUtils,
         compose_key,
     };
-    use crate::heal::storage::{DiskStatus, HealLifecycleExpiryContext, HealListItem, HealObjectInfo, HealStorageAPI};
+    use crate::heal::storage::{DiskStatus, HealListItem, HealObjectInfo, HealStorageAPI};
     use crate::heal::storage_api::status::BucketInfo;
     use crate::heal::{
         BUCKET_META_PREFIX, DiskOption, DiskStore, EcstoreError, Endpoint, HealDiskExt as _, RUSTFS_META_BUCKET, new_disk,
@@ -1275,7 +1149,7 @@ mod resume_loop_tests {
     use crate::{Error, Result};
     use rustfs_common::heal_channel::{HealOpts, HealRequestSource};
     use rustfs_madmin::heal_commands::{HealDriveInfo, HealResultItem, Infos};
-    use std::collections::{HashMap, HashSet, VecDeque};
+    use std::collections::{HashMap, VecDeque};
     use std::sync::atomic::{AtomicBool, Ordering};
     use std::sync::{Arc, Mutex};
     use tempfile::TempDir;
@@ -1286,37 +1160,10 @@ mod resume_loop_tests {
         HealListItem {
             name: name.to_string(),
             version_id: version.map(str::to_string),
-            mod_time_unix_nanos: None,
-            lifecycle_object_info: None,
             is_delete_marker: delete_marker,
         }
     }
 
-    fn item_with_mod_time(name: &str, version: Option<&str>, mod_time_secs: u64) -> HealListItem {
-        HealListItem {
-            name: name.to_string(),
-            version_id: version.map(str::to_string),
-            mod_time_unix_nanos: Some(i128::from(mod_time_secs).saturating_mul(NANOS_PER_SECOND)),
-            lifecycle_object_info: None,
-            is_delete_marker: false,
-        }
-    }
-
-    #[test]
-    fn new_version_filter_respects_grace_boundary() {
-        let started_at = 1_700_000_000;
-
-        assert!(!should_skip_new_version(None, started_at));
-        assert!(!should_skip_new_version(
-            Some(i128::from(started_at + NEW_VERSION_SKIP_GRACE_SECS).saturating_mul(NANOS_PER_SECOND)),
-            started_at,
-        ));
-        assert!(should_skip_new_version(
-            Some(i128::from(started_at + NEW_VERSION_SKIP_GRACE_SECS + 1).saturating_mul(NANOS_PER_SECOND)),
-            started_at,
-        ));
-    }
-
     #[test]
     fn target_outcomes_require_each_requested_endpoint_once_and_ok() {
         let result = HealResultItem {
@@ -1399,10 +1246,8 @@ mod resume_loop_tests {
         /// Target-specific physical readback evidence per `compose_key`; the
         /// fake models a healthy backend unless a test explicitly revokes it.
         replacement_commit_evidence: Mutex<HashMap<String, ReplacementCommitEvidence>>,
-        lifecycle_expired: Mutex<HashSet<String>>,
         /// every heal_object call recorded as (name, version_id)
         heal_calls: Mutex<Vec<(String, Option<String>)>>,
-        list_include_lifecycle_object_info: Mutex<Vec<bool>>,
         replacement_target_identity_sequences: Mutex<VecDeque<Vec<ReplacementTargetIdentity>>>,
         fail_listing: AtomicBool,
     }
@@ -1429,15 +1274,9 @@ mod resume_loop_tests {
                 .unwrap()
                 .insert(compose_key(name, version), ReplacementCommitEvidence::Error(message.to_string()));
         }
-        fn set_lifecycle_expired(&self, name: &str, version: Option<&str>) {
-            self.lifecycle_expired.lock().unwrap().insert(compose_key(name, version));
-        }
         fn calls(&self) -> Vec<(String, Option<String>)> {
             self.heal_calls.lock().unwrap().clone()
         }
-        fn list_include_lifecycle_object_info_calls(&self) -> Vec<bool> {
-            self.list_include_lifecycle_object_info.lock().unwrap().clone()
-        }
         fn fail_listing(&self) {
             self.fail_listing.store(true, Ordering::SeqCst);
         }
@@ -1491,23 +1330,6 @@ mod resume_loop_tests {
         async fn get_object_checksum(&self, _b: &str, _o: &str) -> Result<Option<String>> {
             Ok(None)
         }
-        async fn load_heal_lifecycle_expiry_context(&self, _bucket: &str) -> Result<Option<HealLifecycleExpiryContext>> {
-            Ok((!self.lifecycle_expired.lock().unwrap().is_empty()).then(HealLifecycleExpiryContext::test))
-        }
-        async fn enqueue_heal_lifecycle_expiry(
-            &self,
-            _context: &HealLifecycleExpiryContext,
-            _bucket: &str,
-            object: &str,
-            version_id: Option<&str>,
-            _object_info: Option<&HealObjectInfo>,
-        ) -> Result<bool> {
-            Ok(self
-                .lifecycle_expired
-                .lock()
-                .unwrap()
-                .contains(&compose_key(object, version_id)))
-        }
         async fn heal_object(
             &self,
             _bucket: &str,
@@ -1564,12 +1386,7 @@ mod resume_loop_tests {
             _bucket: &str,
             _prefix: &str,
             continuation_token: Option<&str>,
-            include_lifecycle_object_info: bool,
         ) -> Result<(Vec<HealListItem>, Option<String>, bool)> {
-            self.list_include_lifecycle_object_info
-                .lock()
-                .unwrap()
-                .push(include_lifecycle_object_info);
             if self.fail_listing.load(Ordering::SeqCst) {
                 return Err(Error::other("injected listing failure"));
             }
@@ -1659,7 +1476,6 @@ mod resume_loop_tests {
 
     /// Drive one bucket heal pass; returns (processed, successful, failed, skipped, result).
     async fn run(env: &Env) -> (u64, u64, u64, u64, Result<()>) {
-        let state = env.resume.get_state().await;
         let mut current_object_index = 0usize;
         let mut processed = 0u64;
         let mut successful = 0u64;
@@ -1678,7 +1494,6 @@ mod resume_loop_tests {
                 &mut skipped,
                 &env.resume,
                 &env.checkpoint,
-                state.start_time,
             )
             .await;
         (processed, successful, failed, skipped, result)
@@ -1744,7 +1559,6 @@ mod resume_loop_tests {
         let mut successful = 0;
         let mut failed = 0;
         let mut skipped = 0;
-        let started_at = env.resume.get_state().await.start_time;
 
         let error = healer
             .heal_bucket_with_resume(
@@ -1758,7 +1572,6 @@ mod resume_loop_tests {
                 &mut skipped,
                 &env.resume,
                 &env.checkpoint,
-                started_at,
             )
             .await
             .expect_err("a remounted target must not begin a new page scan");
@@ -1828,109 +1641,6 @@ mod resume_loop_tests {
         assert_eq!(skipped, 0);
     }
 
-    #[tokio::test]
-    async fn erasure_set_progress_accumulates_healed_object_bytes() {
-        let env = make_env().await;
-        env.storage.set_page(
-            None,
-            Page {
-                items: vec![item("first", Some("v1"), false), item("second", Some("v2"), false)],
-                next: None,
-                truncated: false,
-            },
-        );
-        env.storage.set_result(
-            "first",
-            Some("v1"),
-            HealResultItem {
-                object_size: 1024,
-                ..Default::default()
-            },
-        );
-        env.storage.set_result(
-            "second",
-            Some("v2"),
-            HealResultItem {
-                object_size: 2048,
-                ..Default::default()
-            },
-        );
-
-        let (processed, successful, failed, skipped, result) = run(&env).await;
-
-        result.expect("page heal should succeed");
-        assert_eq!(processed, 2);
-        assert_eq!(successful, 2);
-        assert_eq!(failed, 0);
-        assert_eq!(skipped, 0);
-        let progress = env.healer.progress.read().await;
-        assert_eq!(progress.objects_scanned, 2);
-        assert_eq!(progress.objects_healed, 2);
-        assert_eq!(progress.objects_failed, 0);
-        assert_eq!(progress.bytes_processed, 3072);
-        assert!(matches!(progress.current_object.as_deref(), Some("b/first" | "b/second")));
-    }
-
-    #[tokio::test]
-    async fn erasure_set_skips_versions_written_after_heal_started() {
-        let env = make_env().await;
-        let started_at = env.resume.get_state().await.start_time;
-        env.storage.set_page(
-            None,
-            Page {
-                items: vec![
-                    item_with_mod_time("old", Some("v1"), started_at + NEW_VERSION_SKIP_GRACE_SECS),
-                    item_with_mod_time("new", Some("v2"), started_at + NEW_VERSION_SKIP_GRACE_SECS + 1),
-                ],
-                next: None,
-                truncated: false,
-            },
-        );
-
-        let (processed, successful, failed, skipped, result) = run(&env).await;
-
-        result.expect("page heal should succeed");
-        assert_eq!(processed, 2);
-        assert_eq!(successful, 1);
-        assert_eq!(failed, 0);
-        assert_eq!(skipped, 0);
-        assert_eq!(env.storage.calls(), vec![("old".to_string(), Some("v1".to_string()))]);
-        let progress = env.healer.progress.read().await;
-        assert_eq!(progress.skipped_new_versions, 1);
-        assert_eq!(progress.objects_scanned, 2);
-        assert_eq!(progress.objects_healed, 1);
-        assert_eq!(progress.objects_failed, 0);
-    }
-
-    #[tokio::test]
-    async fn erasure_set_skips_versions_queued_for_lifecycle_expiry() {
-        let env = make_env().await;
-        env.storage.set_page(
-            None,
-            Page {
-                items: vec![item("expired", Some("v1"), false), item("kept", Some("v2"), false)],
-                next: None,
-                truncated: false,
-            },
-        );
-        env.storage.set_lifecycle_expired("expired", Some("v1"));
-
-        let (processed, successful, failed, skipped, result) = run(&env).await;
-
-        result.expect("page heal should succeed");
-        assert_eq!(processed, 2);
-        assert_eq!(successful, 1);
-        assert_eq!(failed, 0);
-        assert_eq!(skipped, 0);
-        assert_eq!(env.storage.calls(), vec![("kept".to_string(), Some("v2".to_string()))]);
-        assert_eq!(env.storage.list_include_lifecycle_object_info_calls(), vec![true]);
-        let progress = env.healer.progress.read().await;
-        assert_eq!(progress.skipped_ilm_expired, 1);
-        assert_eq!(progress.objects_scanned, 2);
-        assert_eq!(progress.objects_healed, 1);
-        assert_eq!(progress.objects_failed, 0);
-    }
-
     #[tokio::test]
     async fn bucket_listing_failure_does_not_mark_set_completed() {
         let env = make_env().await;

crates/heal/src/heal/manager.rs

@@ -220,11 +220,6 @@ struct CompletedHealStatus {
     result_items: Vec<HealResultItem>,
     result_items_truncated: bool,
     completed_at: SystemTime,
-    /// Sequence-stamped retained window, archived with the completion so
-    /// incremental consumers keep their cursor across the transition (HS-06).
-    seqed_items: Vec<(u64, HealResultItem)>,
-    next_seq: u64,
-    min_seq: u64,
 }
 
 #[derive(Debug, Clone)]
@@ -245,65 +240,6 @@ pub struct HealTaskReport {
     pub result_items: Vec<HealResultItem>,
     pub result_items_truncated: bool,
     pub progress: Option<HealProgress>,
-    /// Cursor for incremental consumption: sequence number of the next item
-    /// to be produced. `0` on reports from sources without sequencing.
-    pub next_seq: u64,
-    /// Oldest sequence still retained (`0` together with `next_seq` when
-    /// sequencing is unavailable).
-    pub min_seq: u64,
-}
-
-/// Report from a live task, honoring the client's incremental cursor.
-async fn active_task_report(task: &HealTask, since: Option<u64>) -> HealTaskReport {
-    let window = task.get_result_items_since(since).await;
-    HealTaskReport {
-        status: task.get_status().await,
-        result_items: window.items,
-        // The legacy flag stays set once anything was evicted; a lagging
-        // incremental cursor additionally marks this response truncated so
-        // the client knows to restart from `min_seq`.
-        result_items_truncated: task.result_items_truncated() || window.lagged,
-        progress: Some(task.get_progress().await),
-        next_seq: window.next_seq,
-        min_seq: window.min_seq,
-    }
-}
-
-fn empty_task_report(status: HealTaskStatus) -> HealTaskReport {
-    HealTaskReport {
-        status,
-        result_items: Vec::new(),
-        result_items_truncated: false,
-        progress: None,
-        next_seq: 0,
-        min_seq: 0,
-    }
-}
-
-fn completed_task_report(completed: &CompletedHealStatus, since: Option<u64>) -> HealTaskReport {
-    let mut lagged = false;
-    let result_items = match since {
-        None => completed.result_items.clone(),
-        Some(cursor) => {
-            if cursor + 1 < completed.min_seq {
-                lagged = true;
-            }
-            completed
-                .seqed_items
-                .iter()
-                .filter(|(seq, _)| *seq > cursor)
-                .map(|(_, item)| item.clone())
-                .collect()
-        }
-    };
-    HealTaskReport {
-        status: completed.status.clone(),
-        result_items,
-        result_items_truncated: completed.result_items_truncated || lagged,
-        progress: None,
-        next_seq: completed.next_seq,
-        min_seq: completed.min_seq,
-    }
 }
 
 #[derive(Debug, Clone, Copy, Default, PartialEq, Eq, serde::Deserialize, serde::Serialize)]
@@ -334,8 +270,6 @@ pub struct HealSourceCounts {
     pub auto_heal: u64,
     pub internal: u64,
     pub read_repair: u64,
-    #[serde(default)]
-    pub mrf: u64,
 }
 
 impl HealSourceCounts {
@@ -346,7 +280,6 @@ impl HealSourceCounts {
             HealRequestSource::AutoHeal => self.auto_heal += 1,
             HealRequestSource::Internal => self.internal += 1,
             HealRequestSource::ReadRepair => self.read_repair += 1,
-            HealRequestSource::Mrf => self.mrf += 1,
         }
     }
 }
@@ -595,11 +528,6 @@ impl PriorityHealQueue {
         self.dedup_keys.contains_key(&key)
     }
 
-    /// Iterate queued requests (used by the admin overlap check).
-    fn requests(&self) -> impl Iterator<Item = &HealRequest> {
-        self.heap.iter().map(|item| &item.request)
-    }
-
     fn contains_request_id(&self, request_id: &str) -> bool {
         self.heap.iter().any(|item| item.request.id == request_id)
     }
@@ -758,80 +686,6 @@ fn recoverable_heal_retry_delay(retry_attempt: u32) -> Duration {
 }
 
 /// Heal config
-/// HS-06 admin overlap policy.
-#[derive(Debug, Clone, Copy, PartialEq, Eq, Default)]
-pub enum HealOverlapPolicy {
-    /// Default: overlapping admin starts merge into the existing task
-    /// (today's dedup semantics).
-    #[default]
-    Merge,
-    /// Return a typed already-running / overlapping-paths rejection like
-    /// madmin's ErrHealAlreadyRunning / ErrHealOverlappingPaths.
-    MinioError,
-}
-
-/// Path view of a heal type for overlap comparison: a bucket plus a
-/// prefix/object path inside it (`None` bucket = cluster-wide, overlaps
-/// everything).
-fn heal_type_path_view(heal_type: &HealType) -> (Option<&str>, &str) {
-    match heal_type {
-        HealType::Cluster => (None, ""),
-        HealType::Bucket { bucket } => (Some(bucket), ""),
-        HealType::Prefix { bucket, prefix } => (Some(bucket), prefix),
-        HealType::Object { bucket, object, .. }
-        | HealType::Metadata { bucket, object }
-        | HealType::ECDecode { bucket, object, .. } => (Some(bucket), object),
-        // MRF/MetaPath heal keys on a meta path; treat the whole set of
-        // buckets as one namespace so it only overlaps itself exactly.
-        HealType::MRF { meta_path } => (Some("\u{0}mrf"), meta_path),
-        // Erasure-set heal: the set id is the overlap dimension.
-        HealType::ErasureSet { set_disk_id, .. } => (Some("\u{0}set"), set_disk_id),
-    }
-}
-
-/// How two heal paths relate for the admin overlap check (HS-06).
-#[derive(Debug, Clone, Copy, PartialEq, Eq)]
-enum OverlapVerdict {
-    /// Distinct targets: no conflict.
-    Disjoint,
-    /// Same target: an identical heal is already in flight.
-    SameTarget,
-    /// One target contains the other.
-    Overlapping,
-}
-
-fn prefix_paths_overlap(a: &str, b: &str) -> OverlapVerdict {
-    if a == b {
-        return OverlapVerdict::SameTarget;
-    }
-    if a.is_empty() || b.is_empty() || a.starts_with(b) || b.starts_with(a) {
-        return OverlapVerdict::Overlapping;
-    }
-    OverlapVerdict::Disjoint
-}
-
-fn heal_types_overlap(left: &HealType, right: &HealType) -> OverlapVerdict {
-    let (left_bucket, left_path) = heal_type_path_view(left);
-    let (right_bucket, right_path) = heal_type_path_view(right);
-    match (left_bucket, right_bucket) {
-        // Cluster-wide overlaps everything (but an exact cluster match is
-        // SameTarget).
-        (None, _) | (_, None) => {
-            if matches!(left, HealType::Cluster) && matches!(right, HealType::Cluster) {
-                OverlapVerdict::SameTarget
-            } else {
-                OverlapVerdict::Overlapping
-            }
-        }
-        (Some(lb), Some(rb)) => {
-            if lb != rb {
-                return OverlapVerdict::Disjoint;
-            }
-            prefix_paths_overlap(left_path, right_path)
-        }
-    }
-}
-
 #[derive(Debug, Clone)]
 pub struct HealConfig {
     /// Whether to enable auto heal
@@ -852,9 +706,6 @@ pub struct HealConfig {
     pub low_priority_drop_when_full: bool,
     /// Whether notify-driven scheduler wakeups are enabled.
     pub event_driven_scheduler_enable: bool,
-    /// How admin heal starts behave on path overlap (HS-06): merge into the
-    /// existing task (default) or return a typed already-running rejection.
-    pub overlap_policy: HealOverlapPolicy,
     /// Whether per-set bulkhead scheduling is enabled.
     pub set_bulkhead_enable: bool,
     /// Whether erasure-set page parallelism is enabled.
@@ -903,14 +754,6 @@ impl Default for HealConfig {
             rustfs_config::ENV_HEAL_EVENT_DRIVEN_SCHEDULER_ENABLE,
             rustfs_config::DEFAULT_HEAL_EVENT_DRIVEN_SCHEDULER_ENABLE,
         );
-        let overlap_policy =
-            match rustfs_utils::get_env_str(rustfs_config::ENV_HEAL_OVERLAP_POLICY, rustfs_config::DEFAULT_HEAL_OVERLAP_POLICY)
-                .to_lowercase()
-                .as_str()
-            {
-                "minio_error" => HealOverlapPolicy::MinioError,
-                _ => HealOverlapPolicy::Merge,
-            };
         let set_bulkhead_enable = rustfs_utils::get_env_bool(
             rustfs_config::ENV_HEAL_SET_BULKHEAD_ENABLE,
             rustfs_config::DEFAULT_HEAL_SET_BULKHEAD_ENABLE,
@@ -947,7 +790,6 @@ impl Default for HealConfig {
             low_priority_merge_enable,
             low_priority_drop_when_full,
             event_driven_scheduler_enable,
-            overlap_policy,
             set_bulkhead_enable,
             page_parallel_enable,
             mainline_throttle_enable,
@@ -1914,50 +1756,6 @@ impl HealManager {
         request: HealRequest,
         preserve_alias: bool,
     ) -> Result<HealAdmissionReceipt> {
-        // HS-06 forceStart semantics (admin only): MinIO stops the old task
-        // first and then starts the new one. Cancel any active admin task
-        // overlapping this request's path before entering admission, so the
-        // fresh task is never merged into the one being replaced.
-        if request.source == HealRequestSource::Admin && request.force_start {
-            let overlapping: Vec<String> = {
-                let active_heals = self.active_heals.lock().await;
-                active_heals
-                    .iter()
-                    .filter(|(task_id, task)| {
-                        task.source == HealRequestSource::Admin
-                            && heal_types_overlap(&request.heal_type, &task.heal_type) != OverlapVerdict::Disjoint
-                            && *task_id != &request.id
-                    })
-                    .map(|(task_id, _)| task_id.clone())
-                    .collect()
-            };
-            for task_id in overlapping {
-                match self.cancel_task(&task_id).await {
-                    Ok(_) => info!(
-                        target: "rustfs::heal::manager",
-                        event = EVENT_HEAL_QUEUE_ADMISSION,
-                        component = LOG_COMPONENT_HEAL,
-                        subsystem = LOG_SUBSYSTEM_MANAGER,
-                        request_id = %request.id,
-                        cancelled_task_id = %task_id,
-                        result = "force_start_cancelled_overlap",
-                        "Admin forceStart cancelled an overlapping heal task"
-                    ),
-                    Err(err) => warn!(
-                        target: "rustfs::heal::manager",
-                        event = EVENT_HEAL_QUEUE_ADMISSION,
-                        component = LOG_COMPONENT_HEAL,
-                        subsystem = LOG_SUBSYSTEM_MANAGER,
-                        request_id = %request.id,
-                        cancelled_task_id = %task_id,
-                        error = %err,
-                        result = "force_start_cancel_failed",
-                        "Admin forceStart failed to cancel an overlapping heal task"
-                    ),
-                }
-            }
-        }
-
         let config = self.config.read().await;
         let dedup_key = PriorityHealQueue::make_dedup_key(&request);
 
@@ -1980,15 +1778,7 @@ impl HealManager {
                 .or_else(|| retrying_heal_for_dedup_key(&retrying_heals, &dedup_key).map(|(task_id, _)| (task_id, "retrying")))
         });
         if let Some((merged_task_id, duplicate_state)) = duplicate.flatten() {
-            // HS-06: under the minio_error overlap policy an exact duplicate
-            // admin start reports the typed AlreadyRunning rejection instead
-            // of the silent merge (MinIO's ErrHealAlreadyRunning).
-            let admission =
-                if request.source == HealRequestSource::Admin && config.overlap_policy == HealOverlapPolicy::MinioError {
-                    HealAdmissionResult::Dropped(HealAdmissionDropReason::AlreadyRunning)
-                } else {
-                    Self::duplicate_admission_for_request(&request, &config)
-                };
+            let admission = Self::duplicate_admission_for_request(&request, &config);
             drop(retrying_heals);
             drop(queue);
             drop(active_heals);
@@ -2034,62 +1824,6 @@ impl HealManager {
             });
         }
 
-        // HS-06 typed overlap rejection (admin only, minio_error policy):
-        // paths containing or contained by an active/queued task reject with
-        // AlreadyRunning / OverlappingPaths instead of merging. Exact
-        // duplicates already merged above; scanner/autoheal/read-repair
-        // sources never take this path.
-        if request.source == HealRequestSource::Admin && config.overlap_policy == HealOverlapPolicy::MinioError {
-            let mut rejection = None;
-            for (task_id, task) in active_heals.iter() {
-                match heal_types_overlap(&request.heal_type, &task.heal_type) {
-                    OverlapVerdict::SameTarget => {
-                        rejection = Some((HealAdmissionDropReason::AlreadyRunning, task_id.clone()));
-                        break;
-                    }
-                    OverlapVerdict::Overlapping => {
-                        rejection = Some((HealAdmissionDropReason::OverlappingPaths, task_id.clone()));
-                    }
-                    OverlapVerdict::Disjoint => {}
-                }
-            }
-            if rejection.is_none() {
-                for queued in queue.requests() {
-                    match heal_types_overlap(&request.heal_type, &queued.heal_type) {
-                        OverlapVerdict::SameTarget => {
-                            rejection = Some((HealAdmissionDropReason::AlreadyRunning, queued.id.clone()));
-                            break;
-                        }
-                        OverlapVerdict::Overlapping => {
-                            rejection = Some((HealAdmissionDropReason::OverlappingPaths, queued.id.clone()));
-                        }
-                        OverlapVerdict::Disjoint => {}
-                    }
-                }
-            }
-            if let Some((reason, overlap_task_id)) = rejection {
-                drop(retrying_heals);
-                drop(queue);
-                drop(active_heals);
-                Self::record_admission_metric(request.source, HealAdmissionResult::Dropped(reason), "overlap_rejected");
-                warn!(
-                    target: "rustfs::heal::manager",
-                    event = EVENT_HEAL_QUEUE_ADMISSION,
-                    component = LOG_COMPONENT_HEAL,
-                    subsystem = LOG_SUBSYSTEM_MANAGER,
-                    request_id = %request.id,
-                    overlap_task_id = %overlap_task_id,
-                    reason = reason.as_str(),
-                    result = "overlap_rejected",
-                    "Admin heal start rejected by overlap policy"
-                );
-                return Ok(HealAdmissionReceipt {
-                    result: HealAdmissionResult::Dropped(reason),
-                    task_id: overlap_task_id,
-                });
-            }
-        }
-
         let mut task_id = request.id.clone();
         let admission = Self::admit_request_to_queue(&mut queue, request, &config, "submit");
         if admission == HealAdmissionResult::Merged
@@ -2162,25 +1896,28 @@ impl HealManager {
     }
 
     pub async fn get_task_report(&self, task_id: &str) -> Result<HealTaskReport> {
-        self.get_task_report_since(task_id, None).await
-    }
-
-    /// Incremental variant of [`Self::get_task_report`] (HS-06): `since` is
-    /// the client's last seen sequence number; `None` keeps the legacy
-    /// full-snapshot semantics.
-    pub async fn get_task_report_since(&self, task_id: &str, since: Option<u64>) -> Result<HealTaskReport> {
         let canonical_task_id = self.canonical_task_id(task_id).await;
         {
             let active_heals = self.active_heals.lock().await;
             if let Some(task) = active_heals.get(&canonical_task_id) {
-                return Ok(active_task_report(task, since).await);
+                return Ok(HealTaskReport {
+                    status: task.get_status().await,
+                    result_items: task.get_result_items().await,
+                    result_items_truncated: task.result_items_truncated(),
+                    progress: Some(task.get_progress().await),
+                });
             }
         }
 
         {
             let retrying_heals = self.retrying_heals.lock().await;
             if let Some(retrying) = retrying_heals.get(&canonical_task_id) {
-                return Ok(empty_task_report(retrying.status()));
+                return Ok(HealTaskReport {
+                    status: retrying.status(),
+                    result_items: Vec::new(),
+                    result_items_truncated: false,
+                    progress: None,
+                });
             }
         }
 
@@ -2190,21 +1927,36 @@ impl HealManager {
             if let Some(completed) = completed_heals.get(&canonical_task_id)
                 && completed_status_is_retrying(&completed.status)
             {
-                return Ok(completed_task_report(completed, since));
+                return Ok(HealTaskReport {
+                    status: completed.status.clone(),
+                    result_items: completed.result_items.clone(),
+                    result_items_truncated: completed.result_items_truncated,
+                    progress: None,
+                });
             }
         }
 
         {
             let queue = self.heal_queue.lock().await;
             if queue.contains_request_id(&canonical_task_id) {
-                return Ok(empty_task_report(HealTaskStatus::Pending));
+                return Ok(HealTaskReport {
+                    status: HealTaskStatus::Pending,
+                    result_items: Vec::new(),
+                    result_items_truncated: false,
+                    progress: None,
+                });
             }
         }
 
         let mut completed_heals = self.completed_heals.lock().await;
         prune_completed_heal_statuses(&mut completed_heals);
         if let Some(completed) = completed_heals.get(&canonical_task_id) {
-            return Ok(completed_task_report(completed, since));
+            return Ok(HealTaskReport {
+                status: completed.status.clone(),
+                result_items: completed.result_items.clone(),
+                result_items_truncated: completed.result_items_truncated,
+                progress: None,
+            });
         }
 
         Err(Error::TaskNotFound {
@@ -2213,23 +1965,18 @@ impl HealManager {
     }
 
     pub async fn get_task_report_for_path(&self, heal_path: &str, task_id: &str) -> Result<HealTaskReport> {
-        self.get_task_report_for_path_since(heal_path, task_id, None).await
-    }
-
-    /// Incremental variant of [`Self::get_task_report_for_path`] (HS-06).
-    pub async fn get_task_report_for_path_since(
-        &self,
-        heal_path: &str,
-        task_id: &str,
-        since: Option<u64>,
-    ) -> Result<HealTaskReport> {
         let canonical_task_id = self.canonical_task_id(task_id).await;
         {
             let active_heals = self.active_heals.lock().await;
             if let Some(task) = active_heals.get(&canonical_task_id)
                 && heal_type_matches_path(&task.heal_type, heal_path)
             {
-                return Ok(active_task_report(task, since).await);
+                return Ok(HealTaskReport {
+                    status: task.get_status().await,
+                    result_items: task.get_result_items().await,
+                    result_items_truncated: task.result_items_truncated(),
+                    progress: Some(task.get_progress().await),
+                });
             }
         }
 
@@ -2238,7 +1985,12 @@ impl HealManager {
             if let Some(retrying) = retrying_heals.get(&canonical_task_id)
                 && heal_type_matches_path(&retrying.request.heal_type, heal_path)
             {
-                return Ok(empty_task_report(retrying.status()));
+                return Ok(HealTaskReport {
+                    status: retrying.status(),
+                    result_items: Vec::new(),
+                    result_items_truncated: false,
+                    progress: None,
+                });
             }
         }
 
@@ -2249,14 +2001,24 @@ impl HealManager {
                 && heal_type_matches_path(&completed.heal_type, heal_path)
                 && completed_status_is_retrying(&completed.status)
             {
-                return Ok(completed_task_report(completed, since));
+                return Ok(HealTaskReport {
+                    status: completed.status.clone(),
+                    result_items: completed.result_items.clone(),
+                    result_items_truncated: completed.result_items_truncated,
+                    progress: None,
+                });
             }
         }
 
         {
             let queue = self.heal_queue.lock().await;
             if queue.contains_request_id_matching_path(&canonical_task_id, heal_path) {
-                return Ok(empty_task_report(HealTaskStatus::Pending));
+                return Ok(HealTaskReport {
+                    status: HealTaskStatus::Pending,
+                    result_items: Vec::new(),
+                    result_items_truncated: false,
+                    progress: None,
+                });
             }
         }
 
@@ -2266,7 +2028,12 @@ impl HealManager {
             if let Some(completed) = completed_heals.get(&canonical_task_id)
                 && heal_type_matches_path(&completed.heal_type, heal_path)
             {
-                return Ok(completed_task_report(completed, since));
+                return Ok(HealTaskReport {
+                    status: completed.status.clone(),
+                    result_items: completed.result_items.clone(),
+                    result_items_truncated: completed.result_items_truncated,
+                    progress: None,
+                });
             }
         }
 
@@ -2618,27 +2385,8 @@ impl HealManager {
             snapshot.objects_scanned = snapshot.objects_scanned.saturating_add(progress.objects_scanned);
             snapshot.objects_healed = snapshot.objects_healed.saturating_add(progress.objects_healed);
             snapshot.objects_failed = snapshot.objects_failed.saturating_add(progress.objects_failed);
-            snapshot.skipped_new_versions = snapshot.skipped_new_versions.saturating_add(progress.skipped_new_versions);
-            snapshot.skipped_ilm_expired = snapshot.skipped_ilm_expired.saturating_add(progress.skipped_ilm_expired);
-            snapshot.objects_total_count = snapshot.objects_total_count.saturating_add(progress.objects_total_count);
-            snapshot.objects_total_size = snapshot.objects_total_size.saturating_add(progress.objects_total_size);
             snapshot.bytes_processed = snapshot.bytes_processed.saturating_add(progress.bytes_processed);
-            snapshot.start_time = match (snapshot.start_time, progress.start_time) {
-                (Some(current), Some(next)) => Some(current.min(next)),
-                (None, next) => next,
-                (current, None) => current,
-            };
-            snapshot.last_update_time = match (snapshot.last_update_time, progress.last_update_time) {
-                (Some(current), Some(next)) => Some(current.max(next)),
-                (None, next) => next,
-                (current, None) => current,
-            };
-            if progress.current_object.is_some() {
-                snapshot.current_object = progress.current_object;
-            }
         }
-        snapshot.refresh_progress_percentage();
-        snapshot.refresh_estimated_completion_time();
         Some(snapshot)
     }
 
@@ -3460,17 +3208,12 @@ impl HealManager {
                         } else {
                             completed_task.get_status().await
                         };
-                        let completed_progress = completed_task.get_progress().await;
-                        let final_window = completed_task.get_result_items_since(None).await;
                         let completed_status_entry = CompletedHealStatus {
                             heal_type: completed_task.heal_type.clone(),
                             status: completed_status.clone(),
-                            result_items: final_window.items.clone(),
+                            result_items: completed_task.get_result_items().await,
                             result_items_truncated: completed_task.result_items_truncated(),
                             completed_at: SystemTime::now(),
-                            seqed_items: completed_task.get_seqed_result_items().await,
-                            next_seq: final_window.next_seq,
-                            min_seq: final_window.min_seq,
                         };
                         let mut completed_heals_guard = completed_heals_clone.lock().await;
                         prune_completed_heal_statuses(&mut completed_heals_guard);
@@ -3480,7 +3223,6 @@ impl HealManager {
                         match completed_status {
                             HealTaskStatus::Completed => {
                                 stats.update_task_completion(true);
-                                stats.add_healed_objects(completed_progress.objects_healed, completed_progress.bytes_processed);
                             }
                             HealTaskStatus::Retrying { .. } => {}
                             _ => {
@@ -4007,7 +3749,6 @@ mod tests {
             _bucket: &str,
             _prefix: &str,
             _continuation_token: Option<&str>,
-            _include_lifecycle_object_info: bool,
         ) -> Result<(Vec<crate::heal::storage::HealListItem>, Option<String>, bool)> {
             Ok((Vec::new(), None, false))
         }
@@ -5242,9 +4983,6 @@ mod tests {
                 },
                 result_items: Vec::new(),
                 result_items_truncated: false,
-                seqed_items: Vec::new(),
-                next_seq: 0,
-                min_seq: 0,
                 completed_at: SystemTime::now(),
             },
         );
@@ -5526,136 +5264,6 @@ mod tests {
         assert_eq!(snapshot.queued_by_source.internal, 0);
     }
 
-    // HS-06 (backlog#1870): overlap policy + forceStart semantics.
-    fn manager_with_policy(policy: HealOverlapPolicy) -> HealManager {
-        let storage: Arc<dyn HealStorageAPI> = Arc::new(MockStorage);
-        HealManager::new(
-            storage,
-            Some(HealConfig {
-                overlap_policy: policy,
-                ..Default::default()
-            }),
-        )
-    }
-
-    fn admin_prefix_request(bucket: &str, prefix: &str) -> HealRequest {
-        let mut request = HealRequest::new(
-            HealType::Prefix {
-                bucket: bucket.to_string(),
-                prefix: prefix.to_string(),
-            },
-            HealOptions::default(),
-            HealPriority::Normal,
-        );
-        request.source = HealRequestSource::Admin;
-        request
-    }
-
-    async fn insert_active_task(manager: &HealManager, request: HealRequest) -> String {
-        let task = Arc::new(HealTask::from_request(request, manager.storage.clone()));
-        let task_id = task.id.clone();
-        manager.active_heals.lock().await.insert(task_id.clone(), task);
-        task_id
-    }
-
-    #[tokio::test]
-    async fn overlap_policy_minio_error_rejects_same_and_containing_paths() {
-        let manager = manager_with_policy(HealOverlapPolicy::MinioError);
-        insert_active_task(&manager, admin_prefix_request("bucket-a", "logs/")).await;
-
-        // Same target: typed AlreadyRunning.
-        let same = manager
-            .submit_heal_request(admin_prefix_request("bucket-a", "logs/"))
-            .await
-            .expect("admission must decide");
-        assert_eq!(
-            same,
-            HealAdmissionResult::Dropped(HealAdmissionDropReason::AlreadyRunning),
-            "an identical target must reject with already-running"
-        );
-
-        // Contained path: typed OverlappingPaths.
-        let nested = manager
-            .submit_heal_request(admin_prefix_request("bucket-a", "logs/app/"))
-            .await
-            .expect("admission must decide");
-        assert_eq!(
-            nested,
-            HealAdmissionResult::Dropped(HealAdmissionDropReason::OverlappingPaths),
-            "a path inside the active task's path must reject with overlapping-paths"
-        );
-
-        // Containing path (bucket-wide vs nested active): also overlapping.
-        let wide = manager
-            .submit_heal_request(admin_prefix_request("bucket-a", ""))
-            .await
-            .expect("admission must decide");
-        assert_eq!(
-            wide,
-            HealAdmissionResult::Dropped(HealAdmissionDropReason::OverlappingPaths),
-            "a bucket-wide start overlapping a nested active heal must reject"
-        );
-
-        // Disjoint bucket: unaffected.
-        let disjoint = manager
-            .submit_heal_request(admin_prefix_request("bucket-b", "logs/"))
-            .await
-            .expect("admission must decide");
-        assert_eq!(disjoint, HealAdmissionResult::Accepted);
-    }
-
-    #[tokio::test]
-    async fn overlap_policy_default_merge_keeps_today_semantics() {
-        let manager = manager_with_policy(HealOverlapPolicy::Merge);
-        insert_active_task(&manager, admin_prefix_request("bucket-a", "logs/")).await;
-
-        // Different-dedup-key overlap still merges under the default policy:
-        // the nested path dedups to its own key but nothing rejects it.
-        let nested = manager
-            .submit_heal_request(admin_prefix_request("bucket-a", "logs/app/"))
-            .await
-            .expect("admission must decide");
-        assert_eq!(nested, HealAdmissionResult::Accepted, "default policy must not reject overlaps");
-
-        // Non-admin sources never get overlap rejections even under minio_error.
-        let manager = manager_with_policy(HealOverlapPolicy::MinioError);
-        insert_active_task(&manager, admin_prefix_request("bucket-a", "logs/")).await;
-        let mut scanner_request = admin_prefix_request("bucket-a", "logs/app/");
-        scanner_request.source = HealRequestSource::Scanner;
-        let admitted = manager
-            .submit_heal_request(scanner_request)
-            .await
-            .expect("admission must decide");
-        assert_eq!(admitted, HealAdmissionResult::Accepted, "scanner sources must never be overlap-rejected");
-    }
-
-    #[tokio::test]
-    async fn admin_force_start_cancels_overlapping_active_task_first() {
-        let manager = manager_with_policy(HealOverlapPolicy::Merge);
-        let old_id = insert_active_task(&manager, admin_prefix_request("bucket-a", "logs/")).await;
-
-        let mut replacement = admin_prefix_request("bucket-a", "logs/");
-        replacement.force_start = true;
-        let receipt = manager
-            .submit_heal_request_with_receipt(replacement)
-            .await
-            .expect("force-start submission must decide");
-
-        assert!(receipt.result.is_admitted(), "the new task must be admitted (Accepted or Merged)");
-        let old_task_gone = {
-            let active_heals = manager.active_heals.lock().await;
-            !active_heals.contains_key(&old_id)
-        };
-        assert!(
-            old_task_gone,
-            "the overlapping admin task must be cancelled (removed from the active table) before the new one starts"
-        );
-        assert!(
-            matches!(manager.get_task_status(&old_id).await, Err(Error::TaskNotFound { .. })),
-            "a cancelled task must no longer resolve as an active heal"
-        );
-    }
-
     #[tokio::test]
     async fn test_operations_snapshot_counts_active_by_source_and_priority() {
         let storage: Arc<dyn HealStorageAPI> = Arc::new(MockStorage);
@@ -5788,8 +5396,6 @@ mod tests {
         ));
         {
             let mut progress = first.progress.write().await;
-            progress.start_time = Some(SystemTime::now() - Duration::from_secs(20));
-            progress.set_total_baseline(12, 8192);
             progress.update_progress(7, 3, 1, 4096);
         }
 
@@ -5799,8 +5405,6 @@ mod tests {
         ));
         {
             let mut progress = second.progress.write().await;
-            progress.start_time = Some(SystemTime::now() - Duration::from_secs(10));
-            progress.set_total_baseline(8, 4096);
             progress.update_progress(11, 5, 2, 2048);
         }
 
@@ -5815,11 +5419,7 @@ mod tests {
         assert_eq!(progress.objects_scanned, 18);
         assert_eq!(progress.objects_healed, 8);
         assert_eq!(progress.objects_failed, 3);
-        assert_eq!(progress.objects_total_count, 20);
-        assert_eq!(progress.objects_total_size, 12288);
         assert_eq!(progress.bytes_processed, 6144);
-        assert!((progress.progress_percentage - 50.0).abs() < 0.001);
-        assert!(progress.estimated_completion_time.is_some());
     }
 
     #[tokio::test]
@@ -5958,9 +5558,6 @@ mod tests {
                 status: HealTaskStatus::Completed,
                 result_items: Vec::new(),
                 result_items_truncated: false,
-                seqed_items: Vec::new(),
-                next_seq: 0,
-                min_seq: 0,
                 completed_at: SystemTime::now(),
             },
         );
@@ -5995,9 +5592,6 @@ mod tests {
                     ..Default::default()
                 }],
                 result_items_truncated: true,
-                seqed_items: Vec::new(),
-                next_seq: 0,
-                min_seq: 0,
                 completed_at: SystemTime::now(),
             },
         );

crates/heal/src/heal/mod.rs

@@ -16,7 +16,6 @@ pub mod channel;
 pub mod erasure_healer;
 pub mod event;
 pub mod manager;
-pub mod mrf_queue;
 pub mod progress;
 pub(crate) mod replacement_readiness;
 pub mod resume;

crates/heal/src/heal/mrf_queue.rs

@@ -1,682 +0,0 @@
-// Copyright 2024 RustFS Team
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-//! Mission Repair Feed (MRF) queue, journal, and consumer.
-//!
-//! Intents arriving on the global channel (see `rustfs_common::mrf_channel`)
-//! are buffered in a bounded in-memory queue, translated into prioritized
-//! heal requests, and — while they are not yet accepted by the heal manager —
-//! mirrored into a durable journal so a crash or restart can replay them.
-//! This is the RustFS counterpart of MinIO's `.heal/mrf/list.bin` replay,
-//! layered on top of (not replacing) read-repair and scanner heal.
-//!
-//! Durability model: the journal is a snapshot of the *unaccepted* pending
-//! set, rewritten on a group-commit cadence (every flush interval or flush
-//! threshold new intents). A rewrite is atomic at the record level only — a
-//! torn tail simply truncates during replay because every record carries its
-//! own CRC32. Losing the last flush window (≤500 ms) is acceptable: replayed
-//! duplicates are merged by the manager's dedup key, and read-repair remains
-//! the safety net.
-
-use super::{DiskStore, HealDiskExt as _, local_disk_map_read};
-use crate::heal::manager::HealManager;
-use metrics::{counter, gauge};
-use rustfs_common::heal_channel::{HealAdmissionDropReason, HealAdmissionResult};
-use rustfs_common::mrf_channel::{MRF_MAX_ATTEMPTS, MrfIntent};
-use std::collections::VecDeque;
-use std::sync::Arc;
-use std::time::Duration;
-use tokio::sync::mpsc;
-use uuid::Uuid;
-
-use crate::heal::task::{HealOptions, HealPriority, HealRequest, HealType};
-
-/// Journal location inside the metadata bucket, following the resume-state
-/// layout.
-pub(crate) const MRF_JOURNAL_PATH: &str = "buckets/.heal/mrf/journal.bin";
-
-/// Record format tag.
-const MRF_JOURNAL_FORMAT: u8 = 1;
-/// Record layout version.
-const MRF_JOURNAL_VERSION: u8 = 1;
-
-/// Fixed header size: format, version, kind, attempts, enqueued_at_ms,
-/// has_version flag.
-const MRF_RECORD_FIXED_HEAD: usize = 1 + 1 + 1 + 1 + 8 + 1;
-
-#[derive(Debug, Clone)]
-pub(crate) struct MrfConsumerConfig {
-    /// In-memory queue capacity in intents.
-    pub queue_capacity: usize,
-    /// Journal byte budget; a pending snapshot above this bound is rejected
-    /// oldest-first so the journal can never grow unbounded.
-    pub journal_max_bytes: usize,
-    /// How many journal intents to re-arm per replay round.
-    pub replay_batch: usize,
-    /// Group-commit cadence for the journal snapshot.
-    pub flush_interval: Duration,
-    /// New intents between flushes that force an early snapshot.
-    pub flush_threshold: usize,
-    /// Backoff after the heal manager reports a full admission.
-    pub admission_backoff: Duration,
-}
-
-impl Default for MrfConsumerConfig {
-    fn default() -> Self {
-        Self {
-            queue_capacity: rustfs_utils::get_env_usize(
-                rustfs_config::ENV_HEAL_MRF_QUEUE_SIZE,
-                rustfs_config::DEFAULT_HEAL_MRF_QUEUE_SIZE,
-            ),
-            journal_max_bytes: rustfs_utils::get_env_usize(
-                rustfs_config::ENV_HEAL_MRF_JOURNAL_MAX_BYTES,
-                rustfs_config::DEFAULT_HEAL_MRF_JOURNAL_MAX_BYTES,
-            ),
-            replay_batch: rustfs_utils::get_env_usize(
-                rustfs_config::ENV_HEAL_MRF_REPLAY_BATCH,
-                rustfs_config::DEFAULT_HEAL_MRF_REPLAY_BATCH,
-            ),
-            flush_interval: Duration::from_millis(500),
-            flush_threshold: 1000,
-            admission_backoff: Duration::from_secs(5),
-        }
-    }
-}
-
-/// Bounded pending set with count and byte ceilings. Overflow drops the
-/// incoming intent (never a resident one) and counts the loss.
-pub(crate) struct MrfQueue {
-    pending: VecDeque<MrfIntent>,
-    bytes: usize,
-    capacity: usize,
-    byte_budget: usize,
-}
-
-impl MrfQueue {
-    pub(crate) fn new(capacity: usize, byte_budget: usize) -> Self {
-        Self {
-            pending: VecDeque::new(),
-            bytes: 0,
-            capacity,
-            byte_budget,
-        }
-    }
-
-    /// Returns `false` (after counting) when either ceiling would be crossed.
-    pub(crate) fn try_push(&mut self, intent: MrfIntent) -> bool {
-        let cost = intent.estimated_bytes();
-        if self.pending.len() >= self.capacity || self.bytes + cost > self.byte_budget {
-            counter!("rustfs_heal_mrf_dropped_total", "reason" => "queue_overflow").increment(1);
-            return false;
-        }
-        self.bytes += cost;
-        self.pending.push_back(intent);
-        true
-    }
-
-    pub(crate) fn pop_front(&mut self) -> Option<MrfIntent> {
-        let intent = self.pending.pop_front()?;
-        self.bytes = self.bytes.saturating_sub(intent.estimated_bytes());
-        Some(intent)
-    }
-
-    pub(crate) fn push_back(&mut self, intent: MrfIntent) {
-        self.bytes += intent.estimated_bytes();
-        self.pending.push_back(intent);
-    }
-
-    pub(crate) fn depth(&self) -> usize {
-        self.pending.len()
-    }
-
-    pub(crate) fn bytes(&self) -> usize {
-        self.bytes
-    }
-
-    pub(crate) fn intents(&self) -> impl Iterator<Item = &MrfIntent> {
-        self.pending.iter()
-    }
-}
-
-// ---------------------------------------------------------------------------
-// Journal record codec
-// ---------------------------------------------------------------------------
-
-/// Append one encoded record to `out`.
-pub(crate) fn encode_intent(intent: &MrfIntent, out: &mut Vec<u8>) {
-    let start = out.len();
-    out.push(MRF_JOURNAL_FORMAT);
-    out.push(MRF_JOURNAL_VERSION);
-    out.push(match intent.kind {
-        rustfs_common::mrf_channel::MrfKind::DecodeFailure => 1,
-        rustfs_common::mrf_channel::MrfKind::MetadataCorruption => 2,
-        rustfs_common::mrf_channel::MrfKind::PartialWrite => 3,
-    });
-    out.push(intent.attempts);
-    out.extend_from_slice(&intent.enqueued_at_ms.to_le_bytes());
-    match intent.version_id {
-        Some(bytes) => {
-            out.push(1);
-            out.extend_from_slice(&bytes);
-        }
-        None => out.push(0),
-    }
-    out.extend_from_slice(&(intent.bucket.len() as u32).to_le_bytes());
-    out.extend_from_slice(&(intent.object.len() as u32).to_le_bytes());
-    out.extend_from_slice(intent.bucket.as_bytes());
-    out.extend_from_slice(intent.object.as_bytes());
-    let mut hasher = crc_fast::Digest::new(crc_fast::CrcAlgorithm::Crc32IsoHdlc);
-    hasher.update(&out[start..]);
-    out.extend_from_slice(&(hasher.finalize() as u32).to_le_bytes());
-}
-
-fn decode_one(data: &[u8]) -> Option<(MrfIntent, usize)> {
-    if data.len() < MRF_RECORD_FIXED_HEAD + 8 {
-        return None;
-    }
-    if data[0] != MRF_JOURNAL_FORMAT || data[1] != MRF_JOURNAL_VERSION {
-        return None;
-    }
-    let kind = match data[2] {
-        1 => rustfs_common::mrf_channel::MrfKind::DecodeFailure,
-        2 => rustfs_common::mrf_channel::MrfKind::MetadataCorruption,
-        3 => rustfs_common::mrf_channel::MrfKind::PartialWrite,
-        _ => return None,
-    };
-    let attempts = data[3];
-    let enqueued_at_ms = u64::from_le_bytes(data[4..12].try_into().expect("slice length checked"));
-    let has_version = data[12] != 0;
-    let mut cursor = MRF_RECORD_FIXED_HEAD;
-    let version_id = if has_version {
-        if data.len() < cursor + 16 {
-            return None;
-        }
-        let bytes: [u8; 16] = data[cursor..cursor + 16].try_into().expect("slice length checked");
-        cursor += 16;
-        Some(bytes)
-    } else {
-        None
-    };
-    if data.len() < cursor + 8 {
-        return None;
-    }
-    let bucket_len = u32::from_le_bytes(data[cursor..cursor + 4].try_into().expect("slice length checked")) as usize;
-    let object_len = u32::from_le_bytes(data[cursor + 4..cursor + 8].try_into().expect("slice length checked")) as usize;
-    cursor += 8;
-    let body_end = cursor.checked_add(bucket_len)?.checked_add(object_len)?;
-    let record_end = body_end.checked_add(4)?;
-    if data.len() < record_end {
-        return None;
-    }
-    let mut hasher = crc_fast::Digest::new(crc_fast::CrcAlgorithm::Crc32IsoHdlc);
-    hasher.update(&data[..body_end]);
-    if (hasher.finalize() as u32) != u32::from_le_bytes(data[body_end..record_end].try_into().expect("slice length checked")) {
-        return None;
-    }
-    let bucket = std::sync::Arc::from(std::str::from_utf8(&data[cursor..cursor + bucket_len]).ok()?);
-    let object = std::sync::Arc::from(std::str::from_utf8(&data[cursor + bucket_len..body_end]).ok()?);
-    Some((
-        MrfIntent {
-            bucket,
-            object,
-            version_id,
-            kind,
-            enqueued_at_ms,
-            attempts,
-        },
-        record_end,
-    ))
-}
-
-/// Decode a whole journal, stopping at the first torn or corrupt record.
-/// Returns the decoded intents and the number of trailing bytes discarded.
-pub(crate) fn decode_journal(data: &[u8]) -> (Vec<MrfIntent>, usize) {
-    let mut intents = Vec::new();
-    let mut cursor = 0usize;
-    while cursor < data.len() {
-        match decode_one(&data[cursor..]) {
-            Some((intent, consumed)) => {
-                intents.push(intent);
-                cursor += consumed;
-            }
-            None => break,
-        }
-    }
-    let truncated = data.len() - cursor;
-    (intents, truncated)
-}
-
-// ---------------------------------------------------------------------------
-// Journal disk IO (all local disks, first successful read wins)
-// ---------------------------------------------------------------------------
-
-async fn journal_disks() -> Vec<DiskStore> {
-    let map = local_disk_map_read().await;
-    map.values().flatten().cloned().collect()
-}
-
-async fn read_journal() -> Option<Vec<u8>> {
-    for disk in journal_disks().await {
-        match disk.read_all(super::RUSTFS_META_BUCKET, MRF_JOURNAL_PATH).await {
-            Ok(bytes) => return Some(bytes.to_vec()),
-            Err(_) => continue,
-        }
-    }
-    None
-}
-
-async fn write_journal(data: &[u8]) {
-    let payload = bytes::Bytes::copy_from_slice(data);
-    for disk in journal_disks().await {
-        if let Err(err) = disk
-            .write_all(super::RUSTFS_META_BUCKET, MRF_JOURNAL_PATH, payload.clone())
-            .await
-        {
-            warn_mrf_journal_write(&err);
-        }
-    }
-    if !data.is_empty() {
-        counter!("rustfs_heal_mrf_journal_fsync_total").increment(1);
-    }
-    gauge!("rustfs_heal_mrf_journal_bytes").set(data.len() as f64);
-}
-
-async fn delete_journal() {
-    for disk in journal_disks().await {
-        let _ = disk
-            .delete(
-                super::RUSTFS_META_BUCKET,
-                MRF_JOURNAL_PATH,
-                crate::heal::storage_api::owner::EcstoreDeleteOptions::default(),
-            )
-            .await;
-    }
-}
-
-fn warn_mrf_journal_write(err: &super::DiskError) {
-    tracing::warn!(
-        target: "rustfs::heal::mrf",
-        error = %err,
-        "MRF journal write failed; unconsumed intents may be lost on restart"
-    );
-}
-
-// ---------------------------------------------------------------------------
-// Consumer
-// ---------------------------------------------------------------------------
-
-/// Translate an intent into the prioritized heal request the issue specifies:
-/// decode failures go Urgent ECDecode, metadata corruption goes High
-/// Metadata, partial writes go Normal object heal.
-pub(crate) fn build_heal_request(intent: &MrfIntent) -> HealRequest {
-    let bucket = intent.bucket.to_string();
-    let object = intent.object.to_string();
-    let version_id = intent.version_id.map(|bytes| Uuid::from_bytes(bytes).to_string());
-    let (heal_type, priority) = match intent.kind {
-        rustfs_common::mrf_channel::MrfKind::DecodeFailure => (
-            HealType::ECDecode {
-                bucket,
-                object,
-                version_id,
-            },
-            HealPriority::Urgent,
-        ),
-        rustfs_common::mrf_channel::MrfKind::MetadataCorruption => (HealType::Metadata { bucket, object }, HealPriority::High),
-        rustfs_common::mrf_channel::MrfKind::PartialWrite => (
-            HealType::Object {
-                bucket,
-                object,
-                version_id,
-            },
-            HealPriority::Normal,
-        ),
-    };
-    let mut request = HealRequest::new(heal_type, HealOptions::default(), priority);
-    request.source = rustfs_common::heal_channel::HealRequestSource::Mrf;
-    request
-}
-
-struct MrfRuntime {
-    queue: MrfQueue,
-    config: MrfConsumerConfig,
-    new_since_flush: usize,
-    /// True while a journal snapshot exists on disk that no longer reflects
-    /// an all-consumed pending set; the next idle tick removes it (MinIO
-    /// deletes its `list.bin` after replay for the same reason).
-    journal_on_disk: bool,
-    /// Earliest instant a full-admission retry may proceed.
-    backoff_until: Option<tokio::time::Instant>,
-}
-
-impl MrfRuntime {
-    fn record_accept(&mut self) {
-        // Accepted intents leave the pending set; the next flush persists the
-        // smaller snapshot, which is the journal's compaction.
-    }
-
-    fn snapshot(&self) -> Vec<u8> {
-        let mut buf = Vec::new();
-        for intent in self.queue.intents() {
-            encode_intent(intent, &mut buf);
-        }
-        buf
-    }
-
-    async fn flush(&mut self) {
-        write_journal(&self.snapshot()).await;
-        self.new_since_flush = 0;
-        self.journal_on_disk = true;
-    }
-
-    /// Drain pending intents into the heal manager until it is full, the
-    /// queue empties, or attempts are exhausted.
-    async fn dispatch(&mut self, manager: &HealManager) {
-        if let Some(until) = self.backoff_until {
-            if tokio::time::Instant::now() < until {
-                return;
-            }
-            self.backoff_until = None;
-        }
-        while let Some(mut intent) = self.queue.pop_front() {
-            let request = build_heal_request(&intent);
-            match manager.submit_heal_request(request).await {
-                Ok(HealAdmissionResult::Accepted) | Ok(HealAdmissionResult::Merged) => self.record_accept(),
-                Ok(HealAdmissionResult::Full) | Ok(HealAdmissionResult::Dropped(HealAdmissionDropReason::QueueFull)) => {
-                    intent.attempts = intent.attempts.saturating_add(1);
-                    if intent.attempts >= MRF_MAX_ATTEMPTS {
-                        counter!("rustfs_heal_mrf_dropped_total", "reason" => "attempts_exhausted").increment(1);
-                        continue;
-                    }
-                    self.queue.push_back(intent);
-                    self.backoff_until = Some(tokio::time::Instant::now() + self.config.admission_backoff);
-                    break;
-                }
-                Ok(HealAdmissionResult::Dropped(_)) => {
-                    counter!("rustfs_heal_mrf_dropped_total", "reason" => "admission_policy").increment(1);
-                }
-                Err(_) => {
-                    intent.attempts = intent.attempts.saturating_add(1);
-                    if intent.attempts >= MRF_MAX_ATTEMPTS {
-                        counter!("rustfs_heal_mrf_dropped_total", "reason" => "attempts_exhausted").increment(1);
-                        continue;
-                    }
-                    self.queue.push_back(intent);
-                    self.backoff_until = Some(tokio::time::Instant::now() + self.config.admission_backoff);
-                    break;
-                }
-            }
-        }
-        gauge!("rustfs_heal_mrf_queue_depth").set(self.queue.depth() as f64);
-        gauge!("rustfs_heal_mrf_queue_bytes").set(self.queue.bytes() as f64);
-    }
-}
-
-/// Initialize the global MRF channel (honoring `RUSTFS_HEAL_MRF_ENABLE`) and
-/// spawn the consumer task. Called once from the heal runtime bootstrap right
-/// after the manager started; a disabled feature or a double call is a no-op.
-/// Public for integration tests that drive the real consumer loop.
-pub fn spawn_mrf_consumer(manager: Arc<HealManager>) {
-    let enabled = rustfs_utils::get_env_bool(rustfs_config::ENV_HEAL_MRF_ENABLE, rustfs_config::DEFAULT_HEAL_MRF_ENABLE);
-    rustfs_common::mrf_channel::set_mrf_delivery_enabled(enabled);
-    if !enabled {
-        tracing::info!(
-            target: "rustfs::heal::mrf",
-            "MRF intent pipeline disabled by configuration; producers will not deliver"
-        );
-        return;
-    }
-    let receiver = match rustfs_common::mrf_channel::init_mrf_channel() {
-        Ok(receiver) => receiver,
-        Err(err) => {
-            tracing::warn!(
-                target: "rustfs::heal::mrf",
-                error = err,
-                "MRF channel initialization failed; intents will be dropped at producers"
-            );
-            return;
-        }
-    };
-    tokio::spawn(async move {
-        run_mrf_consumer(manager, receiver).await;
-    });
-    tracing::info!(target: "rustfs::heal::mrf", "MRF intent consumer started");
-}
-
-/// Replay the durable journal into a fresh pending queue and submit whatever
-/// it armed. Returns the number of intact intents replayed. Duplicates are
-/// merged by the manager's dedup key; the journal file is removed once read
-/// (torn tails truncate via the per-record CRC). Public for integration tests;
-/// the live consumer invokes this through [`replay_into`] at startup.
-pub async fn replay_journal_once(manager: &Arc<HealManager>) -> usize {
-    let config = MrfConsumerConfig::default();
-    let mut queue = MrfQueue::new(config.queue_capacity, config.journal_max_bytes);
-    let mut backoff_until: Option<tokio::time::Instant> = None;
-    replay_into(manager, &mut queue, &mut backoff_until).await
-}
-
-/// Shared replay core: read + decode + re-arm + delete, then drain what fits.
-async fn replay_into(
-    manager: &Arc<HealManager>,
-    queue: &mut MrfQueue,
-    backoff_until: &mut Option<tokio::time::Instant>,
-) -> usize {
-    let Some(data) = read_journal().await else {
-        return 0;
-    };
-    let (intents, truncated) = decode_journal(&data);
-    if truncated > 0 {
-        tracing::warn!(
-            target: "rustfs::heal::mrf",
-            truncated_bytes = truncated,
-            "MRF journal had a torn tail; truncated records were discarded"
-        );
-    }
-    counter!("rustfs_heal_mrf_replayed_total").increment(intents.len() as u64);
-    let replayed = intents.len();
-    for intent in intents {
-        queue.try_push(intent);
-    }
-    delete_journal().await;
-
-    // Drain the replayed intents immediately; whatever the manager refuses
-    // stays armed in `queue` for the consumer's retry loop.
-    if backoff_until.is_none() {
-        while let Some(mut intent) = queue.pop_front() {
-            let request = build_heal_request(&intent);
-            match manager.submit_heal_request(request).await {
-                Ok(HealAdmissionResult::Accepted) | Ok(HealAdmissionResult::Merged) => {}
-                Ok(HealAdmissionResult::Full) | Ok(HealAdmissionResult::Dropped(HealAdmissionDropReason::QueueFull)) => {
-                    intent.attempts = intent.attempts.saturating_add(1);
-                    if intent.attempts < MRF_MAX_ATTEMPTS {
-                        queue.push_back(intent);
-                        *backoff_until = Some(tokio::time::Instant::now());
-                    }
-                    break;
-                }
-                Ok(HealAdmissionResult::Dropped(_)) | Err(_) => {}
-            }
-        }
-    }
-    replayed
-}
-
-/// Replay the journal, then keep draining the channel into the heal manager
-/// while persisting the pending snapshot.
-async fn run_mrf_consumer(manager: Arc<HealManager>, mut receiver: mpsc::Receiver<MrfIntent>) {
-    let config = MrfConsumerConfig::default();
-    let mut runtime = MrfRuntime {
-        queue: MrfQueue::new(config.queue_capacity, config.journal_max_bytes),
-        config: config.clone(),
-        new_since_flush: 0,
-        journal_on_disk: false,
-        backoff_until: None,
-    };
-
-    // Replay: read the journal, re-arm intents (duplicates are merged by the
-    // manager's dedup key), then drop the file so the next flush starts clean.
-    replay_into(&manager, &mut runtime.queue, &mut runtime.backoff_until).await;
-
-    let mut flush_tick = tokio::time::interval(runtime.config.flush_interval);
-    flush_tick.set_missed_tick_behavior(tokio::time::MissedTickBehavior::Delay);
-    let mut batch: Vec<MrfIntent> = Vec::with_capacity(runtime.config.replay_batch);
-
-    loop {
-        tokio::select! {
-            received = receiver.recv_many(&mut batch, runtime.config.replay_batch) => {
-                if received == 0 {
-                    // Channel closed: flush once more and stop.
-                    runtime.flush().await;
-                    tracing::info!(
-                        target: "rustfs::heal::mrf",
-                        "MRF channel closed; consumer stopped after final flush"
-                    );
-                    return;
-                }
-                for intent in batch.drain(..) {
-                    runtime.queue.try_push(intent);
-                    runtime.new_since_flush += 1;
-                }
-                runtime.dispatch(manager.as_ref()).await;
-                if runtime.new_since_flush >= runtime.config.flush_threshold {
-                    runtime.flush().await;
-                }
-            }
-            _ = flush_tick.tick() => {
-                if runtime.new_since_flush > 0 || runtime.queue.depth() > 0 {
-                    runtime.flush().await;
-                    runtime.dispatch(manager.as_ref()).await;
-                } else if runtime.journal_on_disk {
-                    // All intents consumed: remove the journal so a restart
-                    // replays nothing (mirrors MinIO's post-replay unlink).
-                    delete_journal().await;
-                    runtime.journal_on_disk = false;
-                    gauge!("rustfs_heal_mrf_journal_bytes").set(0.0);
-                }
-                gauge!("rustfs_heal_mrf_queue_depth").set(runtime.queue.depth() as f64);
-            }
-        }
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use rustfs_common::mrf_channel::{MrfIntent, MrfKind};
-    use std::sync::Arc as StdArc;
-
-    fn intent(bucket: &str, object: &str, attempts: u8) -> MrfIntent {
-        MrfIntent {
-            bucket: StdArc::from(bucket),
-            object: StdArc::from(object),
-            version_id: Some([7u8; 16]),
-            kind: MrfKind::DecodeFailure,
-            enqueued_at_ms: 1_700_000_000_000,
-            attempts,
-        }
-    }
-
-    #[test]
-    fn queue_enforces_count_and_byte_ceilings() {
-        let mut queue = MrfQueue::new(2, usize::MAX);
-        assert!(queue.try_push(intent("b", "o", 0)));
-        assert!(queue.try_push(intent("b", "o", 0)));
-        assert!(!queue.try_push(intent("b", "o", 0)), "count ceiling must drop");
-
-        let mut tiny = MrfQueue::new(usize::MAX, intent("bucket", "object", 0).estimated_bytes());
-        assert!(tiny.try_push(intent("bucket", "object", 0)));
-        assert!(
-            !tiny.try_push(intent("bucket", "object", 0)),
-            "byte budget must drop before the second intent fits"
-        );
-    }
-
-    #[test]
-    fn journal_roundtrip_preserves_intents() {
-        let intents = vec![
-            intent("bucket-a", "object/a", 0),
-            intent("bucket-b", "object/b", 2),
-            MrfIntent {
-                bucket: StdArc::from("bucket-c"),
-                object: StdArc::from("object/c"),
-                version_id: None,
-                kind: MrfKind::MetadataCorruption,
-                enqueued_at_ms: 5,
-                attempts: 1,
-            },
-        ];
-        let mut buf = Vec::new();
-        for intent in &intents {
-            encode_intent(intent, &mut buf);
-        }
-        let (decoded, truncated) = decode_journal(&buf);
-        assert_eq!(truncated, 0);
-        assert_eq!(decoded.len(), intents.len());
-        for (left, right) in decoded.iter().zip(intents.iter()) {
-            assert_eq!(left.bucket, right.bucket);
-            assert_eq!(left.object, right.object);
-            assert_eq!(left.version_id, right.version_id);
-            assert_eq!(left.kind, right.kind);
-            assert_eq!(left.attempts, right.attempts);
-        }
-    }
-
-    #[test]
-    fn journal_torn_tail_is_truncated() {
-        let mut buf = Vec::new();
-        encode_intent(&intent("b", "o", 0), &mut buf);
-        let mut torn = buf.clone();
-        torn.extend_from_slice(&buf[..buf.len() / 2]);
-
-        let (decoded, truncated) = decode_journal(&torn);
-        assert_eq!(decoded.len(), 1, "the intact record must survive");
-        assert!(truncated > 0, "the partial tail must be discarded");
-
-        // A corrupted body (CRC mismatch) also truncates from that record on.
-        let mut corrupt = buf.clone();
-        let mid = MRF_RECORD_FIXED_HEAD + 4;
-        corrupt[mid] ^= 0xff;
-        let (decoded, truncated) = decode_journal(&corrupt);
-        assert!(decoded.is_empty());
-        assert_eq!(truncated, corrupt.len());
-    }
-
-    #[test]
-    fn heal_request_mapping_follows_priority_matrix() {
-        let decode = build_heal_request(&intent("b", "o", 0));
-        assert!(matches!(decode.heal_type, HealType::ECDecode { .. }));
-        assert_eq!(decode.priority, HealPriority::Urgent);
-
-        let metadata = build_heal_request(&MrfIntent {
-            bucket: StdArc::from("b"),
-            object: StdArc::from("o"),
-            version_id: None,
-            kind: MrfKind::MetadataCorruption,
-            enqueued_at_ms: 0,
-            attempts: 0,
-        });
-        assert!(matches!(metadata.heal_type, HealType::Metadata { .. }));
-        assert_eq!(metadata.priority, HealPriority::High);
-
-        let partial = build_heal_request(&MrfIntent {
-            bucket: StdArc::from("b"),
-            object: StdArc::from("o"),
-            version_id: None,
-            kind: MrfKind::PartialWrite,
-            enqueued_at_ms: 0,
-            attempts: 0,
-        });
-        assert!(matches!(partial.heal_type, HealType::Object { .. }));
-        assert_eq!(partial.priority, HealPriority::Normal);
-    }
-}

crates/heal/src/heal/progress.rs

@@ -13,7 +13,7 @@
 // limitations under the License.
 
 use serde::{Deserialize, Serialize};
-use std::time::{Duration, SystemTime};
+use std::time::SystemTime;
 
 #[derive(Debug, Default, Clone, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
@@ -24,14 +24,6 @@ pub struct HealProgress {
     pub objects_healed: u64,
     /// Objects failed
     pub objects_failed: u64,
-    /// Versions skipped because they were written after this heal started
-    pub skipped_new_versions: u64,
-    /// Versions skipped because lifecycle already selected them for expiry
-    pub skipped_ilm_expired: u64,
-    /// Baseline object count from the latest complete usage snapshot
-    pub objects_total_count: u64,
-    /// Baseline object bytes from the latest complete usage snapshot
-    pub objects_total_size: u64,
     /// Bytes processed
     pub bytes_processed: u64,
     /// Current object
@@ -62,56 +54,10 @@ impl HealProgress {
         self.bytes_processed = bytes;
         self.last_update_time = Some(SystemTime::now());
 
-        self.refresh_progress_percentage();
-        self.refresh_estimated_completion_time();
-    }
-
-    pub fn set_total_baseline(&mut self, objects_total_count: u64, objects_total_size: u64) {
-        self.objects_total_count = objects_total_count;
-        self.objects_total_size = objects_total_size;
-        self.last_update_time = Some(SystemTime::now());
-        self.refresh_progress_percentage();
-        self.refresh_estimated_completion_time();
-    }
-
-    pub fn record_skipped_new_version(&mut self) {
-        self.skipped_new_versions = self.skipped_new_versions.saturating_add(1);
-        self.last_update_time = Some(SystemTime::now());
-        self.refresh_progress_percentage();
-        self.refresh_estimated_completion_time();
-    }
-
-    pub fn record_skipped_ilm_expired(&mut self) {
-        self.skipped_ilm_expired = self.skipped_ilm_expired.saturating_add(1);
-        self.last_update_time = Some(SystemTime::now());
-        self.refresh_progress_percentage();
-        self.refresh_estimated_completion_time();
-    }
-
-    fn completed_for_baseline(&self) -> u64 {
-        self.objects_healed
-            .saturating_add(self.objects_failed)
-            .saturating_add(self.skipped_new_versions)
-            .saturating_add(self.skipped_ilm_expired)
-    }
-
-    pub(crate) fn refresh_progress_percentage(&mut self) {
-        if self.objects_total_size > 0 {
-            self.progress_percentage = ((self.bytes_processed as f64 / self.objects_total_size as f64) * 100.0).min(100.0);
-            return;
-        }
-        if self.objects_total_count > 0 {
-            let completed = self.completed_for_baseline();
-            self.progress_percentage = ((completed as f64 / self.objects_total_count as f64) * 100.0).min(100.0);
-            return;
-        }
-
-        let total = self
-            .objects_scanned
-            .saturating_add(self.objects_healed)
-            .saturating_add(self.objects_failed);
+        // calculate progress percentage
+        let total = scanned + healed + failed;
         if total > 0 {
-            self.progress_percentage = (self.objects_healed as f64 / total as f64) * 100.0;
+            self.progress_percentage = (healed as f64 / total as f64) * 100.0;
         }
     }
 
@@ -120,36 +66,9 @@ impl HealProgress {
         self.last_update_time = Some(SystemTime::now());
     }
 
-    pub fn refresh_estimated_completion_time(&mut self) {
-        let Some(start_time) = self.start_time else {
-            self.estimated_completion_time = None;
-            return;
-        };
-        if self.is_completed() || !(0.0..100.0).contains(&self.progress_percentage) || self.bytes_processed == 0 {
-            self.estimated_completion_time = None;
-            return;
-        }
-
-        let elapsed = match SystemTime::now().duration_since(start_time) {
-            Ok(elapsed) if !elapsed.is_zero() => elapsed,
-            _ => {
-                self.estimated_completion_time = None;
-                return;
-            }
-        };
-        let estimated_total_secs = elapsed.as_secs_f64() * 100.0 / self.progress_percentage;
-        self.estimated_completion_time = start_time.checked_add(Duration::from_secs_f64(estimated_total_secs));
-    }
-
     pub fn is_completed(&self) -> bool {
-        if self.progress_percentage >= 100.0 {
-            return true;
-        }
-        if self.objects_total_count > 0 || self.objects_total_size > 0 {
-            return false;
-        }
-
-        self.objects_scanned > 0 && self.objects_healed.saturating_add(self.objects_failed) >= self.objects_scanned
+        self.progress_percentage >= 100.0
+            || self.objects_scanned > 0 && self.objects_healed + self.objects_failed >= self.objects_scanned
     }
 
     pub fn get_success_rate(&self) -> f64 {
@@ -239,10 +158,6 @@ mod tests {
         assert_eq!(progress.objects_scanned, 0);
         assert_eq!(progress.objects_healed, 0);
         assert_eq!(progress.objects_failed, 0);
-        assert_eq!(progress.skipped_new_versions, 0);
-        assert_eq!(progress.skipped_ilm_expired, 0);
-        assert_eq!(progress.objects_total_count, 0);
-        assert_eq!(progress.objects_total_size, 0);
         assert_eq!(progress.bytes_processed, 0);
         assert_eq!(progress.progress_percentage, 0.0);
         assert!(progress.start_time.is_some());
@@ -266,73 +181,6 @@ mod tests {
         assert!(progress.last_update_time.is_some());
     }
 
-    #[test]
-    fn test_heal_progress_estimates_completion_time_from_progress() {
-        let mut progress = HealProgress::new();
-        progress.start_time = Some(SystemTime::now() - Duration::from_secs(10));
-
-        progress.update_progress(100, 25, 0, 4096);
-
-        let eta = progress
-            .estimated_completion_time
-            .expect("partial byte progress should estimate completion");
-        assert!(eta > SystemTime::now());
-    }
-
-    #[test]
-    fn test_heal_progress_uses_byte_baseline_for_percentage() {
-        let mut progress = HealProgress::new();
-        progress.set_total_baseline(10, 8192);
-
-        progress.update_progress(100, 25, 0, 4096);
-
-        assert!((progress.progress_percentage - 50.0).abs() < 0.001);
-    }
-
-    #[test]
-    fn test_heal_progress_uses_object_baseline_when_bytes_unknown() {
-        let mut progress = HealProgress::new();
-        progress.set_total_baseline(10, 0);
-
-        progress.update_progress(100, 3, 2, 0);
-
-        assert!((progress.progress_percentage - 50.0).abs() < 0.001);
-    }
-
-    #[test]
-    fn test_heal_progress_counts_skipped_versions_for_object_baseline() {
-        let mut progress = HealProgress::new();
-        progress.set_total_baseline(10, 0);
-
-        progress.update_progress(100, 3, 2, 0);
-        progress.record_skipped_new_version();
-
-        assert_eq!(progress.skipped_new_versions, 1);
-        assert!((progress.progress_percentage - 60.0).abs() < 0.001);
-    }
-
-    #[test]
-    fn test_heal_progress_does_not_estimate_completion_without_bytes() {
-        let mut progress = HealProgress::new();
-        progress.start_time = Some(SystemTime::now() - Duration::from_secs(10));
-
-        progress.update_progress(100, 25, 0, 0);
-
-        assert!(progress.estimated_completion_time.is_none());
-    }
-
-    #[test]
-    fn test_heal_progress_with_baseline_is_not_completed_by_processed_count() {
-        let mut progress = HealProgress::new();
-        progress.start_time = Some(SystemTime::now() - Duration::from_secs(10));
-        progress.set_total_baseline(10, 8192);
-
-        progress.update_progress(1, 1, 0, 1024);
-
-        assert!(!progress.is_completed());
-        assert!(progress.estimated_completion_time.is_some());
-    }
-
     #[test]
     fn test_heal_progress_update_progress_zero_total() {
         let mut progress = HealProgress::new();
@@ -403,8 +251,6 @@ mod tests {
         assert_eq!(json["objectsScanned"], 10);
         assert_eq!(json["objectsHealed"], 8);
         assert_eq!(json["objectsFailed"], 2);
-        assert_eq!(json["skippedNewVersions"], 0);
-        assert_eq!(json["skippedIlmExpired"], 0);
         assert_eq!(json["bytesProcessed"], 1024);
         assert_eq!(json["currentObject"], "test-bucket/test-object");
         assert!(json["progressPercentage"].is_number());

crates/heal/src/heal/storage.rs

@@ -22,7 +22,6 @@ use serde::{Deserialize, Serialize};
 use std::sync::Arc;
 use tracing::{debug, error, warn};
 
-use super::storage_api::owner::{EcstoreHealLifecycleExpiryContext, ecstore_load_admin_data_usage_from_backend_cached};
 use super::storage_api::storage::{
     BucketInfo, BucketOperations, DiskSetSelector, HealOperations as _, ListOperations as _, ObjectIO as _,
     ObjectOperations as _, StorageAdminApi,
@@ -30,37 +29,6 @@ use super::storage_api::storage::{
 use super::{DiskStore, ECStore, Endpoint, HealDiskExt as _, StorageError, resume::ReplacementTargetIdentity};
 pub use super::{HealObjectInfo, HealObjectOptions, HealPutObjReader};
 
-#[derive(Debug, Clone, Copy, Default, PartialEq, Eq)]
-pub struct HealBucketUsageBaseline {
-    pub objects_count: u64,
-    pub bytes: u64,
-}
-
-pub struct HealLifecycleExpiryContext {
-    inner: HealLifecycleExpiryContextInner,
-}
-
-enum HealLifecycleExpiryContextInner {
-    Ecstore(EcstoreHealLifecycleExpiryContext),
-    #[allow(dead_code)]
-    Test,
-}
-
-impl HealLifecycleExpiryContext {
-    fn ecstore(inner: EcstoreHealLifecycleExpiryContext) -> Self {
-        Self {
-            inner: HealLifecycleExpiryContextInner::Ecstore(inner),
-        }
-    }
-
-    #[cfg(test)]
-    pub(crate) fn test() -> Self {
-        Self {
-            inner: HealLifecycleExpiryContextInner::Test,
-        }
-    }
-}
-
 const LOG_COMPONENT_HEAL: &str = "heal";
 const LOG_SUBSYSTEM_STORAGE: &str = "storage";
 const EVENT_HEAL_STORAGE_OBJECT_IO: &str = "heal_storage_object_io";
@@ -304,10 +272,6 @@ pub struct HealListItem {
     pub name: String,
     /// normalized version id (`None` when the version is nil/absent)
     pub version_id: Option<String>,
-    /// version modification time as Unix nanoseconds
-    pub mod_time_unix_nanos: Option<i128>,
-    /// object snapshot for lifecycle evaluation
-    pub lifecycle_object_info: Option<HealObjectInfo>,
     /// whether this version is a delete marker (observability only)
     pub is_delete_marker: bool,
 }
@@ -365,28 +329,6 @@ pub trait HealStorageAPI: Send + Sync {
     /// Get bucket info
     async fn get_bucket_info(&self, bucket: &str) -> Result<Option<BucketInfo>>;
 
-    /// Aggregate usage-cache baselines for the requested buckets.
-    async fn erasure_set_usage_baseline(&self, _buckets: &[String]) -> Result<Option<HealBucketUsageBaseline>> {
-        Ok(None)
-    }
-
-    /// Load per-bucket lifecycle expiry context for heal skips.
-    async fn load_heal_lifecycle_expiry_context(&self, _bucket: &str) -> Result<Option<HealLifecycleExpiryContext>> {
-        Ok(None)
-    }
-
-    /// Queue lifecycle expiry for a version that heal can skip.
-    async fn enqueue_heal_lifecycle_expiry(
-        &self,
-        _context: &HealLifecycleExpiryContext,
-        _bucket: &str,
-        _object: &str,
-        _version_id: Option<&str>,
-        _object_info: Option<&HealObjectInfo>,
-    ) -> Result<bool> {
-        Ok(false)
-    }
-
     /// Fix bucket metadata
     async fn heal_bucket_metadata(&self, bucket: &str) -> Result<()>;
 
@@ -467,7 +409,6 @@ pub trait HealStorageAPI: Send + Sync {
         bucket: &str,
         prefix: &str,
         continuation_token: Option<&str>,
-        include_lifecycle_object_info: bool,
     ) -> Result<(Vec<HealListItem>, Option<String>, bool)>;
 
     /// List versions for healing via a per-erasure-set DISK-WALK union enumerator
@@ -486,10 +427,8 @@ pub trait HealStorageAPI: Send + Sync {
         bucket: &str,
         prefix: &str,
         continuation_token: Option<&str>,
-        include_lifecycle_object_info: bool,
     ) -> Result<(Vec<HealListItem>, Option<String>, bool)> {
-        self.list_objects_for_heal_page(bucket, prefix, continuation_token, include_lifecycle_object_info)
-            .await
+        self.list_objects_for_heal_page(bucket, prefix, continuation_token).await
     }
 
     /// Get disk for resume functionality.
@@ -1082,85 +1021,6 @@ impl HealStorageAPI for ECStoreHealStorage {
         }
     }
 
-    async fn erasure_set_usage_baseline(&self, buckets: &[String]) -> Result<Option<HealBucketUsageBaseline>> {
-        if buckets.is_empty() {
-            return Ok(None);
-        }
-
-        let info = match ecstore_load_admin_data_usage_from_backend_cached(self.ecstore.clone()).await {
-            Ok(info) if info.is_complete_bucket_usage_snapshot() => info,
-            Ok(_) | Err(_) => return Ok(None),
-        };
-
-        let mut baseline = HealBucketUsageBaseline::default();
-        for bucket in buckets {
-            if let Some(usage) = info.buckets_usage.get(bucket) {
-                baseline.objects_count = baseline.objects_count.saturating_add(usage.objects_count);
-                baseline.bytes = baseline.bytes.saturating_add(usage.size);
-            }
-        }
-
-        Ok(Some(baseline))
-    }
-
-    async fn load_heal_lifecycle_expiry_context(&self, bucket: &str) -> Result<Option<HealLifecycleExpiryContext>> {
-        match self.ecstore.load_heal_lifecycle_expiry_context(bucket).await {
-            Ok(Some(context)) => Ok(Some(HealLifecycleExpiryContext::ecstore(context))),
-            Ok(None) => Ok(None),
-            Err(err) => {
-                debug!(
-                    target: "rustfs::heal::storage",
-                    event = EVENT_HEAL_STORAGE_ADMIN_OP,
-                    component = LOG_COMPONENT_HEAL,
-                    subsystem = LOG_SUBSYSTEM_STORAGE,
-                    operation = "load_heal_lifecycle_expiry_context",
-                    bucket,
-                    result = "failed",
-                    error = %err,
-                    "Heal storage lifecycle expiry context load failed"
-                );
-                Ok(None)
-            }
-        }
-    }
-
-    async fn enqueue_heal_lifecycle_expiry(
-        &self,
-        context: &HealLifecycleExpiryContext,
-        bucket: &str,
-        object: &str,
-        version_id: Option<&str>,
-        object_info: Option<&HealObjectInfo>,
-    ) -> Result<bool> {
-        let context = match &context.inner {
-            HealLifecycleExpiryContextInner::Ecstore(context) => context,
-            HealLifecycleExpiryContextInner::Test => return Ok(false),
-        };
-        match self
-            .ecstore
-            .enqueue_heal_lifecycle_expiry(context, bucket, object, version_id, object_info)
-            .await
-        {
-            Ok(queued) => Ok(queued),
-            Err(err) => {
-                debug!(
-                    target: "rustfs::heal::storage",
-                    event = EVENT_HEAL_STORAGE_ADMIN_OP,
-                    component = LOG_COMPONENT_HEAL,
-                    subsystem = LOG_SUBSYSTEM_STORAGE,
-                    operation = "enqueue_heal_lifecycle_expiry",
-                    bucket,
-                    object,
-                    version_id = ?version_id,
-                    result = "failed",
-                    error = %err,
-                    "Heal storage lifecycle expiry check failed"
-                );
-                Ok(false)
-            }
-        }
-    }
-
     async fn heal_bucket_metadata(&self, bucket: &str) -> Result<()> {
         debug!(
             target: "rustfs::heal::storage",
@@ -1576,7 +1436,7 @@ impl HealStorageAPI for ECStoreHealStorage {
 
         loop {
             let (page_objects, next_token, is_truncated) = self
-                .list_objects_for_heal_page(bucket, prefix, continuation_token.as_deref(), false)
+                .list_objects_for_heal_page(bucket, prefix, continuation_token.as_deref())
                 .await?;
 
             all_objects.extend(page_objects);
@@ -1611,7 +1471,6 @@ impl HealStorageAPI for ECStoreHealStorage {
         bucket: &str,
         prefix: &str,
         continuation_token: Option<&str>,
-        include_lifecycle_object_info: bool,
     ) -> Result<(Vec<HealListItem>, Option<String>, bool)> {
         debug!(
             target: "rustfs::heal::storage",
@@ -1663,19 +1522,10 @@ impl HealStorageAPI for ECStoreHealStorage {
         let page_objects: Vec<HealListItem> = list_info
             .objects
             .into_iter()
-            .map(|mut obj| {
-                obj.version_id = obj.version_id.filter(|u| !u.is_nil());
-                let version_id = obj.version_id.map(|u| u.to_string());
-                let mod_time_unix_nanos = obj.mod_time.map(|mod_time| mod_time.unix_timestamp_nanos());
-                let is_delete_marker = obj.delete_marker;
-                let lifecycle_object_info = include_lifecycle_object_info.then(|| obj.clone());
-                HealListItem {
-                    name: obj.name,
-                    version_id,
-                    mod_time_unix_nanos,
-                    lifecycle_object_info,
-                    is_delete_marker,
-                }
+            .map(|obj| HealListItem {
+                name: obj.name,
+                version_id: obj.version_id.filter(|u| !u.is_nil()).map(|u| u.to_string()),
+                is_delete_marker: obj.delete_marker,
             })
             .collect();
         let page_count = page_objects.len();
@@ -1712,7 +1562,6 @@ impl HealStorageAPI for ECStoreHealStorage {
         bucket: &str,
         prefix: &str,
         continuation_token: Option<&str>,
-        include_lifecycle_object_info: bool,
     ) -> Result<(Vec<HealListItem>, Option<String>, bool)> {
         // Per-page bounds for the disk-walk union enumerator. Objects are atomic
         // (never split across pages), so version_budget only bounds how many
@@ -1741,16 +1590,7 @@ impl HealStorageAPI for ECStoreHealStorage {
 
         let (versions, next_forward, is_truncated) = self
             .ecstore
-            .heal_walk_versions_page(
-                pool_idx,
-                set_idx,
-                bucket,
-                prefix,
-                forward_to.as_deref(),
-                BATCH_OBJECTS,
-                VERSION_BUDGET,
-                include_lifecycle_object_info,
-            )
+            .heal_walk_versions_page(pool_idx, set_idx, bucket, prefix, forward_to.as_deref(), BATCH_OBJECTS, VERSION_BUDGET)
             .await
             .map_err(|e| {
                 error!(
@@ -1774,8 +1614,6 @@ impl HealStorageAPI for ECStoreHealStorage {
             .map(|v| HealListItem {
                 name: v.name,
                 version_id: v.version_id,
-                mod_time_unix_nanos: v.mod_time_unix_nanos,
-                lifecycle_object_info: v.lifecycle_object_info,
                 is_delete_marker: v.is_delete_marker,
             })
             .collect();

crates/heal/src/heal/storage_api.rs

@@ -12,10 +12,7 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
-pub(crate) use rustfs_ecstore::api::data_usage::{
-    DATA_USAGE_CACHE_NAME as ECSTORE_DATA_USAGE_CACHE_NAME,
-    load_admin_data_usage_from_backend_cached as ecstore_load_admin_data_usage_from_backend_cached,
-};
+pub(crate) use rustfs_ecstore::api::data_usage::DATA_USAGE_CACHE_NAME as ECSTORE_DATA_USAGE_CACHE_NAME;
 pub(crate) use rustfs_ecstore::api::disk::endpoint::Endpoint as EcstoreEndpoint;
 pub(crate) use rustfs_ecstore::api::disk::error::{DiskError as EcstoreDiskError, Result as EcstoreDiskResult};
 pub(crate) use rustfs_ecstore::api::disk::{
@@ -28,9 +25,7 @@ pub(crate) use rustfs_ecstore::api::disk::{
 pub(crate) use rustfs_ecstore::api::disk::{DiskOption as EcstoreDiskOption, new_disk as ecstore_new_disk};
 pub(crate) use rustfs_ecstore::api::error::{Error as EcstoreErrorType, StorageError as EcstoreStorageError};
 pub(crate) use rustfs_ecstore::api::runtime::local_disk_map_read as ecstore_local_disk_map_read;
-pub(crate) use rustfs_ecstore::api::storage::{
-    ECStore as EcstoreStore, HealLifecycleExpiryContext as EcstoreHealLifecycleExpiryContext,
-};
+pub(crate) use rustfs_ecstore::api::storage::ECStore as EcstoreStore;
 use rustfs_storage_api as storage_contracts;
 
 pub(crate) mod owner {
@@ -39,8 +34,8 @@ pub(crate) mod owner {
     pub(crate) use super::{
         ECSTORE_BUCKET_META_PREFIX, ECSTORE_DATA_USAGE_CACHE_NAME, ECSTORE_HEALING_MARKER_PATH, ECSTORE_RUSTFS_META_BUCKET,
         EcstoreConditionalFileUpdate, EcstoreDeleteOptions, EcstoreDiskAPI, EcstoreDiskBytes, EcstoreDiskError,
-        EcstoreDiskResult, EcstoreDiskStore, EcstoreEndpoint, EcstoreErrorType, EcstoreHealLifecycleExpiryContext,
-        EcstoreStorageError, EcstoreStore, ecstore_load_admin_data_usage_from_backend_cached, ecstore_local_disk_map_read,
+        EcstoreDiskResult, EcstoreDiskStore, EcstoreEndpoint, EcstoreErrorType, EcstoreStorageError, EcstoreStore,
+        ecstore_local_disk_map_read,
     };
 
     #[cfg(test)]

crates/heal/src/heal/task.rs

@@ -19,12 +19,11 @@ use crate::heal::{
     resume::{
         CheckpointManager, ReplacementPhase, ReplacementTargetIdentity, ResumeManager, replacement_target_identities_match,
     },
-    storage::{HealBucketUsageBaseline, HealStorageAPI, next_heal_listing_token},
+    storage::{HealStorageAPI, next_heal_listing_token},
 };
 use crate::{Error, Result};
 use metrics::{counter, histogram};
 use rustfs_common::heal_channel::{HealOpts, HealRequestSource, HealScanMode};
-use rustfs_common::trace_bus::{TraceEvent, TraceFunc, TraceKind, trace_emit};
 use rustfs_madmin::heal_commands::HealResultItem;
 use rustfs_utils::path::SLASH_SEPARATOR;
 use serde::{Deserialize, Serialize};
@@ -32,7 +31,7 @@ use std::{
     future::Future,
     sync::{
         Arc,
-        atomic::{AtomicBool, AtomicU64, Ordering},
+        atomic::{AtomicBool, Ordering},
     },
     time::{Duration, Instant, SystemTime},
 };
@@ -179,17 +178,6 @@ pub enum HealPriority {
     Urgent = 3,
 }
 
-impl HealPriority {
-    fn as_str(self) -> &'static str {
-        match self {
-            Self::Low => "low",
-            Self::Normal => "normal",
-            Self::High => "high",
-            Self::Urgent => "urgent",
-        }
-    }
-}
-
 /// Heal options
 #[derive(Debug, Clone, Serialize, Deserialize)]
 pub struct HealOptions {
@@ -351,20 +339,6 @@ impl HealRequest {
 }
 
 /// Heal task
-/// Incremental view over a task's retained result items (HS-06).
-///
-/// `next_seq` is the cursor a client should pass on its next poll; `min_seq`
-/// is the oldest sequence still retained; `lagged` means the client's cursor
-/// fell behind `min_seq` and items were skipped — the client should restart
-/// from `min_seq`.
-#[derive(Debug, Clone)]
-pub struct HealResultWindow {
-    pub items: Vec<HealResultItem>,
-    pub next_seq: u64,
-    pub min_seq: u64,
-    pub lagged: bool,
-}
-
 pub struct HealTask {
     /// Task ID
     pub id: String,
@@ -387,16 +361,8 @@ pub struct HealTask {
     pub status: Arc<RwLock<HealTaskStatus>>,
     /// Progress tracking
     pub progress: Arc<RwLock<HealProgress>>,
-    /// Result items collected from storage heal calls, each stamped with a
-    /// monotonically increasing sequence number for incremental consumption
-    /// (the client passes the last seen seq back and receives only newer
-    /// items; see `get_result_items_since`).
-    pub result_items: Arc<RwLock<Vec<(u64, HealResultItem)>>>,
-    /// Next sequence number to assign; starts at 1.
-    next_item_seq: Arc<AtomicU64>,
-    /// Sequence number of the oldest item still inside the retention window;
-    /// equals `next_item_seq` while the window is empty.
-    min_available_seq: Arc<AtomicU64>,
+    /// Result items collected from storage heal calls.
+    pub result_items: Arc<RwLock<Vec<HealResultItem>>>,
     result_items_truncated: Arc<AtomicBool>,
     batch_failure: Arc<RwLock<Option<BatchHealFailure>>>,
     batch_failure_recorded: Arc<AtomicBool>,
@@ -448,8 +414,6 @@ impl HealTask {
             status: Arc::new(RwLock::new(HealTaskStatus::Pending)),
             progress: Arc::new(RwLock::new(HealProgress::new())),
             result_items: Arc::new(RwLock::new(Vec::new())),
-            next_item_seq: Arc::new(AtomicU64::new(1)),
-            min_available_seq: Arc::new(AtomicU64::new(1)),
             result_items_truncated: Arc::new(AtomicBool::new(false)),
             batch_failure: Arc::new(RwLock::new(None)),
             batch_failure_recorded: Arc::new(AtomicBool::new(false)),
@@ -534,61 +498,6 @@ impl HealTask {
         }
     }
 
-    fn emit_trace_task_state(&self, state: &'static str, duration: Duration, error: Option<&Error>) {
-        trace_emit(|| {
-            let mut event = TraceEvent::new(TraceKind::Heal, TraceFunc::HealTask)
-                .with_duration(duration)
-                .with_attr("task_id", self.id.as_str())
-                .with_attr("heal_type", self.heal_type.log_kind())
-                .with_attr("state", state)
-                .with_attr("source", self.source.as_str())
-                .with_attr("priority", self.priority.as_str())
-                .with_attr("retry_attempts", u64::from(self.retry_attempts))
-                .with_attr("dry_run", self.options.dry_run);
-
-            event = match &self.heal_type {
-                HealType::Cluster => event,
-                HealType::Object {
-                    bucket,
-                    object,
-                    version_id,
-                } => {
-                    let event = event.with_bucket(bucket.as_str()).with_object(object.as_str());
-                    match version_id {
-                        Some(version_id) => event.with_attr("version_id", version_id.as_str()),
-                        None => event,
-                    }
-                }
-                HealType::Bucket { bucket } => event.with_bucket(bucket.as_str()),
-                HealType::Prefix { bucket, prefix } => event.with_bucket(bucket.as_str()).with_object(prefix.as_str()),
-                HealType::ErasureSet { buckets, set_disk_id } => {
-                    let bucket_count = u64::try_from(buckets.len()).unwrap_or(u64::MAX);
-                    event
-                        .with_attr("set_disk_id", set_disk_id.as_str())
-                        .with_attr("bucket_count", bucket_count)
-                }
-                HealType::Metadata { bucket, object } => event.with_bucket(bucket.as_str()).with_object(object.as_str()),
-                HealType::ECDecode {
-                    bucket,
-                    object,
-                    version_id,
-                } => {
-                    let event = event.with_bucket(bucket.as_str()).with_object(object.as_str());
-                    match version_id {
-                        Some(version_id) => event.with_attr("version_id", version_id.as_str()),
-                        None => event,
-                    }
-                }
-                HealType::MRF { meta_path } => event.with_object(meta_path.as_str()),
-            };
-
-            match error {
-                Some(error) => event.with_attr("error", error.to_string()),
-                None => event,
-            }
-        });
-    }
-
     async fn remaining_timeout(&self) -> Result<Option<Duration>> {
         if let Some(total) = self.options.timeout {
             let start_instant = { *self.task_start_instant.read().await };
@@ -808,7 +717,6 @@ impl HealTask {
             queue_delay = ?queue_delay,
             "Heal task started"
         });
-        self.emit_trace_task_state("started", Duration::ZERO, None);
 
         let result = match &self.heal_type {
             HealType::Cluster => self.heal_cluster().await,
@@ -897,14 +805,6 @@ impl HealTask {
             }
         }
 
-        let terminal_state = match &result {
-            Ok(_) => "completed",
-            Err(Error::TaskCancelled) => "cancelled",
-            Err(Error::TaskTimeout) => "timed_out",
-            Err(_) => "failed",
-        };
-        self.emit_trace_task_state(terminal_state, start_instant.elapsed(), result.as_ref().err());
-
         result
     }
 
@@ -935,63 +835,18 @@ impl HealTask {
     }
 
     pub async fn get_result_items(&self) -> Vec<HealResultItem> {
-        self.result_items.read().await.iter().map(|(_, item)| item.clone()).collect()
-    }
-
-    /// Sequence-stamped retained window, used when archiving a completed
-    /// task so incremental cursors survive the transition (HS-06).
-    pub async fn get_seqed_result_items(&self) -> Vec<(u64, HealResultItem)> {
         self.result_items.read().await.clone()
     }
 
-    /// Incremental result window (HS-06): `since = None` returns the full
-    /// retained window (legacy snapshot semantics); `since = Some(seq)`
-    /// returns only items stamped with a sequence greater than `seq`.
-    /// `lagged` warns that the caller's cursor fell behind the window start
-    /// and items were skipped (the response carries `min_seq` as the catch-up
-    /// cursor).
-    pub async fn get_result_items_since(&self, since: Option<u64>) -> HealResultWindow {
-        let result_items = self.result_items.read().await;
-        let next_seq = self.next_item_seq.load(Ordering::Relaxed);
-        let min_seq = self.min_available_seq.load(Ordering::Relaxed);
-        let mut lagged = false;
-        let items = match since {
-            None => result_items.iter().map(|(_, item)| item.clone()).collect::<Vec<_>>(),
-            Some(cursor) => {
-                if cursor + 1 < min_seq {
-                    lagged = true;
-                }
-                result_items
-                    .iter()
-                    .filter(|(seq, _)| *seq > cursor)
-                    .map(|(_, item)| item.clone())
-                    .collect::<Vec<_>>()
-            }
-        };
-        HealResultWindow {
-            items,
-            next_seq,
-            min_seq,
-            lagged,
-        }
-    }
-
     pub fn result_items_truncated(&self) -> bool {
         self.result_items_truncated.load(Ordering::Relaxed)
     }
 
     async fn record_result_item(&self, result: HealResultItem) {
-        let seq = self.next_item_seq.fetch_add(1, Ordering::Relaxed);
         let mut result_items = self.result_items.write().await;
         if result_items.len() < MAX_RETAINED_HEAL_RESULT_ITEMS {
-            result_items.push((seq, result));
+            result_items.push(result);
         } else {
-            // Slide the window: the oldest item leaves and the cursor for the
-            // oldest still-available item moves forward with it.
-            result_items.remove(0);
-            self.min_available_seq
-                .store(result_items.first().map_or(seq, |(oldest, _)| *oldest), Ordering::Relaxed);
-            result_items.push((seq, result));
             self.result_items_truncated.store(true, Ordering::Relaxed);
         }
     }
@@ -1680,7 +1535,7 @@ impl HealTask {
             let (objects, next_token, is_truncated) = self
                 .await_with_control(
                     self.storage
-                        .list_objects_for_heal_page(bucket, prefix, continuation_token.as_deref(), false),
+                        .list_objects_for_heal_page(bucket, prefix, continuation_token.as_deref()),
                 )
                 .await?;
 
@@ -1842,23 +1697,6 @@ impl HealTask {
         Ok(())
     }
 
-    async fn apply_erasure_set_usage_baseline(&self, buckets: &[String]) -> Result<()> {
-        let baseline = match self
-            .await_with_control(self.storage.erasure_set_usage_baseline(buckets))
-            .await
-        {
-            Ok(Some(baseline)) => baseline,
-            Ok(None) => return Ok(()),
-            Err(err @ Error::TaskCancelled) | Err(err @ Error::TaskTimeout) => return Err(err),
-            Err(_) => return Ok(()),
-        };
-
-        let HealBucketUsageBaseline { objects_count, bytes } = baseline;
-        let mut progress = self.progress.write().await;
-        progress.set_total_baseline(objects_count, bytes);
-        Ok(())
-    }
-
     async fn heal_metadata(&self, bucket: &str, object: &str) -> Result<()> {
         debug!(
             target: "rustfs::heal::task",
@@ -2460,8 +2298,6 @@ impl HealTask {
             None
         };
 
-        self.apply_erasure_set_usage_baseline(&buckets).await?;
-
         let healing_marker = format!("{set_disk_id}:{}", self.id);
         if let Some((disk, resume_manager, _)) = replacement_resume.as_ref() {
             let state = resume_manager.get_state().await;
@@ -2766,8 +2602,7 @@ impl HealTask {
 
         {
             let mut progress = self.progress.write().await;
-            let bytes_processed = progress.bytes_processed;
-            progress.update_progress(4, 4, 0, bytes_processed);
+            progress.update_progress(4, 4, 0, 0);
         }
 
         match result {
@@ -2823,7 +2658,6 @@ mod tests {
     use super::super::{DiskOption, DiskStore, Endpoint, HealDiskExt as _, new_disk};
     use super::*;
     use crate::heal::storage::{DiskStatus, HealListItem, HealObjectInfo};
-    use rustfs_common::trace_bus::{TraceEvent, TraceFunc, TraceKind, TraceSubscription, TraceVal, subscribe_trace_events};
     use rustfs_madmin::heal_commands::{HealDriveInfo, HealResultItem, Infos};
     use std::collections::{HashMap, VecDeque};
     use std::sync::Mutex;
@@ -3369,8 +3203,6 @@ mod tests {
         block_heal_object: Mutex<bool>,
         resume_disk: Mutex<Option<DiskStore>>,
         replacement_resume_disk: Mutex<Option<DiskStore>>,
-        usage_baseline: Mutex<Option<HealBucketUsageBaseline>>,
-        usage_baseline_error: Mutex<bool>,
     }
 
     #[test]
@@ -3433,69 +3265,11 @@ mod tests {
         assert_eq!(samples_logged, MAX_BUCKET_FAILURE_LOG_SAMPLES);
     }
 
-    #[tokio::test]
-    async fn execute_emits_heal_trace_task_state() {
-        let mut trace = subscribe_trace_events();
-        let storage = Arc::new(MockStorage::default());
-        let task = HealTask::from_request(
-            HealRequest::object("bucket-a".to_string(), "object-a".to_string(), Some("version-a".to_string())),
-            storage,
-        );
-
-        task.execute().await.expect("mock object heal should complete");
-
-        let started = recv_trace_task_state(&mut trace, &task.id, "started").await;
-        assert_eq!(started.kind, TraceKind::Heal);
-        assert_eq!(started.func, TraceFunc::HealTask);
-        assert_eq!(started.bucket.as_deref(), Some("bucket-a"));
-        assert_eq!(started.object.as_deref(), Some("object-a"));
-        assert_eq!(trace_attr_string(&started, "heal_type").as_deref(), Some("object"));
-        assert_eq!(trace_attr_string(&started, "source").as_deref(), Some("internal"));
-        assert_eq!(trace_attr_string(&started, "version_id").as_deref(), Some("version-a"));
-
-        let completed = recv_trace_task_state(&mut trace, &task.id, "completed").await;
-        assert_eq!(completed.kind, TraceKind::Heal);
-        assert_eq!(completed.func, TraceFunc::HealTask);
-        assert_eq!(trace_attr_string(&completed, "state").as_deref(), Some("completed"));
-    }
-
-    async fn recv_trace_task_state(trace: &mut TraceSubscription, task_id: &str, state: &str) -> TraceEvent {
-        for _ in 0..32 {
-            let event = tokio::time::timeout(Duration::from_secs(1), trace.recv())
-                .await
-                .expect("trace event should arrive")
-                .expect("trace bus should stay open");
-            if trace_attr_string(&event, "task_id").as_deref() == Some(task_id)
-                && trace_attr_string(&event, "state").as_deref() == Some(state)
-            {
-                return (*event).clone();
-            }
-        }
-
-        panic!("expected trace state {state} for task {task_id}");
-    }
-
-    fn trace_attr_string(event: &TraceEvent, key: &str) -> Option<String> {
-        event.attrs.iter().find_map(|attr| {
-            if attr.key != key {
-                return None;
-            }
-            Some(match &attr.value {
-                TraceVal::Bool(value) => value.to_string(),
-                TraceVal::U64(value) => value.to_string(),
-                TraceVal::I64(value) => value.to_string(),
-                TraceVal::Str(value) => value.to_string(),
-            })
-        })
-    }
-
     /// Build a latest, non-delete-marker heal list item with no version id.
     fn heal_item(name: &str) -> HealListItem {
         HealListItem {
             name: name.to_string(),
             version_id: None,
-            mod_time_unix_nanos: None,
-            lifecycle_object_info: None,
             is_delete_marker: false,
         }
     }
@@ -3583,13 +3357,6 @@ mod tests {
             }))
         }
 
-        async fn erasure_set_usage_baseline(&self, _buckets: &[String]) -> Result<Option<HealBucketUsageBaseline>> {
-            if *self.usage_baseline_error.lock().unwrap() {
-                return Err(Error::Other("usage baseline unavailable".to_string()));
-            }
-            Ok(*self.usage_baseline.lock().unwrap())
-        }
-
         async fn heal_bucket_metadata(&self, _bucket: &str) -> Result<()> {
             Ok(())
         }
@@ -3773,7 +3540,6 @@ mod tests {
             bucket: &str,
             prefix: &str,
             continuation_token: Option<&str>,
-            _include_lifecycle_object_info: bool,
         ) -> Result<(Vec<HealListItem>, Option<String>, bool)> {
             self.listed_prefixes.lock().unwrap().push(prefix.to_string());
             if *self.truncate_without_token.lock().unwrap() {
@@ -3949,69 +3715,6 @@ mod tests {
         assert!(task.result_items_truncated());
     }
 
-    // HS-06 (backlog#1870): incremental result windows.
-    #[tokio::test]
-    async fn result_items_seq_is_monotonic_and_incremental_slices_work() {
-        let storage = Arc::new(MockStorage::default());
-        let task = HealTask::from_request(HealRequest::bucket("bucket-a".to_string()), storage);
-
-        for round in 0..5u64 {
-            let item = HealResultItem {
-                object_size: round as usize,
-                ..Default::default()
-            };
-            task.record_result_item(item).await;
-        }
-
-        let full = task.get_result_items_since(None).await;
-        assert_eq!(full.items.len(), 5, "None keeps the full-snapshot semantics");
-        assert_eq!(full.next_seq, 6, "next_seq is one past the last assigned");
-        assert_eq!(full.min_seq, 1, "nothing was evicted yet");
-        assert!(!full.lagged);
-
-        // Incremental: only items newer than the cursor.
-        let incremental = task.get_result_items_since(Some(3)).await;
-        assert_eq!(
-            incremental.items.iter().map(|item| item.object_size).collect::<Vec<_>>(),
-            vec![3, 4],
-            "only sequences greater than the cursor are returned"
-        );
-        assert_eq!(incremental.next_seq, 6);
-
-        // A cursor at the head is not lagging.
-        assert!(!task.get_result_items_since(Some(0)).await.lagged);
-    }
-
-    #[tokio::test]
-    async fn result_items_window_slide_moves_min_seq_and_flags_lagging_cursors() {
-        let storage = Arc::new(MockStorage::default());
-        let task = HealTask::from_request(HealRequest::bucket("bucket-a".to_string()), storage);
-
-        // Fill the window completely, then push two more items: seq 1 and 2
-        // are evicted by the slide.
-        for _ in 0..(MAX_RETAINED_HEAL_RESULT_ITEMS + 2) {
-            task.record_result_item(HealResultItem::default()).await;
-        }
-
-        let full = task.get_result_items_since(None).await;
-        assert_eq!(full.items.len(), MAX_RETAINED_HEAL_RESULT_ITEMS);
-        assert_eq!(full.min_seq, 3, "each evicted head item moved the oldest-available cursor");
-        assert!(task.result_items_truncated());
-
-        // A client still polling from before the eviction is lagging.
-        let lagging = task.get_result_items_since(Some(0)).await;
-        assert!(lagging.lagged, "a cursor behind min_seq must be flagged");
-        assert_eq!(lagging.min_seq, 3, "the response tells the client where to restart");
-
-        // A cursor inside the window is fine.
-        assert!(!task.get_result_items_since(Some(3)).await.lagged);
-
-        // The lagging client restarts from min_seq and gets the full window.
-        let catch_up = task.get_result_items_since(Some(3)).await;
-        assert_eq!(catch_up.items.len(), MAX_RETAINED_HEAL_RESULT_ITEMS - 1);
-        assert!(!catch_up.lagged);
-    }
-
     #[tokio::test]
     async fn test_recursive_bucket_heal_skips_object_dir_candidates() {
         let storage = Arc::new(MockStorage {
@@ -4951,73 +4654,6 @@ mod tests {
         assert!(storage.object_heal_opts.lock().unwrap().is_empty());
     }
 
-    #[tokio::test]
-    async fn erasure_set_heal_applies_usage_baseline_to_progress() {
-        let temp = TempDir::new().expect("temporary directory should be created");
-        let disk = make_resume_disk(&temp).await;
-        let storage = Arc::new(MockStorage {
-            resume_disk: Mutex::new(Some(disk)),
-            usage_baseline: Mutex::new(Some(HealBucketUsageBaseline {
-                objects_count: 10,
-                bytes: 8,
-            })),
-            ..Default::default()
-        });
-        let request = HealRequest::new(
-            HealType::ErasureSet {
-                buckets: vec!["bucket-a".to_string()],
-                set_disk_id: "pool_0_set_0".to_string(),
-            },
-            HealOptions {
-                timeout: None,
-                ..Default::default()
-            },
-            HealPriority::Normal,
-        );
-        let task = HealTask::from_request(request, storage);
-
-        task.heal_erasure_set(vec!["bucket-a".to_string()], "pool_0_set_0".to_string())
-            .await
-            .expect("erasure set heal should complete");
-
-        let progress = task.get_progress().await;
-        assert_eq!(progress.objects_total_count, 10);
-        assert_eq!(progress.objects_total_size, 8);
-        assert_eq!(progress.bytes_processed, 2);
-        assert!((progress.progress_percentage - 25.0).abs() < 0.001);
-    }
-
-    #[tokio::test]
-    async fn erasure_set_heal_ignores_usage_baseline_errors() {
-        let temp = TempDir::new().expect("temporary directory should be created");
-        let disk = make_resume_disk(&temp).await;
-        let storage = Arc::new(MockStorage {
-            resume_disk: Mutex::new(Some(disk)),
-            usage_baseline_error: Mutex::new(true),
-            ..Default::default()
-        });
-        let request = HealRequest::new(
-            HealType::ErasureSet {
-                buckets: vec!["bucket-a".to_string()],
-                set_disk_id: "pool_0_set_0".to_string(),
-            },
-            HealOptions {
-                timeout: None,
-                ..Default::default()
-            },
-            HealPriority::Normal,
-        );
-        let task = HealTask::from_request(request, storage);
-
-        task.heal_erasure_set(vec!["bucket-a".to_string()], "pool_0_set_0".to_string())
-            .await
-            .expect("usage baseline failures should not fail erasure set heal");
-
-        let progress = task.get_progress().await;
-        assert_eq!(progress.objects_total_count, 0);
-        assert_eq!(progress.objects_total_size, 0);
-    }
-
     #[tokio::test]
     async fn resumable_erasure_set_execution_is_cancelled_while_object_heal_is_pending() {
         let temp = TempDir::new().expect("temporary directory should be created");

crates/heal/src/lib.rs

@@ -158,10 +158,6 @@ pub async fn init_heal_manager_with_workload_provider(
             return Err(err);
         }
 
-        // Start the MRF intent consumer (error-path repair intents + durable
-        // journal replay) now that the manager can accept submissions.
-        heal::mrf_queue::spawn_mrf_consumer(heal_manager.clone());
-
         #[cfg(test)]
         test_hook_after_manager_start().await;
 
@@ -449,7 +445,6 @@ mod tests {
             _bucket: &str,
             _prefix: &str,
             _continuation_token: Option<&str>,
-            _include_lifecycle_object_info: bool,
         ) -> Result<(Vec<HealListItem>, Option<String>, bool), Error> {
             Ok((Vec::new(), None, false))
         }

crates/heal/tests/heal_b5_versioned_regression_test.rs

@@ -176,7 +176,7 @@ async fn enumerate_all_versions(heal_storage: &Arc<ECStoreHealStorage>, bucket:
     let mut token: Option<String> = None;
     loop {
         let (page, next, truncated) = heal_storage
-            .list_objects_for_heal_page(bucket, "", token.as_deref(), false)
+            .list_objects_for_heal_page(bucket, "", token.as_deref())
             .await
             .expect("list_objects_for_heal_page failed");
         items.extend(page);

crates/heal/tests/heal_b920_subquorum_union_test.rs

@@ -166,7 +166,7 @@ async fn enumerate_b5(heal_storage: &Arc<ECStoreHealStorage>, bucket: &str) -> V
     let mut token: Option<String> = None;
     loop {
         let (page, next, truncated) = heal_storage
-            .list_objects_for_heal_page(bucket, "", token.as_deref(), false)
+            .list_objects_for_heal_page(bucket, "", token.as_deref())
             .await
             .expect("b5 list page failed");
         items.extend(page);
@@ -187,7 +187,7 @@ async fn enumerate_disk_walk(heal_storage: &Arc<ECStoreHealStorage>, bucket: &st
     let mut token: Option<String> = None;
     loop {
         let (page, next, truncated) = heal_storage
-            .list_versions_for_heal_page_disk_walk(SET_DISK_ID, bucket, "", token.as_deref(), false)
+            .list_versions_for_heal_page_disk_walk(SET_DISK_ID, bucket, "", token.as_deref())
             .await
             .expect("disk-walk list page failed");
         items.extend(page);
@@ -418,7 +418,7 @@ mod serial_tests {
         let mut pages = 0usize;
         loop {
             let (versions, next_forward, truncated) = ecstore
-                .heal_walk_versions_page(0, 0, bucket, "", forward.as_deref(), 2, 100_000, false)
+                .heal_walk_versions_page(0, 0, bucket, "", forward.as_deref(), 2, 100_000)
                 .await
                 .expect("heal_walk_versions_page failed");
             pages += 1;

crates/heal/tests/heal_bug_fixes_test.rs

@@ -242,7 +242,6 @@ fn test_heal_task_status_atomic_update() {
             _bucket: &str,
             _prefix: &str,
             _continuation_token: Option<&str>,
-            _include_lifecycle_object_info: bool,
         ) -> rustfs_heal::Result<(Vec<HealListItem>, Option<String>, bool)> {
             Ok((vec![], None, false))
         }
@@ -386,7 +385,6 @@ async fn test_heal_task_transient_object_exists_skip_avoids_recreate() {
             _bucket: &str,
             _prefix: &str,
             _continuation_token: Option<&str>,
-            _include_lifecycle_object_info: bool,
         ) -> rustfs_heal::Result<(Vec<HealListItem>, Option<String>, bool)> {
             Ok((Vec::new(), None, false))
         }

crates/heal/tests/mrf_pipeline_test.rs

@@ -1,189 +0,0 @@
-// Copyright 2024 RustFS Team
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-//! HS-01 (rustfs/backlog#1865): MRF intent pipeline integration tests.
-//!
-//! Drives the real consumer loop (`spawn_mrf_consumer`) against a real
-//! 4-disk `ECStore` heal storage and a `HealManager` that has not started its
-//! scheduler, so submitted intents stay observable in the admission queue.
-//! Under `cargo nextest` each test runs in its own process, which keeps the
-//! process-global MRF channel singleton safe.
-
-use rustfs_common::mrf_channel::{self, MrfKind};
-use rustfs_heal::heal::{
-    manager::{HealConfig, HealManager},
-    mrf_queue,
-    storage::{ECStoreHealStorage, HealStorageAPI},
-};
-use serial_test::serial;
-use std::{path::Path, sync::Arc, time::Duration};
-
-mod storage_api;
-
-use storage_api::endpoint_index::{Endpoint, EndpointServerPools, Endpoints, PoolEndpoints, init_local_disks};
-
-const META_BUCKET: &str = ".rustfs.sys";
-const JOURNAL_REL: &str = "buckets/.heal/mrf/journal.bin";
-
-async fn heal_env() -> (Vec<std::path::PathBuf>, Arc<dyn HealStorageAPI>) {
-    let env = rustfs_test_utils::TestECStoreEnv::builder()
-        .prefix("rustfs_heal_mrf_test")
-        .build()
-        .await;
-    let heal_storage: Arc<dyn HealStorageAPI> = Arc::new(ECStoreHealStorage::new(env.ecstore.clone()));
-    (env.disk_paths, heal_storage)
-}
-
-fn make_manager(storage: Arc<dyn HealStorageAPI>) -> Arc<HealManager> {
-    Arc::new(HealManager::new(
-        storage,
-        Some(HealConfig {
-            // Keep the scheduler from draining the queue before assertions.
-            heal_interval: Duration::from_secs(3600),
-            enable_auto_heal: false,
-            ..Default::default()
-        }),
-    ))
-}
-
-/// Encode one journal record independently of the implementation, so a format
-/// drift between writer and this fixture fails loudly here.
-fn journal_record(kind: u8, bucket: &str, object: &str, version: Option<[u8; 16]>, attempts: u8) -> Vec<u8> {
-    let mut body = vec![1u8, 1, kind, attempts];
-    body.extend_from_slice(&1_700_000_000_000u64.to_le_bytes());
-    match version {
-        Some(bytes) => {
-            body.push(1);
-            body.extend_from_slice(&bytes);
-        }
-        None => body.push(0),
-    }
-    body.extend_from_slice(&(bucket.len() as u32).to_le_bytes());
-    body.extend_from_slice(&(object.len() as u32).to_le_bytes());
-    body.extend_from_slice(bucket.as_bytes());
-    body.extend_from_slice(object.as_bytes());
-    let mut hasher = crc_fast::Digest::new(crc_fast::CrcAlgorithm::Crc32IsoHdlc);
-    hasher.update(&body);
-    body.extend_from_slice(&(hasher.finalize() as u32).to_le_bytes());
-    body
-}
-
-fn write_journal_to_disks(disk_paths: &[std::path::PathBuf], data: &[u8]) {
-    for path in disk_paths {
-        let journal = path.join(META_BUCKET).join(JOURNAL_REL);
-        std::fs::create_dir_all(journal.parent().expect("journal parent")).expect("create journal dir");
-        std::fs::write(&journal, data).expect("write journal fixture");
-    }
-}
-
-async fn wait_until<F, Fut>(deadline: Duration, mut probe: F) -> bool
-where
-    F: FnMut() -> Fut,
-    Fut: std::future::Future<Output = bool>,
-{
-    let start = std::time::Instant::now();
-    while start.elapsed() < deadline {
-        if probe().await {
-            return true;
-        }
-        tokio::time::sleep(Duration::from_millis(50)).await;
-    }
-    false
-}
-
-/// A decode-failure intent delivered on the global channel must surface in the
-/// heal manager as an Urgent request attributed to the MRF source.
-#[tokio::test]
-#[serial]
-async fn decode_failure_intent_maps_to_urgent_mrf_heal_request() {
-    let (_disk_paths, storage) = heal_env().await;
-    let manager = make_manager(storage);
-
-    mrf_queue::spawn_mrf_consumer(manager.clone());
-
-    assert!(
-        mrf_channel::try_send_mrf_intent(MrfKind::DecodeFailure, "mrf-bucket", "mrf-object", None),
-        "intent should be accepted while the consumer holds the channel"
-    );
-
-    let appeared = wait_until(Duration::from_secs(10), || async {
-        let snapshot = manager.operations_snapshot().await;
-        snapshot.queued_by_source.mrf >= 1 && snapshot.queued_by_priority.urgent >= 1
-    })
-    .await;
-    assert!(
-        appeared,
-        "MRF intent must reach the manager queue as an Urgent request (snapshot: {:?})",
-        manager.operations_snapshot().await
-    );
-}
-
-/// A journal left behind by a previous process must be replayed into the
-/// manager queue and then removed, and a torn tail must not block replay of
-/// the intact records.
-#[tokio::test(flavor = "multi_thread", worker_threads = 4)]
-#[serial]
-async fn journal_replay_arms_intents_and_deletes_the_file() {
-    let (disk_paths, storage) = heal_env().await;
-
-    // The journal reader resolves disks through the process-local disk map;
-    // register the environment's disks the same way server startup does.
-    let mut endpoints: Vec<Endpoint> = disk_paths
-        .iter()
-        .map(|p| Endpoint::try_from(p.to_string_lossy().as_ref()).expect("endpoint from disk path"))
-        .collect();
-    for (i, endpoint) in endpoints.iter_mut().enumerate() {
-        endpoint.set_pool_index(0);
-        endpoint.set_set_index(0);
-        endpoint.set_disk_index(i);
-    }
-    let pool = PoolEndpoints {
-        legacy: false,
-        set_count: 1,
-        drives_per_set: endpoints.len(),
-        endpoints: Endpoints::from(endpoints),
-        cmd_line: "mrf-test".to_string(),
-        platform: String::new(),
-    };
-    init_local_disks(EndpointServerPools::from(vec![pool]))
-        .await
-        .expect("local disks should register");
-
-    let mut journal = journal_record(1, "replay-bucket", "replay-object", Some([9u8; 16]), 0);
-    journal.extend(journal_record(3, "replay-bucket", "partial-object", None, 1));
-    // Torn tail: a third record truncated mid-way must not block the two
-    // intact records above.
-    journal.extend_from_slice(&journal_record(2, "replay-bucket", "metadata-object", None, 0)[..8]);
-    write_journal_to_disks(&disk_paths, &journal);
-
-    let manager = make_manager(storage);
-    // Replay directly (not via the process-global channel consumer, which the
-    // sibling test already claimed in this process under plain `cargo test`).
-    let replayed = mrf_queue::replay_journal_once(&manager).await;
-    assert_eq!(replayed, 2, "the two intact records must be replayed");
-
-    let snapshot = manager.operations_snapshot().await;
-    assert_eq!(snapshot.queued_by_source.mrf, 2, "replayed intents must be attributed to the MRF source");
-
-    assert!(
-        disk_paths
-            .iter()
-            .all(|path| !Path::new(path).join(META_BUCKET).join(JOURNAL_REL).exists()),
-        "the journal file must be removed after a successful replay"
-    );
-
-    let snapshot = manager.operations_snapshot().await;
-    assert_eq!(snapshot.queued_by_priority.urgent, 1, "the decode-failure record must replay as Urgent");
-    assert!(snapshot.queued_by_priority.normal >= 1, "the partial-write record must replay as Normal");
-}

crates/io-core/CHANGELOG.md

@@ -9,9 +9,6 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Removed
 
-#### rustfs-io-core
-- **Zero-consumer modules** (added in 0.0.5): `reader`, `writer`, `bufreader_optimizer`, `shared_memory`, `direct_io`, `timeout_wrapper`, `io_priority_queue`, and `scheduler` had no caller in the workspace and were removed (rustfs/backlog#1824). The scheduling algorithm and the request timeout wrapper that RustFS actually runs live in `rustfs/src/storage/`; this crate keeps the config shapes they project into. `OperationProgress` moved to the new `progress` module and is still exported as `rustfs_io_core::OperationProgress`.
-
 #### rustfs-io-metrics
 - **Unified configuration** (added in 0.0.5): the zero-consumer `IoConfig`, `CacheSettings`, `IoSchedulerSettings`, `BackpressureSettings`, `TimeoutSettings`, `DeadlockDetectionSettings` types and their `DEFAULT_*` constants were removed (rustfs/rustfs#6008); rustfs-io-core's `IoSchedulerConfig`/`BackpressureConfig` remain the canonical configuration types.
 

crates/io-core/Cargo.toml

@@ -20,8 +20,8 @@ license.workspace = true
 repository.workspace = true
 rust-version.workspace = true
 homepage.workspace = true
-description = "Shared I/O primitives for RustFS (buffer pool, storage profiling, backpressure, deadlock detection)"
-keywords = ["io", "buffer", "pool", "rustfs", "backpressure"]
+description = "Buffered I/O reader and writer implementations for RustFS (mmap-then-copy, aligned pread)"
+keywords = ["io", "reader", "writer", "rustfs", "mmap"]
 categories = ["development-tools", "filesystem"]
 
 [lints]
@@ -38,6 +38,7 @@ hotpath.workspace = true
 bytes = { workspace = true, features = ["serde"] }
 thiserror = { workspace = true }
 tokio = { workspace = true, features = ["io-util", "fs", "sync", "rt-multi-thread"] }
+memmap2 = { workspace = true }
 rustfs-io-metrics = { workspace = true }
 tracing = { workspace = true }
 

crates/io-core/README.md

@@ -23,20 +23,67 @@
 
 ## Overview
 
-**rustfs-io-core** holds the shared I/O primitives for [RustFS](https://rustfs.com), a distributed object storage system. It provides:
+**rustfs-io-core** is the core I/O scheduling module for [RustFS](https://rustfs.com), a distributed object storage system. It provides:
 
-- **Buffer Pool**: Tiered `BytesPool` for buffer reuse
-- **Storage Profiling**: Storage-media and access-pattern model (`io_profile`)
-- **Scheduler Configuration**: The `IoSchedulerConfig` / `IoPriorityQueueConfig` shapes the storage layer projects into
+- **I/O Scheduler**: Adaptive buffer size calculation and load management
+- **Priority Queue**: Request priority scheduling with starvation prevention
 - **Backpressure Control**: System overload protection with graceful degradation
 - **Deadlock Detection**: Wait-for graph based deadlock detection algorithm
 - **Lock Optimizer**: Adaptive spin lock optimization
-- **Progress Tracking**: Byte progress and staleness for long-running operations
-
-The scheduling algorithm itself lives in `rustfs/src/storage/concurrency/io_schedule.rs`; this crate carries the configuration shapes it projects into, not a second implementation.
+- **Timeout Wrapper**: Dynamic timeout calculation and operation progress tracking
 
 ## Features
 
+### I/O Scheduler
+
+Adaptive I/O scheduling with dynamic buffer size calculation based on file size, access pattern, and system load:
+
+```rust
+use rustfs_io_core::{IoScheduler, IoSchedulerConfig, IoLoadLevel};
+use rustfs_io_core::io_profile::{StorageMedia, AccessPattern};
+
+// Create scheduler
+let config = IoSchedulerConfig {
+    max_concurrent_reads: 64,
+    base_buffer_size: 64 * 1024,  // 64 KB
+    max_buffer_size: 1024 * 1024, // 1 MB
+    ..Default::default()
+};
+let scheduler = IoScheduler::new(config);
+
+// Calculate optimal buffer size
+let buffer_size = calculate_optimal_buffer_size(
+    10 * 1024 * 1024,  // 10 MB file
+    64 * 1024,         // base buffer
+    true,              // sequential access
+    4,                 // concurrent requests
+    StorageMedia::Ssd,
+    IoLoadLevel::Low,
+);
+```
+
+### Priority Queue
+
+Priority queue with starvation prevention:
+
+```rust
+use rustfs_io_core::{IoPriorityQueue, IoPriority, IoQueueStatus};
+
+let queue = IoPriorityQueue::<()>::new(100);
+
+// Enqueue request
+let request_id = queue.enqueue(IoPriority::High, (), 1024);
+
+// Dequeue request
+if let Some((priority, data)) = queue.dequeue() {
+    println!("Processing priority {:?} request", priority);
+}
+
+// Check queue status
+let status = queue.status();
+println!("High priority waiting: {}", status.high_priority_waiting);
+```
+
 ### Backpressure Control
 
 System overload protection:
@@ -101,23 +148,71 @@ let stats = optimizer.stats();
 println!("Locks acquired: {}", stats.total_acquired());
 ```
 
-### Progress Tracking
+### Timeout Wrapper
 
-Byte progress and staleness for long-running operations:
+Dynamic timeout calculation:
 
 ```rust
-use rustfs_io_core::OperationProgress;
+use rustfs_io_core::{RequestTimeoutWrapper, TimeoutConfig};
 use std::time::Duration;
 
-let progress = OperationProgress::new(Some(1000), Duration::from_secs(5));
+let config = TimeoutConfig {
+    base_timeout: Duration::from_secs(5),
+    timeout_per_mb: Duration::from_millis(100),
+    max_timeout: Duration::from_secs(300),
+    ..Default::default()
+};
+let wrapper = RequestTimeoutWrapper::new(config);
 
-progress.update(500);
-assert_eq!(progress.progress_percent(), Some(50.0));
-assert!(!progress.is_stale());
+// Calculate operation timeout
+let timeout = wrapper.calculate_timeout(10 * 1024 * 1024);  // 10 MB
+```
+
+## Buffer Size Calculation
+
+Multiple buffer size calculation functions are provided:
+
+```rust
+use rustfs_io_core::{
+    get_concurrency_aware_buffer_size,
+    get_advanced_buffer_size,
+    get_buffer_size_for_media,
+    calculate_optimal_buffer_size,
+    KI_B, MI_B,
+};
+use rustfs_io_core::io_profile::StorageMedia;
+
+// Basic calculation
+let size1 = get_concurrency_aware_buffer_size(1024 * 1024, 64 * 1024);
+
+// Advanced calculation (considering access pattern)
+let size2 = get_advanced_buffer_size(10 * 1024 * 1024, 64 * 1024, true);
+
+// Media type optimization
+let size3 = get_buffer_size_for_media(64 * 1024, StorageMedia::Ssd);
+
+// Comprehensive calculation
+let size4 = calculate_optimal_buffer_size(
+    100 * 1024 * 1024,  // 100 MB file
+    64 * 1024,          // base buffer
+    true,               // sequential access
+    4,                  // concurrent requests
+    StorageMedia::Nvme,
+    IoLoadLevel::Low,
+);
 ```
 
 ## Configuration
 
+### Environment Variables
+
+| Variable | Description | Default |
+|----------|-------------|---------|
+| `RUSTFS_MAX_CONCURRENT_READS` | Max concurrent reads | 64 |
+| `RUSTFS_BASE_BUFFER_SIZE` | Base buffer size | 65536 |
+| `RUSTFS_MAX_BUFFER_SIZE` | Max buffer size | 1048576 |
+| `RUSTFS_IO_TIMEOUT_SECS` | I/O timeout seconds | 30 |
+
 ### Code Configuration
 
 ```rust
@@ -145,11 +240,12 @@ rustfs-io-core/
 ├── src/
 │   ├── lib.rs              # Module entry
 │   ├── config.rs           # Configuration types
-│   ├── pool.rs             # Tiered buffer pool
+│   ├── scheduler.rs        # I/O scheduler
+│   ├── io_priority_queue.rs # Priority queue
 │   ├── backpressure.rs     # Backpressure control
 │   ├── deadlock_detector.rs # Deadlock detection
 │   ├── lock_optimizer.rs   # Lock optimization
-│   ├── progress.rs         # Operation progress tracking
+│   ├── timeout_wrapper.rs  # Timeout wrapper
 │   └── io_profile.rs       # I/O profile
 └── Cargo.toml
 ```
@@ -158,15 +254,21 @@ rustfs-io-core/
 
 ```bash
 # Run all tests
-cargo nextest run --package rustfs-io-core
+cargo test --package rustfs-io-core
 
 # Run specific tests
-cargo nextest run --package rustfs-io-core -E 'test(backpressure)'
+cargo test --package rustfs-io-core --lib scheduler
+
+# Run benchmarks
+cargo bench --package rustfs-io-core
 ```
 
 ## Documentation
 
 - [API Documentation](https://docs.rs/rustfs-io-core)
+- [I/O Scheduler Design](./docs/scheduler-design.md)
+- [Backpressure Control Design](./docs/backpressure-design.md)
+- [Deadlock Detection Algorithm](./docs/deadlock-detection.md)
 
 ## Related Modules
 

crates/io-core/README_zh.md

@@ -23,20 +23,71 @@
 
 ## 📖 概述
 
-**rustfs-io-core** 是 [RustFS](https://rustfs.com) 分布式对象存储系统的共享 I/O 基础组件。它提供了：
+**rustfs-io-core** 是 [RustFS](https://rustfs.com) 分布式对象存储系统的核心 I/O 调度模块。它提供了：
 
-- **缓冲池**：分级复用的 `BytesPool`
-- **存储画像**：存储介质与访问模式模型（`io_profile`）
-- **调度配置**：存储层投影使用的 `IoSchedulerConfig` / `IoPriorityQueueConfig`
+- **I/O 调度器**：自适应缓冲区大小计算和负载管理
+- **优先级队列**：支持饥饿预防的请求优先级调度
 - **背压控制**：系统过载保护和优雅降级
 - **死锁检测**：基于等待图的死锁检测算法
 - **锁优化**：自适应自旋锁优化
-- **进度追踪**：长耗时操作的字节进度与停滞判定
-
-调度算法本身位于 `rustfs/src/storage/concurrency/io_schedule.rs`；本 crate 只承载它投影使用的配置形状，不是第二套实现。
+- **超时包装器**：动态超时计算和操作进度追踪
 
 ## ✨ 核心功能
 
+### I/O 调度器 (IoScheduler)
+
+自适应 I/O 调度，根据文件大小、访问模式和系统负载动态调整缓冲区大小：
+
+```rust
+use rustfs_io_core::{IoScheduler, IoSchedulerConfig, IoLoadLevel};
+use rustfs_io_core::io_profile::{StorageMedia, AccessPattern};
+
+// 创建调度器
+let config = IoSchedulerConfig {
+    max_concurrent_reads: 64,
+    base_buffer_size: 64 * 1024,  // 64 KB
+    max_buffer_size: 1024 * 1024, // 1 MB
+    ..Default::default()
+};
+let scheduler = IoScheduler::new(config);
+
+// 计算最优缓冲区大小
+let buffer_size = scheduler.calculate_buffer_size(
+    10 * 1024 * 1024,  // 10 MB 文件
+    true,              // 顺序访问
+    StorageMedia::Ssd,
+    IoLoadLevel::Low,
+);
+println!("缓冲区大小: {} bytes", buffer_size);
+```
+
+### 优先级队列 (IoPriorityQueue)
+
+支持饥饿预防的优先级队列：
+
+```rust
+use rustfs_io_core::{IoPriorityQueue, IoPriority, IoQueueStatus};
+
+let queue = IoPriorityQueue::<()>::new(100);
+
+// 入队请求
+let request_id = queue.enqueue(
+    IoPriority::High,
+    (),  // 请求数据
+    1024, // 请求大小
+);
+
+// 出队请求
+if let Some((priority, data)) = queue.dequeue() {
+    println!("处理优先级 {:?} 的请求", priority);
+}
+
+// 检查队列状态
+let status = queue.status();
+println!("高优先级等待: {}", status.high_priority_waiting);
+println!("低优先级等待: {}", status.low_priority_waiting);
+```
+
 ### 背压控制 (BackpressureMonitor)
 
 系统过载保护：
@@ -114,23 +165,78 @@ let stats = optimizer.stats();
 println!("获取锁次数: {}", stats.locks_acquired.load(std::sync::atomic::Ordering::Relaxed));
 ```
 
-### 进度追踪 (OperationProgress)
+### 超时包装器 (RequestTimeoutWrapper)
 
-长耗时操作的字节进度与停滞判定：
+动态超时计算：
 
 ```rust
-use rustfs_io_core::OperationProgress;
+use rustfs_io_core::{RequestTimeoutWrapper, TimeoutConfig};
 use std::time::Duration;
 
-let progress = OperationProgress::new(Some(1000), Duration::from_secs(5));
+let config = TimeoutConfig {
+    base_timeout: Duration::from_secs(5),
+    timeout_per_mb: Duration::from_millis(100),
+    max_timeout: Duration::from_secs(300),
+    ..Default::default()
+};
+let wrapper = RequestTimeoutWrapper::new(config);
 
-progress.update(500);
-assert_eq!(progress.progress_percent(), Some(50.0));
-assert!(!progress.is_stale());
+// 计算操作超时
+let timeout = wrapper.calculate_timeout(10 * 1024 * 1024);  // 10 MB
+println!("超时时间: {:?}", timeout);
+
+// 执行带超时的操作
+let result = wrapper.execute_with_timeout(async {
+    // 异步操作
+    Ok::<_, std::io::Error>(())
+}, timeout).await;
+```
+
+## 📊 缓冲区大小计算
+
+模块提供了多种缓冲区大小计算函数：
+
+```rust
+use rustfs_io_core::{
+    get_concurrency_aware_buffer_size,
+    get_advanced_buffer_size,
+    get_buffer_size_for_media,
+    calculate_optimal_buffer_size,
+    KI_B, MI_B,
+};
+use rustfs_io_core::io_profile::StorageMedia;
+
+// 基础计算
+let size1 = get_concurrency_aware_buffer_size(1024 * 1024, 64 * 1024);
+
+// 高级计算（考虑访问模式）
+let size2 = get_advanced_buffer_size(10 * 1024 * 1024, 64 * 1024, true);
+
+// 媒体类型优化
+let size3 = get_buffer_size_for_media(64 * 1024, StorageMedia::Ssd);
+
+// 综合计算
+let size4 = calculate_optimal_buffer_size(
+    100 * 1024 * 1024,  // 100 MB 文件
+    64 * 1024,          // 基础缓冲区
+    true,               // 顺序访问
+    4,                  // 并发请求数
+    StorageMedia::Nvme,
+    IoLoadLevel::Low,
+);
 ```
 
 ## 🔧 配置
 
+### 环境变量
+
+| 变量名 | 描述 | 默认值 |
+|--------|------|--------|
+| `RUSTFS_MAX_CONCURRENT_READS` | 最大并发读数 | 64 |
+| `RUSTFS_BASE_BUFFER_SIZE` | 基础缓冲区大小 | 65536 |
+| `RUSTFS_MAX_BUFFER_SIZE` | 最大缓冲区大小 | 1048576 |
+| `RUSTFS_IO_TIMEOUT_SECS` | I/O 超时秒数 | 30 |
+
 ### 代码配置
 
 ```rust
@@ -158,11 +264,12 @@ rustfs-io-core/
 ├── src/
 │   ├── lib.rs              # 模块入口
 │   ├── config.rs           # 配置类型
-│   ├── pool.rs             # 分级缓冲池
+│   ├── scheduler.rs        # I/O 调度器
+│   ├── io_priority_queue.rs # 优先级队列
 │   ├── backpressure.rs     # 背压控制
 │   ├── deadlock_detector.rs # 死锁检测
 │   ├── lock_optimizer.rs   # 锁优化
-│   ├── progress.rs         # 操作进度追踪
+│   ├── timeout_wrapper.rs  # 超时包装器
 │   └── io_profile.rs       # I/O 配置文件
 └── Cargo.toml
 ```
@@ -171,15 +278,21 @@ rustfs-io-core/
 
 ```bash
 # 运行所有测试
-cargo nextest run --package rustfs-io-core
+cargo test --package rustfs-io-core
 
 # 运行特定测试
-cargo nextest run --package rustfs-io-core -E 'test(backpressure)'
+cargo test --package rustfs-io-core --lib scheduler
+
+# 运行基准测试
+cargo bench --package rustfs-io-core
 ```
 
 ## 📚 文档
 
 - [API 文档](https://docs.rs/rustfs-io-core)
+- [I/O 调度器设计](./docs/scheduler-design.md)
+- [背压控制原理](./docs/backpressure-design.md)
+- [死锁检测算法](./docs/deadlock-detection.md)
 
 ## 🔗 相关模块
 

crates/io-core/examples/scheduler_example.rs

@@ -0,0 +1,190 @@
+// Copyright 2024 RustFS Team
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+//! Example demonstrating I/O scheduler usage.
+
+use rustfs_io_core::io_profile::StorageMedia;
+use rustfs_io_core::{
+    BackpressureMonitor, BackpressureState, DeadlockDetector, IoLoadLevel, IoScheduler, IoSchedulerConfig, KI_B, LockOptimizer,
+    LockType, MI_B, calculate_optimal_buffer_size, get_buffer_size_for_media,
+};
+use std::time::Duration;
+
+fn main() {
+    println!("=== rustfs-io-core Example ===\n");
+
+    // 1. I/O scheduler example
+    io_scheduler_example();
+
+    // 2. Buffer size calculation example
+    buffer_size_example();
+
+    // 3. Backpressure control example
+    backpressure_example();
+
+    // 4. Deadlock detection example
+    deadlock_detection_example();
+
+    // 5. Lock optimizer example
+    lock_optimizer_example();
+}
+
+fn io_scheduler_example() {
+    println!("--- I/O Scheduler ---");
+
+    // Create scheduler with configuration
+    let config = IoSchedulerConfig {
+        max_concurrent_reads: 64,
+        base_buffer_size: 64 * KI_B,
+        max_buffer_size: MI_B,
+        ..Default::default()
+    };
+    let scheduler = IoScheduler::new(config);
+
+    println!("  Max concurrent reads: {}", scheduler.config().max_concurrent_reads);
+    println!("  Base buffer size: {} KB", scheduler.config().base_buffer_size / KI_B);
+    println!("  Max buffer size: {} KB", scheduler.config().max_buffer_size / KI_B);
+
+    // Calculate buffer sizes for different scenarios
+    let scenarios = [
+        ("Small file", 10 * KI_B as i64, true, StorageMedia::Ssd),
+        ("Medium file", MI_B as i64, true, StorageMedia::Ssd),
+        ("Large sequential", 100 * MI_B as i64, true, StorageMedia::Ssd),
+        ("Large random", 100 * MI_B as i64, false, StorageMedia::Ssd),
+        ("NVMe large", 100 * MI_B as i64, true, StorageMedia::Nvme),
+        ("HDD large", 100 * MI_B as i64, true, StorageMedia::Hdd),
+    ];
+
+    for (name, size, sequential, media) in scenarios {
+        let buffer = calculate_optimal_buffer_size(size, 64 * KI_B, sequential, 4, media, IoLoadLevel::Low);
+        println!("  {}: {} bytes ({} KB)", name, buffer, buffer / KI_B);
+    }
+
+    println!();
+}
+
+fn buffer_size_example() {
+    println!("--- Buffer Size Calculation ---");
+
+    // Comprehensive calculation
+    let size1 = calculate_optimal_buffer_size(10 * MI_B as i64, 64 * KI_B, true, 4, StorageMedia::Ssd, IoLoadLevel::Low);
+    println!("  Comprehensive (10MB, sequential, SSD): {} KB", size1 / KI_B);
+
+    // Media type optimization
+    let media_types = [
+        StorageMedia::Nvme,
+        StorageMedia::Ssd,
+        StorageMedia::Hdd,
+        StorageMedia::Unknown,
+    ];
+    for media in media_types {
+        let size = get_buffer_size_for_media(64 * KI_B, media);
+        println!("  {} optimized: {} KB", media.as_str(), size / KI_B);
+    }
+
+    println!();
+}
+
+fn backpressure_example() {
+    println!("--- Backpressure Control ---");
+
+    let monitor = BackpressureMonitor::with_defaults();
+
+    // Check initial state
+    let state = monitor.state();
+    let state_str = match state {
+        BackpressureState::Normal => "Normal",
+        BackpressureState::Warning => "Warning",
+        BackpressureState::Critical => "Critical",
+    };
+    println!("  Initial state: {}", state_str);
+
+    // Check if active
+    let is_active = monitor.is_active();
+    println!("  Backpressure active: {}", is_active);
+
+    // Try to acquire permit
+    if monitor.try_acquire() {
+        println!("  Successfully acquired permit");
+        monitor.release();
+        println!("  Released permit");
+    }
+
+    // View statistics
+    println!("  Total processed: {}", monitor.total_processed());
+    println!("  Total rejected: {}", monitor.total_rejected());
+
+    println!();
+}
+
+fn deadlock_detection_example() {
+    println!("--- Deadlock Detection ---");
+
+    let detector = DeadlockDetector::with_defaults();
+
+    // Register locks
+    let mutex1 = detector.register_lock(LockType::Mutex);
+    let mutex2 = detector.register_lock(LockType::Mutex);
+    println!("  Registered locks: mutex1={}, mutex2={}", mutex1, mutex2);
+
+    // Simulate normal operation
+    detector.record_acquire(mutex1, 1); // Thread 1 acquires mutex1
+    detector.record_acquire(mutex2, 2); // Thread 2 acquires mutex2
+    println!("  Normal operation: no deadlock");
+
+    // Detect deadlock
+    if detector.detect_deadlock().is_none() {
+        println!("  Detection result: no deadlock");
+    }
+
+    // Simulate deadlock scenario
+    detector.record_wait(mutex2, 1); // Thread 1 waits for mutex2
+    detector.record_wait(mutex1, 2); // Thread 2 waits for mutex1
+
+    // Detect deadlock
+    if let Some(deadlock) = detector.detect_deadlock() {
+        println!("  Detection result: deadlock found {:?}", deadlock);
+    }
+
+    // Cleanup
+    detector.unregister_lock(mutex1);
+    detector.unregister_lock(mutex2);
+    println!();
+}
+
+fn lock_optimizer_example() {
+    println!("--- Lock Optimizer ---");
+
+    let optimizer = LockOptimizer::with_defaults();
+
+    // Simulate lock operations
+    for _i in 0..5 {
+        optimizer.on_acquire();
+        // Simulate work
+        std::thread::sleep(Duration::from_millis(10));
+        optimizer.on_release(Duration::from_millis(10));
+    }
+
+    // View statistics
+    let stats = optimizer.stats();
+    let acquired = stats.total_acquired();
+    let avg_hold = stats.avg_hold_time();
+    let contention = stats.contention_rate();
+
+    println!("  Locks acquired: {}", acquired);
+    println!("  Average hold time: {:?}", avg_hold);
+    println!("  Contention rate: {:.2}%", contention * 100.0);
+
+    println!();
+}

crates/io-core/src/bufreader_optimizer.rs

@@ -0,0 +1,227 @@
+// Copyright 2024 RustFS Team
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+//! BufReader layer optimizer for minimizing redundant buffering layers.
+//!
+//! This module provides optimization for BufReader usage in data paths,
+//! including layer count limiting and dynamic buffer size adjustment.
+
+use std::sync::atomic::{AtomicU64, Ordering};
+
+/// BufReader optimization configuration.
+#[derive(Debug, Clone)]
+pub struct BufReaderConfig {
+    /// Maximum number of nested BufReader layers (default: 2)
+    pub max_layers: u32,
+
+    /// Buffer size for small files (default: 8KB)
+    pub small_file_buffer: usize,
+
+    /// Buffer size for large files (default: 64KB)
+    pub large_file_buffer: usize,
+
+    /// Threshold for large file classification (default: 1MB)
+    pub large_file_threshold: usize,
+}
+
+impl Default for BufReaderConfig {
+    fn default() -> Self {
+        Self {
+            max_layers: 2,
+            small_file_buffer: 8 * 1024,       // 8KB
+            large_file_buffer: 64 * 1024,      // 64KB
+            large_file_threshold: 1024 * 1024, // 1MB
+        }
+    }
+}
+
+/// BufReader optimization statistics.
+#[derive(Debug, Default)]
+pub struct BufReaderStats {
+    /// Total number of readers created
+    pub total_readers: AtomicU64,
+
+    /// Number of redundant layers eliminated
+    pub eliminated_layers: AtomicU64,
+
+    /// Number of buffer size adjustments
+    pub buffer_size_adjustments: AtomicU64,
+}
+
+/// BufReader layer optimizer.
+///
+/// Analyzes and optimizes BufReader nesting in data paths,
+/// dynamically adjusting buffer sizes based on data characteristics.
+pub struct BufReaderOptimizer {
+    config: BufReaderConfig,
+    stats: BufReaderStats,
+}
+
+impl BufReaderOptimizer {
+    /// Create a new BufReader optimizer with the given configuration.
+    pub fn new(config: BufReaderConfig) -> Self {
+        Self {
+            config,
+            stats: BufReaderStats::default(),
+        }
+    }
+
+    /// Create a new BufReader optimizer with default configuration.
+    pub fn with_defaults() -> Self {
+        Self::new(BufReaderConfig::default())
+    }
+
+    /// Calculate the optimal buffer size based on data size.
+    ///
+    /// Returns the appropriate buffer size based on whether the data
+    /// is classified as a small or large file.
+    pub fn optimal_buffer_size(&self, data_size: Option<usize>) -> usize {
+        match data_size {
+            Some(size) if size >= self.config.large_file_threshold => self.config.large_file_buffer,
+            Some(_) => self.config.small_file_buffer,
+            None => self.config.small_file_buffer,
+        }
+    }
+
+    /// Optimize a reader by wrapping it with an appropriately sized BufReader.
+    ///
+    /// This method applies the optimal buffer size based on the expected
+    /// data size and tracks statistics.
+    pub fn optimize<R: tokio::io::AsyncRead + Unpin>(&self, reader: R, data_size: Option<usize>) -> tokio::io::BufReader<R> {
+        let buffer_size = self.optimal_buffer_size(data_size);
+        self.stats.total_readers.fetch_add(1, Ordering::Relaxed);
+        tokio::io::BufReader::with_capacity(buffer_size, reader)
+    }
+
+    /// Get the statistics for this optimizer.
+    pub fn stats(&self) -> &BufReaderStats {
+        &self.stats
+    }
+
+    /// Get the configuration for this optimizer.
+    pub fn config(&self) -> &BufReaderConfig {
+        &self.config
+    }
+}
+
+/// Marker trait for buffered sources.
+///
+/// Types implementing this trait are considered already buffered
+/// and should not be wrapped with additional BufReader layers.
+pub trait BufferedSource: tokio::io::AsyncRead {}
+
+impl BufReaderOptimizer {
+    /// Check if a reader is already a buffered source.
+    ///
+    /// Returns true if the reader implements `BufferedSource`,
+    /// indicating it should not be wrapped with BufReader.
+    pub fn is_buffered_source<R: BufferedSource + ?Sized>(&self, _reader: &R) -> bool {
+        true
+    }
+
+    /// Eliminate redundant BufReader layers if possible.
+    ///
+    /// This method attempts to reduce the nesting depth of BufReader
+    /// layers to improve performance.
+    pub fn eliminate_redundant_layers<R: tokio::io::AsyncRead + Unpin>(&self, reader: R) -> R {
+        // For now, just return the reader as-is
+        // Future implementation could detect and unwrap nested BufReaders
+        self.stats.eliminated_layers.fetch_add(0, Ordering::Relaxed);
+        reader
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use tokio::io::AsyncReadExt;
+
+    #[test]
+    fn test_default_config() {
+        let config = BufReaderConfig::default();
+        assert_eq!(config.max_layers, 2);
+        assert_eq!(config.small_file_buffer, 8 * 1024);
+        assert_eq!(config.large_file_buffer, 64 * 1024);
+        assert_eq!(config.large_file_threshold, 1024 * 1024);
+    }
+
+    #[test]
+    fn test_optimal_buffer_size_small_file() {
+        let optimizer = BufReaderOptimizer::with_defaults();
+
+        // Small file (< 1MB)
+        assert_eq!(optimizer.optimal_buffer_size(Some(100)), 8 * 1024);
+        assert_eq!(optimizer.optimal_buffer_size(Some(1024)), 8 * 1024);
+        assert_eq!(optimizer.optimal_buffer_size(Some(512 * 1024)), 8 * 1024);
+    }
+
+    #[test]
+    fn test_optimal_buffer_size_large_file() {
+        let optimizer = BufReaderOptimizer::with_defaults();
+
+        // Large file (>= 1MB)
+        assert_eq!(optimizer.optimal_buffer_size(Some(1024 * 1024)), 64 * 1024);
+        assert_eq!(optimizer.optimal_buffer_size(Some(10 * 1024 * 1024)), 64 * 1024);
+    }
+
+    #[test]
+    fn test_optimal_buffer_size_unknown() {
+        let optimizer = BufReaderOptimizer::with_defaults();
+
+        // Unknown size
+        assert_eq!(optimizer.optimal_buffer_size(None), 8 * 1024);
+    }
+
+    #[tokio::test]
+    async fn test_optimize_creates_bufreader() {
+        let optimizer = BufReaderOptimizer::with_defaults();
+        let data = vec![1u8, 2, 3, 4, 5];
+        let cursor = std::io::Cursor::new(data.clone());
+
+        let mut reader = optimizer.optimize(cursor, Some(5));
+
+        let mut buf = vec![0u8; 5];
+        let n = reader.read(&mut buf).await.unwrap();
+
+        assert_eq!(n, 5);
+        assert_eq!(buf, data);
+    }
+
+    #[test]
+    fn test_stats_tracking() {
+        let optimizer = BufReaderOptimizer::with_defaults();
+
+        assert_eq!(optimizer.stats().total_readers.load(Ordering::Relaxed), 0);
+
+        let cursor = std::io::Cursor::new(vec![1u8, 2, 3]);
+        let _reader = optimizer.optimize(cursor, Some(3));
+
+        assert_eq!(optimizer.stats().total_readers.load(Ordering::Relaxed), 1);
+    }
+
+    #[test]
+    fn test_custom_config() {
+        let config = BufReaderConfig {
+            max_layers: 3,
+            small_file_buffer: 4 * 1024,
+            large_file_buffer: 128 * 1024,
+            large_file_threshold: 2 * 1024 * 1024,
+        };
+
+        let optimizer = BufReaderOptimizer::new(config);
+
+        assert_eq!(optimizer.optimal_buffer_size(Some(1024 * 1024)), 4 * 1024);
+        assert_eq!(optimizer.optimal_buffer_size(Some(3 * 1024 * 1024)), 128 * 1024);
+    }
+}

crates/io-core/src/direct_io.rs

@@ -0,0 +1,332 @@
+// Copyright 2024 RustFS Team
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+//! Aligned pread-based file reader.
+//!
+//! This module provides an aligned, position-based file reader that uses
+//! `pread`/`FileExt::read_at` for I/O operations. It performs reads at
+//! 512-byte-aligned offsets and sizes, making it suitable as a foundation
+//! for workloads where alignment matters.
+//!
+//! Note: This reader does **not** set the `O_DIRECT` flag and therefore does
+//! not bypass the OS page cache. It is an aligned `pread`-based reader, not
+//! true Direct I/O. To implement true O_DIRECT on Linux, the file must be
+//! opened with `O_DIRECT` via `libc::open`.
+//!
+//! # Platform Support
+//!
+//! The `read_at` implementation is only available on Unix-like platforms.
+//! On other platforms, this reader will return an error.
+
+use std::io::{self};
+use std::pin::Pin;
+use std::task::{Context, Poll};
+use tokio::io::{AsyncRead, ReadBuf};
+
+/// Errors that can occur during aligned pread operations.
+#[derive(Debug, Clone)]
+pub enum AlignedPreadError {
+    /// Platform doesn't support `read_at`-based I/O
+    UnsupportedPlatform,
+    /// File descriptor doesn't support this reader
+    UnsupportedFile,
+    /// I/O error occurred
+    Io(String),
+    /// Invalid alignment (reads require 512-byte-aligned offset and size)
+    AlignmentError { offset: u64, size: usize },
+}
+
+impl std::fmt::Display for AlignedPreadError {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        match self {
+            Self::UnsupportedPlatform => write!(f, "Aligned pread not supported on this platform"),
+            Self::UnsupportedFile => write!(f, "File doesn't support this reader"),
+            Self::Io(msg) => write!(f, "I/O error: {}", msg),
+            Self::AlignmentError { offset, size } => {
+                write!(f, "Alignment error: offset={}, size={}", offset, size)
+            }
+        }
+    }
+}
+
+impl std::error::Error for AlignedPreadError {}
+
+impl From<io::Error> for AlignedPreadError {
+    fn from(err: io::Error) -> Self {
+        Self::Io(err.to_string())
+    }
+}
+
+/// Aligned pread-based file reader for Unix platforms.
+///
+/// This reader performs I/O using `pread`/`FileExt::read_at` at
+/// 512-byte-aligned offsets and sizes, without modifying the file's
+/// current position.
+///
+/// **Note:** This reader does **not** set the `O_DIRECT` flag and therefore
+/// does **not** bypass the OS page cache. It is an aligned `pread`-based
+/// reader. To implement true O_DIRECT, the file must be opened with
+/// `O_DIRECT` via `libc::open`.
+///
+/// # Platform Support
+///
+/// Only available on Linux (uses `FileExt::read_at`). On other platforms,
+/// use `BytesBufferedReader` instead.
+///
+/// # Alignment Requirements
+///
+/// Reads have strict alignment requirements:
+/// - File offset must be aligned to 512 bytes
+/// - Buffer size must be a multiple of 512 bytes
+/// - Buffer address must be aligned (handled internally)
+///
+/// # Example
+///
+/// ```ignore
+/// use rustfs_io_core::AlignedPreadReader;
+///
+/// // Linux only
+/// #[cfg(target_os = "linux")]
+/// let reader = AlignedPreadReader::new(file, offset, size)?;
+/// ```
+#[cfg(target_os = "linux")]
+pub struct AlignedPreadReader {
+    /// Underlying file handle used for aligned pread I/O
+    file: std::fs::File,
+    /// Current read position
+    pos: u64,
+    /// Remaining bytes to read
+    remaining: usize,
+    /// Buffer for aligned reads
+    buffer: Vec<u8>,
+    /// Current position in the buffer
+    buffer_pos: usize,
+    /// Amount of data in the buffer
+    buffer_len: usize,
+}
+
+#[cfg(target_os = "linux")]
+impl AlignedPreadReader {
+    /// Alignment requirement for reads (512 bytes for most systems)
+    pub const ALIGNMENT: usize = 512;
+
+    /// Create a new aligned pread-based reader.
+    ///
+    /// # Arguments
+    ///
+    /// * `file` - File to read from
+    /// * `offset` - Starting offset in the file (must be 512-byte aligned)
+    /// * `size` - Number of bytes to read (must be 512-byte aligned)
+    ///
+    /// # Returns
+    ///
+    /// An `AlignedPreadReader` that reads the file at the given offset.
+    ///
+    /// # Errors
+    ///
+    /// Returns an error if offset or size are not 512-byte aligned.
+    pub fn new(file: std::fs::File, offset: u64, size: usize) -> Result<Self, AlignedPreadError> {
+        // Check alignment
+        if !offset.is_multiple_of(Self::ALIGNMENT as u64) {
+            return Err(AlignedPreadError::AlignmentError { offset, size });
+        }
+        if !size.is_multiple_of(Self::ALIGNMENT) {
+            return Err(AlignedPreadError::AlignmentError { offset, size });
+        }
+
+        Ok(Self {
+            file,
+            pos: offset,
+            remaining: size,
+            buffer: Vec::new(),
+            buffer_pos: 0,
+            buffer_len: 0,
+        })
+    }
+
+    /// Read a chunk of data using aligned pread.
+    ///
+    /// This method performs aligned reads and handles the buffering required
+    /// by this aligned pread implementation. It does not use `O_DIRECT`.
+    fn read_chunk(&mut self, buf: &mut [u8]) -> io::Result<usize> {
+        // If buffer is exhausted, read more data
+        if self.buffer_pos >= self.buffer_len {
+            if self.remaining == 0 {
+                return Ok(0);
+            }
+
+            // Allocate aligned buffer
+            let chunk_size = (self.remaining).min(64 * 1024); // 64KB chunks
+            let aligned_size = chunk_size.div_ceil(Self::ALIGNMENT) * Self::ALIGNMENT;
+
+            self.buffer = vec![0u8; aligned_size];
+
+            // Use pread for atomic read at position (no file offset modification)
+            use std::os::unix::fs::FileExt;
+            let n = self.file.read_at(&mut self.buffer, self.pos)?;
+
+            self.buffer_pos = 0;
+            self.buffer_len = n;
+            self.pos += n as u64;
+            self.remaining -= n;
+
+            if n == 0 {
+                return Ok(0);
+            }
+        }
+
+        // Copy from buffer to user buffer
+        let available = self.buffer_len - self.buffer_pos;
+        let to_copy = buf.len().min(available);
+        buf[..to_copy].copy_from_slice(&self.buffer[self.buffer_pos..self.buffer_pos + to_copy]);
+        self.buffer_pos += to_copy;
+
+        Ok(to_copy)
+    }
+}
+
+#[cfg(target_os = "linux")]
+impl AsyncRead for AlignedPreadReader {
+    fn poll_read(mut self: Pin<&mut Self>, _cx: &mut Context<'_>, buf: &mut ReadBuf<'_>) -> Poll<io::Result<()>> {
+        let filled = buf.filled().len();
+        let mut remaining = buf.initialize_unfilled();
+
+        while !remaining.is_empty() {
+            match self.read_chunk(remaining) {
+                Ok(0) => break,
+                Ok(n) => {
+                    remaining = &mut remaining[n..];
+                }
+                Err(e) => return Poll::Ready(Err(e)),
+            }
+        }
+
+        let _n_read = buf.filled().len() - filled;
+        Poll::Ready(Ok(()))
+    }
+}
+
+/// Aligned pread reader stub for non-Linux platforms.
+///
+/// On non-Linux platforms, `read_at`-based I/O is not available through this
+/// type. This stub exists to provide a consistent API across platforms.
+#[cfg(not(target_os = "linux"))]
+pub struct AlignedPreadReader {
+    _priv: (),
+}
+
+#[cfg(not(target_os = "linux"))]
+impl AlignedPreadReader {
+    /// Create a new aligned pread reader (not supported on this platform).
+    ///
+    /// Always returns an error on non-Linux platforms.
+    pub fn new(_file: std::fs::File, _offset: u64, _size: usize) -> Result<Self, AlignedPreadError> {
+        Err(AlignedPreadError::UnsupportedPlatform)
+    }
+}
+
+#[cfg(not(target_os = "linux"))]
+impl AsyncRead for AlignedPreadReader {
+    fn poll_read(self: Pin<&mut Self>, _cx: &mut Context<'_>, _buf: &mut ReadBuf<'_>) -> Poll<io::Result<()>> {
+        Poll::Ready(Err(io::Error::new(
+            io::ErrorKind::Unsupported,
+            "Aligned pread-based I/O not supported on this platform",
+        )))
+    }
+}
+
+impl std::fmt::Debug for AlignedPreadReader {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        #[cfg(target_os = "linux")]
+        {
+            f.debug_struct("AlignedPreadReader")
+                .field("pos", &self.pos)
+                .field("remaining", &self.remaining)
+                .field("buffer_len", &self.buffer_len)
+                .finish()
+        }
+        #[cfg(not(target_os = "linux"))]
+        {
+            f.debug_struct("AlignedPreadReader")
+                .field("platform", &"unsupported")
+                .finish()
+        }
+    }
+}
+
+/// Historical name for aligned pread errors.
+#[deprecated(since = "1.0.0-beta.8", note = "use AlignedPreadError; this reader does not set O_DIRECT")]
+pub type DirectIoError = AlignedPreadError;
+
+/// Historical name for the aligned pread-based reader.
+#[deprecated(since = "1.0.0-beta.8", note = "use AlignedPreadReader; this reader does not set O_DIRECT")]
+pub type DirectIoReader = AlignedPreadReader;
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn test_alignment_check() {
+        #[cfg(target_os = "linux")]
+        {
+            // Valid alignment
+            let file = std::fs::File::open("/dev/zero").unwrap();
+            assert!(
+                AlignedPreadReader::new(file, 0, 512).is_ok(),
+                "Should succeed with aligned offset and size"
+            );
+
+            let file = std::fs::File::open("/dev/zero").expect("open /dev/zero for alias");
+            assert!(
+                AlignedPreadReader::new(file, 0, 512).is_ok(),
+                "Should succeed through aligned pread alias"
+            );
+
+            // Invalid offset
+            let file = std::fs::File::open("/dev/zero").unwrap();
+            assert!(AlignedPreadReader::new(file, 1, 512).is_err(), "Should fail with unaligned offset");
+
+            // Invalid size
+            let file = std::fs::File::open("/dev/zero").unwrap();
+            assert!(AlignedPreadReader::new(file, 0, 511).is_err(), "Should fail with unaligned size");
+        }
+
+        #[cfg(not(target_os = "linux"))]
+        {
+            // Non-Linux should return UnsupportedPlatform
+            let file = std::fs::File::open(std::env::current_exe().unwrap()).unwrap();
+            assert!(matches!(
+                AlignedPreadReader::new(file, 0, 512),
+                Err(AlignedPreadError::UnsupportedPlatform)
+            ));
+        }
+    }
+
+    #[test]
+    #[allow(deprecated)]
+    fn test_legacy_direct_io_alias() {
+        #[cfg(target_os = "linux")]
+        {
+            let file = std::fs::File::open("/dev/zero").unwrap();
+            assert!(DirectIoReader::new(file, 0, 512).is_ok());
+        }
+
+        #[cfg(not(target_os = "linux"))]
+        {
+            let file = std::fs::File::open(std::env::current_exe().unwrap()).unwrap();
+            assert!(matches!(DirectIoReader::new(file, 0, 512), Err(AlignedPreadError::UnsupportedPlatform)));
+        }
+    }
+}

crates/io-core/src/io_priority_queue.rs

@@ -0,0 +1,381 @@
+// Copyright 2024 RustFS Team
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+//! I/O priority queue for scheduling I/O operations.
+//!
+//! This module provides a priority queue implementation for I/O operations
+//! with support for starvation prevention and fair scheduling.
+
+use crate::config::IoPriorityQueueConfig;
+use crate::scheduler::IoPriority;
+use std::collections::VecDeque;
+use std::time::{Duration, Instant};
+
+/// A queued I/O request.
+#[derive(Debug, Clone)]
+pub struct IoRequest {
+    /// Request ID.
+    pub id: u64,
+    /// Request priority.
+    pub priority: IoPriority,
+    /// Request size in bytes.
+    pub size: usize,
+    /// Queue time.
+    pub queued_at: Instant,
+    /// Whether this is a sequential read.
+    pub is_sequential: bool,
+}
+
+impl IoRequest {
+    /// Create a new I/O request.
+    pub fn new(id: u64, priority: IoPriority, size: usize, is_sequential: bool) -> Self {
+        Self {
+            id,
+            priority,
+            size,
+            queued_at: Instant::now(),
+            is_sequential,
+        }
+    }
+
+    /// Get the wait time in the queue.
+    pub fn wait_time(&self) -> Duration {
+        self.queued_at.elapsed()
+    }
+}
+
+/// Queue status for a priority level.
+#[derive(Debug, Clone, Default)]
+pub struct IoQueueStatus {
+    /// Number of requests in the queue.
+    pub count: usize,
+    /// Total size of all requests.
+    pub total_size: usize,
+    /// Oldest request wait time.
+    pub oldest_wait: Option<Duration>,
+    /// Number of requests processed.
+    pub processed: u64,
+}
+
+impl IoQueueStatus {
+    /// Create new queue status.
+    pub fn new() -> Self {
+        Self::default()
+    }
+}
+
+/// I/O priority queue.
+pub struct IoPriorityQueue {
+    /// Queue configuration.
+    config: IoPriorityQueueConfig,
+    /// High priority queue.
+    high: VecDeque<IoRequest>,
+    /// Normal priority queue.
+    normal: VecDeque<IoRequest>,
+    /// Low priority queue.
+    low: VecDeque<IoRequest>,
+    /// Next request ID.
+    next_id: u64,
+    /// Last dequeue time for each priority (for starvation prevention).
+    last_dequeue: [Option<Instant>; 3],
+    /// Statistics for each queue.
+    stats: [IoQueueStatus; 3],
+}
+
+impl IoPriorityQueue {
+    /// Create a new priority queue with the given configuration.
+    pub fn new(config: IoPriorityQueueConfig) -> Self {
+        Self {
+            config,
+            high: VecDeque::with_capacity(100),
+            normal: VecDeque::with_capacity(500),
+            low: VecDeque::with_capacity(200),
+            next_id: 0,
+            last_dequeue: [None, None, None],
+            stats: [IoQueueStatus::new(), IoQueueStatus::new(), IoQueueStatus::new()],
+        }
+    }
+
+    /// Create with default configuration.
+    pub fn with_defaults() -> Self {
+        Self::new(IoPriorityQueueConfig::default())
+    }
+
+    /// Get the configuration.
+    pub fn config(&self) -> &IoPriorityQueueConfig {
+        &self.config
+    }
+
+    /// Enqueue a request.
+    pub fn enqueue(&mut self, priority: IoPriority, size: usize, is_sequential: bool) -> u64 {
+        let id = self.next_id;
+        self.next_id += 1;
+
+        let request = IoRequest::new(id, priority, size, is_sequential);
+
+        match priority {
+            IoPriority::High => {
+                if self.high.len() < self.config.high_capacity {
+                    self.high.push_back(request);
+                }
+            }
+            IoPriority::Normal => {
+                if self.normal.len() < self.config.normal_capacity {
+                    self.normal.push_back(request);
+                }
+            }
+            IoPriority::Low => {
+                if self.low.len() < self.config.low_capacity {
+                    self.low.push_back(request);
+                }
+            }
+        }
+
+        id
+    }
+
+    /// Dequeue the next request.
+    ///
+    /// Uses weighted fair queuing with starvation prevention.
+    pub fn dequeue(&mut self) -> Option<IoRequest> {
+        let now = Instant::now();
+
+        // Check for starvation: if a lower priority queue hasn't been served in a while,
+        // give it priority
+        let normal_starved = self.is_starved(IoPriority::Normal, now);
+        let low_starved = self.is_starved(IoPriority::Low, now);
+
+        // Priority order with starvation consideration
+        // Check conditions first, then dequeue
+        let dequeue_high = !self.high.is_empty() && !low_starved && !normal_starved;
+        let dequeue_normal = !self.normal.is_empty() && !low_starved;
+        let dequeue_low = !self.low.is_empty();
+        let dequeue_high_fallback = !self.high.is_empty();
+        let dequeue_normal_fallback = !self.normal.is_empty();
+
+        if dequeue_high {
+            let request = self.high.pop_front();
+            if request.is_some() {
+                self.last_dequeue[0] = Some(Instant::now());
+                self.stats[0].processed += 1;
+            }
+            request
+        } else if dequeue_normal {
+            let request = self.normal.pop_front();
+            if request.is_some() {
+                self.last_dequeue[1] = Some(Instant::now());
+                self.stats[1].processed += 1;
+            }
+            request
+        } else if dequeue_low {
+            let request = self.low.pop_front();
+            if request.is_some() {
+                self.last_dequeue[2] = Some(Instant::now());
+                self.stats[2].processed += 1;
+            }
+            request
+        } else if dequeue_high_fallback {
+            let request = self.high.pop_front();
+            if request.is_some() {
+                self.last_dequeue[0] = Some(Instant::now());
+                self.stats[0].processed += 1;
+            }
+            request
+        } else if dequeue_normal_fallback {
+            let request = self.normal.pop_front();
+            if request.is_some() {
+                self.last_dequeue[1] = Some(Instant::now());
+                self.stats[1].processed += 1;
+            }
+            request
+        } else {
+            None
+        }
+    }
+
+    /// Check if a priority level is starved.
+    fn is_starved(&self, priority: IoPriority, now: Instant) -> bool {
+        let idx = match priority {
+            IoPriority::High => 0,
+            IoPriority::Normal => 1,
+            IoPriority::Low => 2,
+        };
+
+        if let Some(last) = self.last_dequeue[idx] {
+            now.duration_since(last) > self.config.starvation_threshold
+        } else {
+            false
+        }
+    }
+
+    /// Get the total number of queued requests.
+    pub fn len(&self) -> usize {
+        self.high.len() + self.normal.len() + self.low.len()
+    }
+
+    /// Check if the queue is empty.
+    pub fn is_empty(&self) -> bool {
+        self.high.is_empty() && self.normal.is_empty() && self.low.is_empty()
+    }
+
+    /// Get queue status for a priority level.
+    pub fn status(&self, priority: IoPriority) -> IoQueueStatus {
+        let (queue, idx) = match priority {
+            IoPriority::High => (&self.high, 0),
+            IoPriority::Normal => (&self.normal, 1),
+            IoPriority::Low => (&self.low, 2),
+        };
+
+        let mut status = self.stats[idx].clone();
+        status.count = queue.len();
+        status.total_size = queue.iter().map(|r| r.size).sum();
+        status.oldest_wait = queue.front().map(|r| r.wait_time());
+        status
+    }
+
+    /// Get the total queue status.
+    pub fn total_status(&self) -> IoQueueStatus {
+        let mut total = IoQueueStatus::new();
+        total.count = self.len();
+        total.total_size = self
+            .high
+            .iter()
+            .chain(self.normal.iter())
+            .chain(self.low.iter())
+            .map(|r| r.size)
+            .sum();
+        total.processed = self.stats.iter().map(|s| s.processed).sum();
+        total.oldest_wait = self
+            .high
+            .front()
+            .map(|r| r.wait_time())
+            .or_else(|| self.normal.front().map(|r| r.wait_time()))
+            .or_else(|| self.low.front().map(|r| r.wait_time()));
+        total
+    }
+
+    /// Clear all queues.
+    pub fn clear(&mut self) {
+        self.high.clear();
+        self.normal.clear();
+        self.low.clear();
+    }
+
+    /// Peek at the next request without removing it.
+    pub fn peek(&self) -> Option<&IoRequest> {
+        if !self.high.is_empty() {
+            self.high.front()
+        } else if !self.normal.is_empty() {
+            self.normal.front()
+        } else {
+            self.low.front()
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn test_enqueue_dequeue() {
+        let mut queue = IoPriorityQueue::with_defaults();
+
+        let id1 = queue.enqueue(IoPriority::High, 1024, true);
+        let id2 = queue.enqueue(IoPriority::Normal, 2048, false);
+        let id3 = queue.enqueue(IoPriority::Low, 4096, true);
+
+        assert_eq!(queue.len(), 3);
+
+        // High priority should be dequeued first
+        let req1 = queue.dequeue().unwrap();
+        assert_eq!(req1.id, id1);
+        assert_eq!(req1.priority, IoPriority::High);
+
+        let req2 = queue.dequeue().unwrap();
+        assert_eq!(req2.id, id2);
+        assert_eq!(req2.priority, IoPriority::Normal);
+
+        let req3 = queue.dequeue().unwrap();
+        assert_eq!(req3.id, id3);
+        assert_eq!(req3.priority, IoPriority::Low);
+
+        assert!(queue.is_empty());
+    }
+
+    #[test]
+    fn test_queue_status() {
+        let mut queue = IoPriorityQueue::with_defaults();
+
+        queue.enqueue(IoPriority::High, 1024, true);
+        queue.enqueue(IoPriority::High, 2048, true);
+        queue.enqueue(IoPriority::Normal, 4096, false);
+
+        let high_status = queue.status(IoPriority::High);
+        assert_eq!(high_status.count, 2);
+        assert_eq!(high_status.total_size, 3072);
+
+        let normal_status = queue.status(IoPriority::Normal);
+        assert_eq!(normal_status.count, 1);
+        assert_eq!(normal_status.total_size, 4096);
+
+        let total = queue.total_status();
+        assert_eq!(total.count, 3);
+        assert_eq!(total.total_size, 7168);
+    }
+
+    #[test]
+    fn test_queue_capacity() {
+        let config = IoPriorityQueueConfig {
+            high_capacity: 2,
+            normal_capacity: 2,
+            low_capacity: 2,
+            ..Default::default()
+        };
+        let mut queue = IoPriorityQueue::new(config);
+
+        queue.enqueue(IoPriority::High, 1024, true);
+        queue.enqueue(IoPriority::High, 1024, true);
+        queue.enqueue(IoPriority::High, 1024, true); // Should be dropped
+
+        assert_eq!(queue.status(IoPriority::High).count, 2);
+    }
+
+    #[test]
+    fn test_clear() {
+        let mut queue = IoPriorityQueue::with_defaults();
+
+        queue.enqueue(IoPriority::High, 1024, true);
+        queue.enqueue(IoPriority::Normal, 2048, false);
+        queue.enqueue(IoPriority::Low, 4096, true);
+
+        assert_eq!(queue.len(), 3);
+        queue.clear();
+        assert!(queue.is_empty());
+    }
+
+    #[test]
+    fn test_peek() {
+        let mut queue = IoPriorityQueue::with_defaults();
+
+        queue.enqueue(IoPriority::Normal, 2048, false);
+        queue.enqueue(IoPriority::High, 1024, true);
+
+        let peeked = queue.peek().unwrap();
+        assert_eq!(peeked.priority, IoPriority::High);
+
+        // Peek shouldn't remove the item
+        assert_eq!(queue.len(), 2);
+    }
+}

crates/io-core/src/io_profile.rs

@@ -26,6 +26,7 @@ pub enum StorageMedia {
 }
 
 impl StorageMedia {
+    #[allow(dead_code)]
     pub fn as_str(&self) -> &'static str {
         match self {
             Self::Nvme => "nvme",
@@ -59,6 +60,7 @@ pub enum AccessPattern {
 }
 
 impl AccessPattern {
+    #[allow(dead_code)]
     pub fn as_str(&self) -> &'static str {
         match self {
             Self::Sequential => "sequential",
@@ -69,21 +71,25 @@ impl AccessPattern {
     }
 
     /// Check if this is a sequential access pattern.
+    #[allow(dead_code)]
     pub fn is_sequential(&self) -> bool {
         matches!(self, Self::Sequential)
     }
 
     /// Check if this is a random access pattern.
+    #[allow(dead_code)]
     pub fn is_random(&self) -> bool {
         matches!(self, Self::Random)
     }
 
     /// Check if this is a mixed access pattern.
+    #[allow(dead_code)]
     pub fn is_mixed(&self) -> bool {
         matches!(self, Self::Mixed)
     }
 
     /// Check if this pattern is unknown.
+    #[allow(dead_code)]
     pub fn is_unknown(&self) -> bool {
         matches!(self, Self::Unknown)
     }

crates/io-core/src/lib.rs

@@ -12,39 +12,85 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
-//! Shared I/O primitives for RustFS.
+//! Buffered I/O reader and writer implementations for RustFS.
 //!
-//! This crate holds the buffer pool and the concurrency-control primitives
-//! that the storage layer builds on:
+//! This crate provides buffered readers and writers for I/O operations.
+//! Prefer `BytesBufferedReader`, `BytesMutWriter`, and `AlignedPreadReader`
+//! for new code. Historical `ZeroCopy*` and `DirectIo*` names remain exported
+//! for backward compatibility.
 //!
-//! - Tiered `BytesPool` for buffer management
-//! - Storage-media and access-pattern profiling (`io_profile`)
-//! - Scheduler and priority-queue configuration shapes
-//! - Backpressure admission, deadlock detection, lock optimization
-//! - Progress tracking for long-running operations
+//! # Features
+//!
+//! - Memory-mapped file reading (mmap-then-copy) on Unix platforms
+//! - Bytes-based buffered wrapping
+//! - AsyncRead trait implementations
+//! - Tiered BytesPool for buffer management
+//! - Aligned pread-based reader (NOT true Direct I/O / O_DIRECT)
 //!
 //! # Example
 //!
 //! ```ignore
-//! use rustfs_io_core::BytesPool;
+//! use rustfs_io_core::{BytesBufferedReader, BytesPool};
+//! use bytes::Bytes;
 //!
+//! // Create from existing bytes (zero-copy)
+//! let data = Bytes::from("hello world");
+//! let reader = BytesBufferedReader::from_bytes(data);
+//!
+//! // Create from file using buffered reads
+//! let reader = BytesBufferedReader::from_file_read(&file, 0, 1024).await?;
+//!
+//! // Use BytesPool
 //! let pool = BytesPool::new_tiered();
 //! let mut buffer = pool.acquire_buffer(8192).await;
 //! ```
 
 pub mod backpressure;
+pub mod bufreader_optimizer;
 pub mod config;
 pub mod deadlock_detector;
+pub mod direct_io;
+pub mod io_priority_queue;
 pub mod io_profile;
 pub mod lock_optimizer;
 pub mod pool;
-pub mod progress;
+pub mod reader;
+pub mod scheduler;
+pub mod shared_memory;
+pub mod timeout_wrapper;
+pub mod writer;
 
+#[cfg(target_os = "linux")]
+pub use direct_io::{AlignedPreadError, AlignedPreadReader};
+#[cfg(target_os = "linux")]
+#[allow(deprecated)]
+pub use direct_io::{DirectIoError, DirectIoReader};
 pub use pool::{BytesPool, BytesPoolConfig, BytesPoolMetrics, PooledBuffer};
+#[allow(deprecated)]
+pub use reader::ZeroCopyObjectReader;
+pub use reader::{BytesBufferedReader, ZeroCopyReadError};
+#[allow(deprecated)]
+pub use writer::ZeroCopyObjectWriter;
+pub use writer::{BytesMutWriter, ZeroCopyWriteError};
+
+// BufReader optimizer exports
+pub use bufreader_optimizer::{BufReaderConfig, BufReaderOptimizer, BufReaderStats, BufferedSource};
+
+// Shared memory exports
+pub use shared_memory::{ArcData, ArcMetadata, SharedMemoryConfig, SharedMemoryPool, SharedMemoryStats};
 
 // Config exports
 pub use config::{ConfigError, IoPriorityQueueConfig, IoSchedulerConfig};
 
+// Scheduler exports
+pub use scheduler::{
+    BandwidthTier, IoLoadLevel, IoLoadMetrics, IoPriority, IoScheduler, IoSchedulingContext, IoStrategy, KI_B, MI_B,
+    calculate_optimal_buffer_size, get_advanced_buffer_size, get_buffer_size_for_media, get_concurrency_aware_buffer_size,
+};
+
+// Priority queue exports
+pub use io_priority_queue::{IoPriorityQueue, IoQueueStatus, IoRequest};
+
 // Backpressure exports
 pub use backpressure::{BackpressureConfig, BackpressureError, BackpressureMonitor, BackpressureState};
 
@@ -54,5 +100,8 @@ pub use deadlock_detector::{DeadlockDetector, DeadlockDetectorConfig, LockInfo,
 // Lock optimizer exports
 pub use lock_optimizer::{LockGuard, LockOptimizeConfig, LockOptimizer, LockStats};
 
-// Progress tracking exports
-pub use progress::OperationProgress;
+// Timeout wrapper exports
+pub use timeout_wrapper::{
+    OperationProgress, RequestTimeoutWrapper, TimeoutConfig, TimeoutError, TimeoutStats, calculate_adaptive_timeout,
+    estimate_bytes_per_second,
+};

crates/io-core/src/progress.rs

@@ -1,138 +0,0 @@
-// Copyright 2024 RustFS Team
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-//! Progress tracking for long-running I/O operations.
-//!
-//! Re-exported as `rustfs_concurrency::OperationProgress` for the storage
-//! timeout implementation, which uses `is_stale` to tell a slow transfer
-//! apart from a stalled one.
-
-use std::sync::atomic::{AtomicU64, Ordering};
-use std::time::{Duration, Instant};
-
-/// Operation progress tracker.
-#[derive(Debug)]
-pub struct OperationProgress {
-    /// Total size (if known).
-    pub total_size: Option<u64>,
-    /// Bytes processed.
-    bytes_processed: AtomicU64,
-    /// Last update time.
-    last_update: std::sync::Mutex<Instant>,
-    /// Stale timeout.
-    stale_timeout: Duration,
-    /// Start time for transfer rate calculation.
-    start_time: Instant,
-}
-
-impl OperationProgress {
-    /// Create new operation progress.
-    pub fn new(total_size: Option<u64>, stale_timeout: Duration) -> Self {
-        Self {
-            total_size,
-            bytes_processed: AtomicU64::new(0),
-            last_update: std::sync::Mutex::new(Instant::now()),
-            stale_timeout,
-            start_time: Instant::now(),
-        }
-    }
-
-    /// Update progress.
-    pub fn update(&self, bytes: u64) {
-        self.bytes_processed.store(bytes, Ordering::Relaxed);
-        if let Ok(mut last) = self.last_update.lock() {
-            *last = Instant::now();
-        }
-    }
-
-    /// Add to progress.
-    pub fn add(&self, bytes: u64) {
-        self.bytes_processed.fetch_add(bytes, Ordering::Relaxed);
-        if let Ok(mut last) = self.last_update.lock() {
-            *last = Instant::now();
-        }
-    }
-
-    /// Get current progress.
-    pub fn current(&self) -> u64 {
-        self.bytes_processed.load(Ordering::Relaxed)
-    }
-
-    /// Check if progress is stale.
-    pub fn is_stale(&self) -> bool {
-        if let Ok(last) = self.last_update.lock() {
-            last.elapsed() > self.stale_timeout
-        } else {
-            false
-        }
-    }
-
-    /// Get progress percentage.
-    pub fn progress_percent(&self) -> Option<f64> {
-        self.total_size.map(|total| {
-            if total == 0 {
-                100.0
-            } else {
-                let processed = self.bytes_processed.load(Ordering::Relaxed);
-                (processed as f64 / total as f64 * 100.0).min(100.0)
-            }
-        })
-    }
-
-    /// Get remaining bytes.
-    pub fn remaining(&self) -> Option<u64> {
-        self.total_size.map(|total| {
-            let processed = self.bytes_processed.load(Ordering::Relaxed);
-            total.saturating_sub(processed)
-        })
-    }
-
-    /// Calculate transfer rate in bytes per second.
-    ///
-    /// Returns 0 if no time has elapsed or no data transferred.
-    pub fn transfer_rate(&self) -> u64 {
-        let processed = self.bytes_processed.load(Ordering::Relaxed);
-        if processed == 0 {
-            return 0;
-        }
-
-        let elapsed = self.start_time.elapsed().as_secs_f64();
-        if elapsed > 0.0 {
-            (processed as f64 / elapsed) as u64
-        } else {
-            0
-        }
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    #[test]
-    fn test_operation_progress() {
-        let progress = OperationProgress::new(Some(1000), Duration::from_secs(5));
-
-        assert_eq!(progress.current(), 0);
-        assert_eq!(progress.progress_percent(), Some(0.0));
-
-        progress.update(500);
-        assert_eq!(progress.current(), 500);
-        assert_eq!(progress.progress_percent(), Some(50.0));
-
-        progress.add(300);
-        assert_eq!(progress.current(), 800);
-        assert_eq!(progress.remaining(), Some(200));
-    }
-}

crates/io-core/src/reader.rs

@@ -0,0 +1,412 @@
+// Copyright 2024 RustFS Team
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+//! Bytes-backed object reader implementation.
+
+use bytes::Bytes;
+use std::io;
+use std::pin::Pin;
+use std::task::{Context, Poll};
+use tokio::io::{AsyncRead, ReadBuf};
+
+/// Errors that can occur during Bytes-backed read operations.
+#[derive(Debug, Clone)]
+pub enum ZeroCopyReadError {
+    /// I/O error occurred.
+    Io(String),
+    /// Memory mapping error.
+    Mmap(String),
+    /// Invalid offset or size.
+    InvalidRange,
+}
+
+impl std::fmt::Display for ZeroCopyReadError {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        match self {
+            Self::Io(msg) => write!(f, "I/O error: {}", msg),
+            Self::Mmap(msg) => write!(f, "Mmap error: {}", msg),
+            Self::InvalidRange => write!(f, "Invalid offset or size"),
+        }
+    }
+}
+
+impl std::error::Error for ZeroCopyReadError {}
+
+impl From<io::Error> for ZeroCopyReadError {
+    fn from(err: io::Error) -> Self {
+        Self::Io(err.to_string())
+    }
+}
+
+/// Bytes-backed object reader.
+///
+/// `from_bytes` wraps existing `Bytes` without copying, but file constructors
+/// copy file data into owned `Bytes` after mmap or normal reads.
+///
+/// # Example
+///
+/// ```ignore
+/// use bytes::Bytes;
+/// use rustfs_io_core::BytesBufferedReader;
+///
+/// // Create from bytes without copying the `Bytes` buffer
+/// let data = Bytes::from("hello world");
+/// let reader = BytesBufferedReader::from_bytes(data);
+///
+/// // Read using AsyncRead trait
+/// let mut buf = vec![0u8; 1024];
+/// let n = reader.read(&mut buf[..]).await?;
+/// ```
+pub struct BytesBufferedReader {
+    /// Internal data source (could be mmap or owned bytes)
+    data: Bytes,
+    /// Current read position
+    pos: usize,
+}
+
+/// Historical name for the bytes-backed object reader.
+#[deprecated(
+    since = "1.0.0-beta.8",
+    note = "use BytesBufferedReader; file constructors copy into owned Bytes"
+)]
+pub type ZeroCopyObjectReader = BytesBufferedReader;
+
+impl BytesBufferedReader {
+    /// Create a reader from existing bytes.
+    ///
+    /// This is a true zero-copy operation - the Bytes are wrapped
+    /// without any allocation or copying.
+    ///
+    /// # Arguments
+    ///
+    /// * `data` - Bytes to wrap
+    ///
+    /// # Example
+    ///
+    /// ```ignore
+    /// let data = Bytes::from("hello world");
+    /// let reader = BytesBufferedReader::from_bytes(data);
+    /// ```
+    pub fn from_bytes(data: Bytes) -> Self {
+        Self { data, pos: 0 }
+    }
+
+    /// Create a Bytes-backed reader from a file using mmap-then-copy.
+    ///
+    /// This maps the requested file range and copies it into owned `Bytes`
+    /// before returning. It does not expose the mmap as a zero-copy buffer.
+    ///
+    /// # Arguments
+    ///
+    /// * `path` - Path to the file to memory map
+    /// * `offset` - Offset within the file to start reading
+    /// * `size` - Number of bytes to read
+    ///
+    /// # Returns
+    ///
+    /// A reader backed by copied file data.
+    ///
+    /// # Errors
+    ///
+    /// Returns an error if the file cannot be memory mapped.
+    ///
+    /// # Example
+    ///
+    /// ```ignore
+    /// let reader = BytesBufferedReader::from_file_mmap_path("large_file.bin", 0, 1024).await?;
+    /// ```
+    #[cfg(unix)]
+    // SAFETY: The mmap is created from a read-only file handle for the
+    // caller-provided range, then copied into owned `Bytes` before the file and
+    // mapping are dropped.
+    #[allow(unsafe_code)]
+    pub async fn from_file_mmap_path(path: &std::path::Path, offset: u64, size: usize) -> Result<Self, ZeroCopyReadError> {
+        use memmap2::MmapOptions;
+
+        let path = path.to_path_buf();
+        let (offset, size) = (offset, size);
+
+        tokio::task::spawn_blocking(move || {
+            // Open the file in sync context
+            let std_file = std::fs::File::open(&path).map_err(|e| ZeroCopyReadError::Io(e.to_string()))?;
+
+            // SAFETY: `std_file` remains open while the mapping is created and
+            // copied, and the mapped bytes are not exposed beyond this closure.
+            let mmap = unsafe { MmapOptions::new().offset(offset).len(size).map(&std_file) }
+                .map_err(|e| ZeroCopyReadError::Mmap(e.to_string()))?;
+
+            // Convert to Bytes (this is a copy, but only done once)
+            Ok(Self {
+                data: Bytes::copy_from_slice(&mmap),
+                pos: 0,
+            })
+        })
+        .await
+        .map_err(|e| ZeroCopyReadError::Io(e.to_string()))?
+    }
+
+    /// Create a Bytes-backed reader from a file using normal reads.
+    ///
+    /// This path reads the requested range into an owned buffer and wraps it in
+    /// `Bytes`. It does not perform mmap or zero-copy file I/O.
+    ///
+    /// # Arguments
+    ///
+    /// * `file` - File to read from
+    /// * `offset` - Offset within the file to start reading
+    /// * `size` - Number of bytes to map
+    ///
+    /// # Returns
+    ///
+    /// A reader backed by copied file data.
+    ///
+    /// # Errors
+    ///
+    /// Returns an error if the file cannot be read.
+    ///
+    /// # Example
+    ///
+    /// ```ignore
+    /// let file = tokio::fs::File::open("large_file.bin").await?;
+    /// let reader = BytesBufferedReader::from_file_read(&file, 0, 1024).await?;
+    /// ```
+    #[cfg(unix)]
+    pub async fn from_file_read(file: &tokio::fs::File, offset: u64, size: usize) -> Result<Self, ZeroCopyReadError> {
+        use tokio::io::{AsyncReadExt, AsyncSeekExt, SeekFrom};
+
+        let mut cloned = file.try_clone().await?;
+        cloned.seek(SeekFrom::Start(offset)).await?;
+
+        let mut buffer = vec![0u8; size];
+        cloned.read_exact(&mut buffer).await?;
+
+        Ok(Self {
+            data: Bytes::from(buffer),
+            pos: 0,
+        })
+    }
+
+    /// Create a Bytes-backed reader from a file (non-Unix fallback).
+    ///
+    /// On platforms that don't support mmap, this falls back to regular file I/O.
+    #[cfg(not(unix))]
+    pub async fn from_file_read(file: &tokio::fs::File, offset: u64, size: usize) -> Result<Self, ZeroCopyReadError> {
+        use tokio::io::{AsyncReadExt, AsyncSeekExt, SeekFrom};
+
+        let mut cloned = file.try_clone().await?;
+        cloned.seek(SeekFrom::Start(offset)).await?;
+
+        let mut buffer = vec![0u8; size];
+        cloned.read_exact(&mut buffer).await?;
+
+        Ok(Self {
+            data: Bytes::from(buffer),
+            pos: 0,
+        })
+    }
+
+    /// Historical name for `from_file_read`.
+    #[deprecated(
+        since = "1.0.0-beta.8",
+        note = "use from_file_read; this method performs normal reads into owned Bytes"
+    )]
+    pub async fn from_file_mmap(file: &tokio::fs::File, offset: u64, size: usize) -> Result<Self, ZeroCopyReadError> {
+        Self::from_file_read(file, offset, size).await
+    }
+
+    /// Get the remaining data as Bytes (zero-copy).
+    ///
+    /// This returns a slice of the remaining data without copying.
+    /// The returned Bytes shares the underlying memory with this reader.
+    ///
+    /// # Example
+    ///
+    /// ```ignore
+    /// let remaining = reader.remaining_bytes();
+    /// println!("Remaining: {} bytes", remaining.len());
+    /// ```
+    pub fn remaining_bytes(&self) -> Bytes {
+        self.data.slice(self.pos..)
+    }
+
+    /// Get the total length of the data.
+    pub fn len(&self) -> usize {
+        self.data.len()
+    }
+
+    /// Check if the reader has reached the end.
+    pub fn is_empty(&self) -> bool {
+        self.pos >= self.data.len()
+    }
+
+    /// Get the current read position.
+    pub fn position(&self) -> usize {
+        self.pos
+    }
+}
+
+impl AsyncRead for BytesBufferedReader {
+    fn poll_read(mut self: Pin<&mut Self>, _cx: &mut Context<'_>, buf: &mut ReadBuf<'_>) -> Poll<io::Result<()>> {
+        let remaining = self.data.len() - self.pos;
+        if remaining == 0 {
+            return Poll::Ready(Ok(()));
+        }
+
+        let to_read = std::cmp::min(remaining, buf.remaining());
+        let slice = &self.data[self.pos..self.pos + to_read];
+        buf.put_slice(slice);
+        self.pos += to_read;
+
+        Poll::Ready(Ok(()))
+    }
+}
+
+impl std::fmt::Debug for BytesBufferedReader {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.debug_struct("BytesBufferedReader")
+            .field("data_len", &self.data.len())
+            .field("pos", &self.pos)
+            .field("remaining", &(self.data.len() - self.pos))
+            .finish()
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use std::path::PathBuf;
+    use tokio::io::AsyncReadExt;
+
+    fn temp_file_path(test_name: &str) -> PathBuf {
+        let nonce = std::time::SystemTime::now()
+            .duration_since(std::time::UNIX_EPOCH)
+            .expect("system time should be after unix epoch")
+            .as_nanos();
+        std::env::temp_dir().join(format!("rustfs-io-core-{test_name}-{}-{nonce}", std::process::id()))
+    }
+
+    #[tokio::test]
+    async fn test_from_bytes() {
+        let data = Bytes::from("hello world");
+        let mut reader = BytesBufferedReader::from_bytes(data.clone());
+
+        let mut buf = [0u8; 11];
+        let n = reader.read(&mut buf[..]).await.unwrap();
+
+        assert_eq!(n, 11);
+        assert_eq!(&buf[..n], b"hello world");
+    }
+
+    #[tokio::test]
+    async fn test_preferred_reader_alias() {
+        let data = Bytes::from("hello world");
+        let mut reader = BytesBufferedReader::from_bytes(data);
+
+        let mut buf = [0u8; 5];
+        let n = reader.read(&mut buf[..]).await.expect("read bytes from alias");
+
+        assert_eq!(n, 5);
+        assert_eq!(&buf[..n], b"hello");
+    }
+
+    #[tokio::test]
+    async fn test_from_file_read_reads_requested_range() {
+        let path = temp_file_path("from-file-read");
+        tokio::fs::write(&path, b"hello world")
+            .await
+            .expect("write temp file for reader test");
+
+        let file = tokio::fs::File::open(&path).await.expect("open temp file for reader test");
+        let mut reader = BytesBufferedReader::from_file_read(&file, 6, 5)
+            .await
+            .expect("read requested range into Bytes");
+
+        let mut output = Vec::new();
+        reader.read_to_end(&mut output).await.expect("drain reader output");
+
+        assert_eq!(output, b"world");
+
+        let _ = tokio::fs::remove_file(path).await;
+    }
+
+    #[tokio::test]
+    #[allow(deprecated)]
+    async fn test_from_file_mmap_legacy_alias_reads_requested_range() {
+        let path = temp_file_path("from-file-mmap");
+        tokio::fs::write(&path, b"hello world")
+            .await
+            .expect("write temp file for legacy reader test");
+
+        let file = tokio::fs::File::open(&path)
+            .await
+            .expect("open temp file for legacy reader test");
+        let mut reader = BytesBufferedReader::from_file_mmap(&file, 0, 5)
+            .await
+            .expect("read requested range through legacy alias");
+
+        let mut output = Vec::new();
+        reader.read_to_end(&mut output).await.expect("drain legacy reader output");
+
+        assert_eq!(output, b"hello");
+
+        let _ = tokio::fs::remove_file(path).await;
+    }
+
+    #[tokio::test]
+    async fn test_remaining_bytes() {
+        let data = Bytes::from("hello world");
+        let reader = BytesBufferedReader::from_bytes(data);
+
+        let remaining = reader.remaining_bytes();
+        assert_eq!(remaining.len(), 11);
+        assert_eq!(&remaining[..], b"hello world");
+    }
+
+    #[tokio::test]
+    async fn test_position() {
+        let data = Bytes::from("hello world");
+        let mut reader = BytesBufferedReader::from_bytes(data);
+
+        assert_eq!(reader.position(), 0);
+
+        let mut buf = [0u8; 5];
+        reader.read_exact(&mut buf[..]).await.unwrap();
+
+        assert_eq!(reader.position(), 5);
+    }
+
+    #[tokio::test]
+    async fn test_is_empty() {
+        let data = Bytes::from("");
+        let reader = BytesBufferedReader::from_bytes(data);
+        assert!(reader.is_empty());
+
+        let data = Bytes::from("hello");
+        let reader = BytesBufferedReader::from_bytes(data);
+        assert!(!reader.is_empty());
+    }
+
+    #[tokio::test]
+    #[allow(deprecated)]
+    async fn test_legacy_reader_alias() {
+        let data = Bytes::from("hello world");
+        let mut reader = ZeroCopyObjectReader::from_bytes(data);
+
+        let mut buf = [0u8; 5];
+        let n = reader.read(&mut buf[..]).await.expect("read bytes through legacy alias");
+
+        assert_eq!(n, 5);
+        assert_eq!(&buf[..n], b"hello");
+    }
+}

crates/io-core/src/scheduler.rs

@@ -0,0 +1,882 @@
+// Copyright 2024 RustFS Team
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+//! I/O scheduler for adaptive buffer sizing and load management.
+//!
+//! This module provides the core I/O scheduling logic that determines
+//! optimal buffer sizes, I/O strategies, and load management decisions.
+
+use crate::config::IoSchedulerConfig;
+use crate::io_profile::{AccessPattern, StorageMedia, StorageProfile};
+use std::sync::atomic::{AtomicUsize, Ordering};
+use std::time::Duration;
+
+/// I/O priority levels.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash, Default)]
+pub enum IoPriority {
+    /// High priority for small, latency-sensitive operations.
+    High,
+    /// Normal priority for standard operations.
+    #[default]
+    Normal,
+    /// Low priority for large, throughput-oriented operations.
+    Low,
+}
+
+impl IoPriority {
+    /// Determine priority based on request size.
+    ///
+    /// A negative `size` means the size is unknown (-1 by convention) and maps
+    /// to `Normal`; casting it to `usize` would wrap to a huge value and
+    /// misclassify the request as `Low`.
+    pub fn from_size(size: i64, high_threshold: usize, low_threshold: usize) -> Self {
+        if size < 0 {
+            return IoPriority::Normal;
+        }
+        let size = size as usize;
+        if size < high_threshold {
+            IoPriority::High
+        } else if size > low_threshold {
+            IoPriority::Low
+        } else {
+            IoPriority::Normal
+        }
+    }
+
+    /// Get the priority as a string for metrics labels.
+    pub fn as_str(&self) -> &'static str {
+        match self {
+            IoPriority::High => "high",
+            IoPriority::Normal => "normal",
+            IoPriority::Low => "low",
+        }
+    }
+
+    /// Check if this is high priority.
+    pub fn is_high(&self) -> bool {
+        matches!(self, IoPriority::High)
+    }
+
+    /// Check if this is normal priority.
+    pub fn is_normal(&self) -> bool {
+        matches!(self, IoPriority::Normal)
+    }
+
+    /// Check if this is low priority.
+    pub fn is_low(&self) -> bool {
+        matches!(self, IoPriority::Low)
+    }
+}
+
+impl std::fmt::Display for IoPriority {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        write!(f, "{}", self.as_str())
+    }
+}
+
+/// I/O load level.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash, PartialOrd, Default)]
+pub enum IoLoadLevel {
+    /// Low load - system is underutilized.
+    Low,
+    /// Medium load - system is moderately utilized.
+    #[default]
+    Medium,
+    /// High load - system is heavily utilized.
+    High,
+    /// Critical load - system is overloaded.
+    Critical,
+}
+
+impl IoLoadLevel {
+    /// Get the load level as a string for metrics labels.
+    pub fn as_str(&self) -> &'static str {
+        match self {
+            IoLoadLevel::Low => "low",
+            IoLoadLevel::Medium => "medium",
+            IoLoadLevel::High => "high",
+            IoLoadLevel::Critical => "critical",
+        }
+    }
+
+    /// Determine load level from wait time.
+    pub fn from_wait_time(wait_time: Duration, low_threshold: Duration, high_threshold: Duration) -> Self {
+        if wait_time <= low_threshold {
+            IoLoadLevel::Low
+        } else if wait_time <= high_threshold {
+            IoLoadLevel::Medium
+        } else if wait_time <= high_threshold * 2 {
+            IoLoadLevel::High
+        } else {
+            IoLoadLevel::Critical
+        }
+    }
+}
+
+impl std::fmt::Display for IoLoadLevel {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        write!(f, "{}", self.as_str())
+    }
+}
+
+/// Bandwidth tier classification.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash, Default)]
+pub enum BandwidthTier {
+    /// Low bandwidth (< 100 MB/s).
+    Low,
+    /// Medium bandwidth (100-500 MB/s).
+    #[default]
+    Medium,
+    /// High bandwidth (> 500 MB/s).
+    High,
+    /// Unknown bandwidth.
+    Unknown,
+}
+
+impl BandwidthTier {
+    /// Determine bandwidth tier from bytes per second.
+    pub fn from_bps(bps: u64) -> Self {
+        const MB: u64 = 1024 * 1024;
+        if bps < 100 * MB {
+            BandwidthTier::Low
+        } else if bps < 500 * MB {
+            BandwidthTier::Medium
+        } else {
+            BandwidthTier::High
+        }
+    }
+
+    /// Get the tier as a string for metrics labels.
+    pub fn as_str(&self) -> &'static str {
+        match self {
+            BandwidthTier::Low => "low",
+            BandwidthTier::Medium => "medium",
+            BandwidthTier::High => "high",
+            BandwidthTier::Unknown => "unknown",
+        }
+    }
+}
+
+/// I/O strategy decision.
+#[derive(Debug, Clone)]
+pub struct IoStrategy {
+    /// Buffer size to use for I/O operations.
+    pub buffer_size: usize,
+    /// Buffer multiplier based on storage media.
+    pub buffer_multiplier: f64,
+    /// Whether to enable readahead.
+    pub enable_readahead: bool,
+    /// Whether to use buffered I/O.
+    pub use_buffered_io: bool,
+
+    // Performance state
+    /// Current number of concurrent requests.
+    pub concurrent_requests: usize,
+    /// Observed bandwidth in bytes per second.
+    pub observed_bandwidth_bps: Option<u64>,
+    /// Bandwidth tier classification.
+    pub bandwidth_tier: BandwidthTier,
+    /// Current load level.
+    pub load_level: IoLoadLevel,
+
+    // Priority
+    /// I/O priority for this operation.
+    pub priority: IoPriority,
+
+    // Decision flags
+    /// Whether to throttle random I/O.
+    pub should_throttle_random_io: bool,
+    /// Whether to expand buffer for sequential access.
+    pub should_expand_for_sequential: bool,
+    /// Whether to reduce buffer due to concurrency.
+    pub should_reduce_for_concurrency: bool,
+    /// Whether to reduce buffer due to low bandwidth.
+    pub should_reduce_for_bandwidth: bool,
+}
+
+impl Default for IoStrategy {
+    fn default() -> Self {
+        Self {
+            buffer_size: 128 * 1024,
+            buffer_multiplier: 1.0,
+            enable_readahead: true,
+            use_buffered_io: true,
+            concurrent_requests: 0,
+            observed_bandwidth_bps: None,
+            bandwidth_tier: BandwidthTier::Medium,
+            load_level: IoLoadLevel::Low,
+            priority: IoPriority::Normal,
+            should_throttle_random_io: false,
+            should_expand_for_sequential: false,
+            should_reduce_for_concurrency: false,
+            should_reduce_for_bandwidth: false,
+        }
+    }
+}
+
+impl IoStrategy {
+    /// Create a new strategy with default values.
+    pub fn new() -> Self {
+        Self::default()
+    }
+
+    /// Create a strategy for sequential access.
+    pub fn sequential(buffer_size: usize) -> Self {
+        Self {
+            buffer_size,
+            enable_readahead: true,
+            should_expand_for_sequential: true,
+            ..Self::default()
+        }
+    }
+
+    /// Create a strategy for random access.
+    pub fn random(buffer_size: usize) -> Self {
+        Self {
+            buffer_size,
+            enable_readahead: false,
+            should_throttle_random_io: true,
+            ..Self::default()
+        }
+    }
+}
+
+/// I/O load metrics.
+#[derive(Debug, Clone, Default)]
+pub struct IoLoadMetrics {
+    /// Number of samples in the current window.
+    pub sample_count: usize,
+    /// Total wait time in the window.
+    pub total_wait_time: Duration,
+    /// Maximum wait time in the window.
+    pub max_wait_time: Duration,
+    /// Average wait time.
+    pub avg_wait_time: Duration,
+    /// Current load level.
+    pub load_level: IoLoadLevel,
+}
+
+impl IoLoadMetrics {
+    /// Create new load metrics.
+    pub fn new() -> Self {
+        Self::default()
+    }
+
+    /// Add a wait time sample.
+    pub fn add_sample(&mut self, wait_time: Duration) {
+        self.sample_count += 1;
+        self.total_wait_time += wait_time;
+        if wait_time > self.max_wait_time {
+            self.max_wait_time = wait_time;
+        }
+        self.avg_wait_time = if self.sample_count > 0 {
+            self.total_wait_time / self.sample_count as u32
+        } else {
+            Duration::ZERO
+        };
+    }
+
+    /// Update load level based on thresholds.
+    pub fn update_load_level(&mut self, low_threshold: Duration, high_threshold: Duration) {
+        self.load_level = IoLoadLevel::from_wait_time(self.avg_wait_time, low_threshold, high_threshold);
+    }
+
+    /// Reset the metrics.
+    pub fn reset(&mut self) {
+        *self = Self::default();
+    }
+}
+
+/// I/O scheduler.
+pub struct IoScheduler {
+    /// Scheduler configuration.
+    config: IoSchedulerConfig,
+    /// Active request counter.
+    active_requests: AtomicUsize,
+    /// Load metrics.
+    load_metrics: std::sync::Mutex<IoLoadMetrics>,
+}
+
+impl IoScheduler {
+    /// Create a new I/O scheduler with the given configuration.
+    pub fn new(config: IoSchedulerConfig) -> Self {
+        Self {
+            config,
+            active_requests: AtomicUsize::new(0),
+            load_metrics: std::sync::Mutex::new(IoLoadMetrics::new()),
+        }
+    }
+
+    /// Create a new I/O scheduler with default configuration.
+    pub fn with_defaults() -> Self {
+        Self::new(IoSchedulerConfig::default())
+    }
+
+    /// Get the scheduler configuration.
+    pub fn config(&self) -> &IoSchedulerConfig {
+        &self.config
+    }
+
+    /// Get the current number of active requests.
+    pub fn active_requests(&self) -> usize {
+        self.active_requests.load(Ordering::Relaxed)
+    }
+
+    /// Increment the active request count.
+    pub fn increment_requests(&self) {
+        self.active_requests.fetch_add(1, Ordering::Relaxed);
+    }
+
+    /// Decrement the active request count.
+    pub fn decrement_requests(&self) {
+        self.active_requests.fetch_sub(1, Ordering::Relaxed);
+    }
+
+    /// Calculate I/O strategy for a request.
+    pub fn calculate_strategy(&self, file_size: i64, permit_wait_time: Duration, is_sequential: bool) -> IoStrategy {
+        let concurrent_requests = self.active_requests.load(Ordering::Relaxed);
+
+        // Determine priority based on file size
+        let priority = IoPriority::from_size(
+            file_size,
+            self.config.high_priority_size_threshold,
+            self.config.low_priority_size_threshold,
+        );
+
+        // Determine load level
+        let load_level =
+            IoLoadLevel::from_wait_time(permit_wait_time, self.config.load_low_threshold(), self.config.load_high_threshold());
+
+        // Calculate base buffer size
+        let base_buffer = self.config.base_buffer_size;
+
+        // Adjust for concurrency
+        let concurrency_factor = match concurrent_requests {
+            0..=2 => 1.0,
+            3..=4 => 0.75,
+            5..=8 => 0.5,
+            _ => 0.4,
+        };
+
+        // Adjust for load level
+        let load_factor = match load_level {
+            IoLoadLevel::Low => 1.2,
+            IoLoadLevel::Medium => 1.0,
+            IoLoadLevel::High => 0.7,
+            IoLoadLevel::Critical => 0.5,
+        };
+
+        // Adjust for access pattern
+        let sequential_factor = if is_sequential { 1.5 } else { 1.0 };
+
+        // Calculate final buffer size
+        let buffer_size = (base_buffer as f64 * concurrency_factor * load_factor * sequential_factor) as usize;
+        let buffer_size = buffer_size.clamp(self.config.min_buffer_size, self.config.max_buffer_size);
+
+        IoStrategy {
+            buffer_size,
+            buffer_multiplier: concurrency_factor * load_factor * sequential_factor,
+            enable_readahead: is_sequential && load_level != IoLoadLevel::Critical,
+            use_buffered_io: true,
+            concurrent_requests,
+            observed_bandwidth_bps: None,
+            bandwidth_tier: BandwidthTier::Unknown,
+            load_level,
+            priority,
+            should_throttle_random_io: !is_sequential && load_level >= IoLoadLevel::High,
+            should_expand_for_sequential: is_sequential && load_level <= IoLoadLevel::Medium,
+            should_reduce_for_concurrency: concurrent_requests > 4,
+            should_reduce_for_bandwidth: false,
+        }
+    }
+
+    /// Calculate multi-factor I/O strategy.
+    pub fn calculate_multi_factor_strategy(
+        &self,
+        file_size: i64,
+        permit_wait_time: Duration,
+        is_sequential: bool,
+        storage_profile: Option<&StorageProfile>,
+    ) -> IoStrategy {
+        let mut strategy = self.calculate_strategy(file_size, permit_wait_time, is_sequential);
+
+        // Apply storage profile adjustments
+        if let Some(profile) = storage_profile {
+            // Adjust buffer size based on storage media
+            let media_factor = match profile.media {
+                StorageMedia::Nvme => 1.5,
+                StorageMedia::Ssd => 1.2,
+                StorageMedia::Hdd => 0.8,
+                StorageMedia::Unknown => 1.0,
+            };
+
+            strategy.buffer_size = (strategy.buffer_size as f64 * media_factor).min(self.config.max_buffer_size as f64) as usize;
+
+            // Apply sequential boost if applicable
+            if is_sequential {
+                strategy.buffer_size = (strategy.buffer_size as f64 * profile.sequential_boost_multiplier)
+                    .min(self.config.max_buffer_size as f64) as usize;
+            }
+
+            // Apply random penalty if applicable
+            if !is_sequential {
+                strategy.buffer_size = (strategy.buffer_size as f64 * profile.random_penalty_multiplier)
+                    .max(self.config.min_buffer_size as f64) as usize;
+            }
+
+            // Update readahead preference
+            strategy.enable_readahead = strategy.enable_readahead && profile.prefers_readahead;
+        }
+
+        strategy
+    }
+
+    /// Record a wait time sample for load tracking.
+    pub fn record_wait_time(&self, wait_time: Duration) {
+        if let Ok(mut metrics) = self.load_metrics.lock() {
+            metrics.add_sample(wait_time);
+            metrics.update_load_level(self.config.load_low_threshold(), self.config.load_high_threshold());
+        }
+    }
+
+    /// Get current load metrics.
+    pub fn load_metrics(&self) -> IoLoadMetrics {
+        if let Ok(metrics) = self.load_metrics.lock() {
+            metrics.clone()
+        } else {
+            IoLoadMetrics::default()
+        }
+    }
+}
+
+impl Default for IoScheduler {
+    fn default() -> Self {
+        Self::with_defaults()
+    }
+}
+
+// ============================================================================
+// Buffer Size Calculation Functions
+// ============================================================================
+
+/// Constants for buffer size calculations.
+pub const KI_B: usize = 1024;
+pub const MI_B: usize = 1024 * 1024;
+
+/// Get concurrency-aware buffer size.
+///
+/// Adjusts buffer size based on the current level of concurrent requests.
+/// Higher concurrency leads to smaller buffers to reduce memory pressure.
+///
+/// # Arguments
+///
+/// * `file_size` - Size of the file being read (-1 if unknown)
+/// * `base_buffer_size` - Base buffer size from workload profile
+///
+/// # Returns
+///
+/// Adjusted buffer size in bytes
+pub fn get_concurrency_aware_buffer_size(file_size: i64, base_buffer_size: usize) -> usize {
+    // Get current concurrency level from global counter
+    let concurrent_requests = 1; // Default to 1 if no global counter available
+
+    // Define concurrency thresholds
+    let medium_threshold = 4;
+    let high_threshold = 8;
+
+    // Calculate adaptive multiplier based on concurrency
+    let adaptive_multiplier = if concurrent_requests <= 2 {
+        // Low concurrency (1-2): use full buffer size
+        1.0
+    } else if concurrent_requests <= medium_threshold {
+        // Medium concurrency (3-4): slightly reduce buffer size (75% of base)
+        0.75
+    } else if concurrent_requests <= high_threshold {
+        // Higher concurrency (5-8): more aggressive reduction (50% of base)
+        0.5
+    } else {
+        // Very high concurrency (>8): minimize memory per request (40% of base)
+        0.4
+    };
+
+    // Calculate the adjusted buffer size
+    let adjusted_size = (base_buffer_size as f64 * adaptive_multiplier) as usize;
+
+    // Ensure we stay within reasonable bounds
+    let min_buffer = if file_size > 0 && file_size < 100 * KI_B as i64 {
+        32 * KI_B // For very small files, use minimum buffer
+    } else {
+        64 * KI_B // Standard minimum buffer size
+    };
+
+    let max_buffer = if concurrent_requests > high_threshold {
+        256 * KI_B // Cap at 256KB for high concurrency
+    } else {
+        MI_B // Cap at 1MB for lower concurrency
+    };
+
+    adjusted_size.clamp(min_buffer, max_buffer)
+}
+
+/// Advanced concurrency-aware buffer sizing with file size optimization.
+///
+/// This enhanced version considers both concurrency level and file size patterns
+/// to provide even better performance characteristics.
+///
+/// # Arguments
+///
+/// * `file_size` - Size of the file being read (-1 if unknown)
+/// * `base_buffer_size` - Baseline buffer size from workload profile
+/// * `is_sequential` - Whether this is a sequential read (hint for optimization)
+/// * `concurrent_requests` - Current number of concurrent requests
+///
+/// # Returns
+///
+/// Optimized buffer size in bytes
+pub fn get_advanced_buffer_size(
+    file_size: i64,
+    base_buffer_size: usize,
+    is_sequential: bool,
+    concurrent_requests: usize,
+) -> usize {
+    // For very small files, use smaller buffers regardless of concurrency
+    if file_size > 0 && file_size < 256 * KI_B as i64 {
+        return (file_size as usize / 4).clamp(16 * KI_B, 64 * KI_B);
+    }
+
+    // Base calculation from standard function
+    let standard_size = get_concurrency_aware_buffer_size(file_size, base_buffer_size);
+
+    let medium_threshold = 4;
+    let high_threshold = 8;
+
+    // For sequential reads, we can be more aggressive with buffer sizes
+    if is_sequential && concurrent_requests <= medium_threshold {
+        // Boost buffer size for sequential reads under low concurrency
+        let boosted = (standard_size as f64 * 1.5) as usize;
+        return boosted.min(MI_B);
+    }
+
+    // For random reads under high concurrency, reduce buffer size
+    if !is_sequential && concurrent_requests > high_threshold {
+        let reduced = (standard_size as f64 * 0.7) as usize;
+        return reduced.max(32 * KI_B);
+    }
+
+    standard_size
+}
+
+/// Get buffer size with storage media optimization.
+///
+/// Adjusts buffer size based on storage media characteristics.
+///
+/// # Arguments
+///
+/// * `base_size` - Base buffer size
+/// * `media` - Storage media type
+///
+/// # Returns
+///
+/// Optimized buffer size for the storage media
+pub fn get_buffer_size_for_media(base_size: usize, media: StorageMedia) -> usize {
+    let multiplier = match media {
+        StorageMedia::Nvme => 1.5, // NVMe can handle larger buffers
+        StorageMedia::Ssd => 1.2,  // SSD benefits from moderate buffers
+        StorageMedia::Hdd => 0.8,  // HDD prefers smaller buffers to reduce seek overhead
+        StorageMedia::Unknown => 1.0,
+    };
+
+    (base_size as f64 * multiplier).min(MI_B as f64) as usize
+}
+
+/// Calculate optimal buffer size using multi-factor analysis.
+///
+/// This is the main entry point for buffer size calculation, considering
+/// all factors: concurrency, storage media, access pattern, and load.
+///
+/// # Arguments
+///
+/// * `file_size` - Size of the file being read
+/// * `base_buffer_size` - Base buffer size
+/// * `is_sequential` - Whether access is sequential
+/// * `concurrent_requests` - Current concurrency level
+/// * `media` - Storage media type
+/// * `load_level` - Current I/O load level
+///
+/// # Returns
+///
+/// Optimally calculated buffer size
+pub fn calculate_optimal_buffer_size(
+    file_size: i64,
+    base_buffer_size: usize,
+    is_sequential: bool,
+    concurrent_requests: usize,
+    media: StorageMedia,
+    load_level: IoLoadLevel,
+) -> usize {
+    // Start with advanced buffer size calculation
+    let mut buffer_size = get_advanced_buffer_size(file_size, base_buffer_size, is_sequential, concurrent_requests);
+
+    // Apply storage media optimization
+    buffer_size = get_buffer_size_for_media(buffer_size, media);
+
+    // Apply load-based adjustment
+    let load_multiplier = match load_level {
+        IoLoadLevel::Low => 1.2,
+        IoLoadLevel::Medium => 1.0,
+        IoLoadLevel::High => 0.7,
+        IoLoadLevel::Critical => 0.5,
+    };
+
+    buffer_size = (buffer_size as f64 * load_multiplier) as usize;
+
+    // Final bounds check
+    buffer_size.clamp(32 * KI_B, MI_B)
+}
+
+/// I/O scheduling context for multi-factor strategy calculation.
+#[derive(Debug, Clone)]
+pub struct IoSchedulingContext {
+    /// File size in bytes (-1 if unknown).
+    pub file_size: i64,
+    /// Base buffer size from configuration.
+    pub base_buffer_size: usize,
+    /// Time spent waiting for permit.
+    pub permit_wait_duration: Duration,
+    /// Whether access is sequential.
+    pub is_sequential_hint: bool,
+    /// Detected access pattern.
+    pub access_pattern: AccessPattern,
+    /// Detected storage media.
+    pub storage_media: StorageMedia,
+    /// Observed bandwidth in bytes per second.
+    pub observed_bandwidth_bps: Option<u64>,
+    /// Current concurrent request count.
+    pub concurrent_requests: usize,
+}
+
+impl Default for IoSchedulingContext {
+    fn default() -> Self {
+        Self {
+            file_size: -1,
+            base_buffer_size: 128 * KI_B,
+            permit_wait_duration: Duration::ZERO,
+            is_sequential_hint: true,
+            access_pattern: AccessPattern::Unknown,
+            storage_media: StorageMedia::Unknown,
+            observed_bandwidth_bps: None,
+            concurrent_requests: 1,
+        }
+    }
+}
+
+impl IoSchedulingContext {
+    /// Create a new scheduling context.
+    pub fn new(file_size: i64, base_buffer_size: usize) -> Self {
+        Self {
+            file_size,
+            base_buffer_size,
+            ..Self::default()
+        }
+    }
+
+    /// Builder pattern: set sequential hint.
+    pub fn with_sequential(mut self, is_sequential: bool) -> Self {
+        self.is_sequential_hint = is_sequential;
+        self.access_pattern = if is_sequential {
+            AccessPattern::Sequential
+        } else {
+            AccessPattern::Random
+        };
+        self
+    }
+
+    /// Builder pattern: set storage media.
+    pub fn with_media(mut self, media: StorageMedia) -> Self {
+        self.storage_media = media;
+        self
+    }
+
+    /// Builder pattern: set bandwidth.
+    pub fn with_bandwidth(mut self, bps: u64) -> Self {
+        self.observed_bandwidth_bps = Some(bps);
+        self
+    }
+
+    /// Builder pattern: set concurrency.
+    pub fn with_concurrency(mut self, count: usize) -> Self {
+        self.concurrent_requests = count;
+        self
+    }
+
+    /// Builder pattern: set wait duration.
+    pub fn with_wait_duration(mut self, duration: Duration) -> Self {
+        self.permit_wait_duration = duration;
+        self
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn test_io_priority() {
+        assert_eq!(IoPriority::from_size(1024, 64 * 1024, 4 * 1024 * 1024), IoPriority::High);
+        assert_eq!(IoPriority::from_size(1024 * 1024, 64 * 1024, 4 * 1024 * 1024), IoPriority::Normal);
+        assert_eq!(IoPriority::from_size(10 * 1024 * 1024, 64 * 1024, 4 * 1024 * 1024), IoPriority::Low);
+    }
+
+    #[test]
+    fn test_io_priority_unknown_size_is_normal() {
+        // -1 means "size unknown" and must not wrap to usize::MAX (=> Low).
+        assert_eq!(IoPriority::from_size(-1, 64 * 1024, 4 * 1024 * 1024), IoPriority::Normal);
+        assert_eq!(IoPriority::from_size(i64::MIN, 64 * 1024, 4 * 1024 * 1024), IoPriority::Normal);
+    }
+
+    #[test]
+    fn test_io_load_level() {
+        let low = Duration::from_millis(5);
+        let high = Duration::from_millis(50);
+
+        assert_eq!(IoLoadLevel::from_wait_time(Duration::from_millis(1), low, high), IoLoadLevel::Low);
+        assert_eq!(IoLoadLevel::from_wait_time(Duration::from_millis(20), low, high), IoLoadLevel::Medium);
+        assert_eq!(IoLoadLevel::from_wait_time(Duration::from_millis(60), low, high), IoLoadLevel::High);
+        assert_eq!(IoLoadLevel::from_wait_time(Duration::from_millis(150), low, high), IoLoadLevel::Critical);
+    }
+
+    #[test]
+    fn test_bandwidth_tier() {
+        assert_eq!(BandwidthTier::from_bps(50 * 1024 * 1024), BandwidthTier::Low);
+        assert_eq!(BandwidthTier::from_bps(200 * 1024 * 1024), BandwidthTier::Medium);
+        assert_eq!(BandwidthTier::from_bps(600 * 1024 * 1024), BandwidthTier::High);
+    }
+
+    #[test]
+    fn test_io_strategy_default() {
+        let strategy = IoStrategy::default();
+        assert!(strategy.buffer_size > 0);
+        assert!(strategy.enable_readahead);
+    }
+
+    #[test]
+    fn test_io_scheduler() {
+        let scheduler = IoScheduler::with_defaults();
+
+        let strategy = scheduler.calculate_strategy(1024 * 1024, Duration::from_millis(5), true);
+        assert!(strategy.buffer_size > 0);
+        assert!(strategy.enable_readahead);
+        assert_eq!(strategy.load_level, IoLoadLevel::Low);
+    }
+
+    #[test]
+    fn test_io_scheduler_with_concurrency() {
+        let scheduler = IoScheduler::with_defaults();
+
+        // Simulate concurrent requests
+        scheduler.increment_requests();
+        scheduler.increment_requests();
+        scheduler.increment_requests();
+
+        let strategy = scheduler.calculate_strategy(1024 * 1024, Duration::from_millis(5), true);
+        assert_eq!(strategy.concurrent_requests, 3);
+    }
+
+    #[test]
+    fn test_load_metrics() {
+        let mut metrics = IoLoadMetrics::new();
+
+        metrics.add_sample(Duration::from_millis(10));
+        metrics.add_sample(Duration::from_millis(20));
+        metrics.add_sample(Duration::from_millis(30));
+
+        assert_eq!(metrics.sample_count, 3);
+        assert_eq!(metrics.avg_wait_time, Duration::from_millis(20));
+        assert_eq!(metrics.max_wait_time, Duration::from_millis(30));
+    }
+
+    #[test]
+    fn test_get_concurrency_aware_buffer_size() {
+        // Test with default concurrency (1)
+        let size = get_concurrency_aware_buffer_size(1024 * 1024, 128 * KI_B);
+        assert!(size >= 64 * KI_B);
+        assert!(size <= MI_B);
+
+        // Test with small file
+        let size = get_concurrency_aware_buffer_size(50 * KI_B as i64, 128 * KI_B);
+        assert!(size >= 32 * KI_B);
+    }
+
+    #[test]
+    fn test_get_advanced_buffer_size() {
+        // Sequential read with low concurrency
+        let size = get_advanced_buffer_size(10 * MI_B as i64, 128 * KI_B, true, 2);
+        assert!(size >= 128 * KI_B);
+
+        // Random read with high concurrency
+        let size = get_advanced_buffer_size(10 * MI_B as i64, 128 * KI_B, false, 10);
+        assert!(size >= 32 * KI_B);
+
+        // Very small file
+        let size = get_advanced_buffer_size(100 * KI_B as i64, 128 * KI_B, true, 1);
+        assert!(size <= 64 * KI_B);
+    }
+
+    #[test]
+    fn test_get_buffer_size_for_media() {
+        let base = 128 * KI_B;
+
+        // NVMe should get larger buffers
+        let nvme_size = get_buffer_size_for_media(base, StorageMedia::Nvme);
+        assert!(nvme_size > base);
+
+        // SSD should get slightly larger buffers
+        let ssd_size = get_buffer_size_for_media(base, StorageMedia::Ssd);
+        assert!(ssd_size > base);
+
+        // HDD should get smaller buffers
+        let hdd_size = get_buffer_size_for_media(base, StorageMedia::Hdd);
+        assert!(hdd_size < base);
+    }
+
+    #[test]
+    fn test_calculate_optimal_buffer_size() {
+        // Low load, sequential, NVMe
+        let size = calculate_optimal_buffer_size(10 * MI_B as i64, 128 * KI_B, true, 2, StorageMedia::Nvme, IoLoadLevel::Low);
+        assert!(size >= 32 * KI_B);
+        assert!(size <= MI_B);
+
+        // Critical load, random, HDD
+        let size =
+            calculate_optimal_buffer_size(10 * MI_B as i64, 128 * KI_B, false, 10, StorageMedia::Hdd, IoLoadLevel::Critical);
+        assert!(size >= 32 * KI_B);
+        assert!(size <= MI_B);
+    }
+
+    #[test]
+    fn test_io_scheduling_context() {
+        let ctx = IoSchedulingContext::new(10 * MI_B as i64, 256 * KI_B)
+            .with_sequential(true)
+            .with_media(StorageMedia::Nvme)
+            .with_bandwidth(500 * MI_B as u64)
+            .with_concurrency(4);
+
+        assert_eq!(ctx.file_size, 10 * MI_B as i64);
+        assert_eq!(ctx.base_buffer_size, 256 * KI_B);
+        assert!(ctx.is_sequential_hint);
+        assert_eq!(ctx.storage_media, StorageMedia::Nvme);
+        assert_eq!(ctx.observed_bandwidth_bps, Some(500 * MI_B as u64));
+        assert_eq!(ctx.concurrent_requests, 4);
+    }
+}

crates/io-core/src/shared_memory.rs

@@ -0,0 +1,320 @@
+// Copyright 2024 RustFS Team
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+//! Shared memory pool for zero-copy data sharing.
+//!
+//! This module provides Arc-based shared memory management for
+//! efficient cross-task data passing without serialization.
+
+use std::convert::AsRef;
+use std::ops::Deref;
+use std::sync::Arc;
+use std::sync::atomic::{AtomicU64, Ordering};
+use std::time::Instant;
+
+/// Shared memory pool configuration.
+#[derive(Debug, Clone)]
+pub struct SharedMemoryConfig {
+    /// Whether shared memory is enabled
+    pub enabled: bool,
+
+    /// Maximum pool size in bytes
+    pub max_pool_size: usize,
+
+    /// Maximum object size in bytes
+    pub max_object_size: usize,
+}
+
+impl Default for SharedMemoryConfig {
+    fn default() -> Self {
+        Self {
+            enabled: true,
+            max_pool_size: 100 * 1024 * 1024,  // 100MB
+            max_object_size: 10 * 1024 * 1024, // 10MB
+        }
+    }
+}
+
+/// Shared memory pool statistics.
+#[derive(Debug, Default)]
+pub struct SharedMemoryStats {
+    /// Total number of objects created
+    pub total_objects: AtomicU64,
+
+    /// Total number of shared references
+    pub total_shared_refs: AtomicU64,
+
+    /// Current memory usage in bytes
+    pub current_memory: AtomicU64,
+
+    /// Peak memory usage in bytes
+    pub peak_memory: AtomicU64,
+}
+
+/// Arc data metadata.
+#[derive(Clone, Debug)]
+pub struct ArcMetadata {
+    /// Size of the data (if measurable)
+    pub size: Option<usize>,
+
+    /// Creation timestamp
+    pub created_at: Instant,
+}
+
+/// Arc-based data wrapper for zero-copy sharing.
+///
+/// This wrapper uses Arc to enable shared ownership of data
+/// across multiple tasks without copying.
+pub struct ArcData<T> {
+    /// The wrapped data
+    inner: Arc<T>,
+
+    /// Metadata about the data
+    metadata: ArcMetadata,
+}
+
+impl<T> Clone for ArcData<T> {
+    fn clone(&self) -> Self {
+        Self {
+            inner: Arc::clone(&self.inner),
+            metadata: self.metadata.clone(),
+        }
+    }
+}
+
+impl<T> ArcData<T> {
+    /// Create a new ArcData wrapper.
+    pub fn new(data: T) -> Self {
+        ArcData {
+            inner: Arc::new(data),
+            metadata: ArcMetadata {
+                size: None,
+                created_at: Instant::now(),
+            },
+        }
+    }
+
+    /// Create a new ArcData wrapper with known size.
+    pub fn with_size(data: T, size: usize) -> Self {
+        ArcData {
+            inner: Arc::new(data),
+            metadata: ArcMetadata {
+                size: Some(size),
+                created_at: Instant::now(),
+            },
+        }
+    }
+
+    /// Get the reference count.
+    pub fn ref_count(&self) -> usize {
+        Arc::strong_count(&self.inner)
+    }
+
+    /// Convert into the underlying Arc.
+    pub fn into_arc(self) -> Arc<T> {
+        self.inner
+    }
+
+    /// Get the metadata.
+    pub fn metadata(&self) -> &ArcMetadata {
+        &self.metadata
+    }
+
+    /// Get the size if known.
+    pub fn size(&self) -> Option<usize> {
+        self.metadata.size
+    }
+}
+
+impl<T> AsRef<T> for ArcData<T> {
+    fn as_ref(&self) -> &T {
+        &self.inner
+    }
+}
+
+impl<T> Deref for ArcData<T> {
+    type Target = T;
+
+    fn deref(&self) -> &Self::Target {
+        &self.inner
+    }
+}
+
+impl<T> std::fmt::Debug for ArcData<T> {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.debug_struct("ArcData")
+            .field("ref_count", &self.ref_count())
+            .field("metadata", &self.metadata)
+            .finish()
+    }
+}
+
+/// Shared memory pool for managing Arc-based shared data.
+pub struct SharedMemoryPool {
+    config: SharedMemoryConfig,
+    stats: SharedMemoryStats,
+}
+
+impl SharedMemoryPool {
+    /// Create a new shared memory pool with the given configuration.
+    pub fn new(config: SharedMemoryConfig) -> Self {
+        Self {
+            config,
+            stats: SharedMemoryStats::default(),
+        }
+    }
+
+    /// Create a new shared memory pool with default configuration.
+    pub fn with_defaults() -> Self {
+        Self::new(SharedMemoryConfig::default())
+    }
+
+    /// Create shared data.
+    ///
+    /// This method wraps the data in an ArcData for zero-copy sharing.
+    pub fn create<T>(&self, data: T) -> ArcData<T> {
+        self.stats.total_objects.fetch_add(1, Ordering::Relaxed);
+        ArcData::new(data)
+    }
+
+    /// Create shared data with known size.
+    ///
+    /// This method tracks memory usage for statistics.
+    pub fn create_with_size<T>(&self, data: T, size: usize) -> ArcData<T> {
+        self.stats.total_objects.fetch_add(1, Ordering::Relaxed);
+
+        // Update memory statistics
+        self.stats.current_memory.fetch_add(size as u64, Ordering::Relaxed);
+
+        // Update peak memory
+        let current = self.stats.current_memory.load(Ordering::Relaxed);
+        let mut peak = self.stats.peak_memory.load(Ordering::Relaxed);
+        if current > peak {
+            peak = current;
+            self.stats.peak_memory.store(peak, Ordering::Relaxed);
+        }
+
+        ArcData::with_size(data, size)
+    }
+
+    /// Share data by increasing reference count.
+    ///
+    /// This method creates a new ArcData that shares the underlying data
+    /// without copying.
+    pub fn share<T>(&self, data: &ArcData<T>) -> ArcData<T> {
+        self.stats.total_shared_refs.fetch_add(1, Ordering::Relaxed);
+        data.clone()
+    }
+
+    /// Get the statistics for this pool.
+    pub fn stats(&self) -> &SharedMemoryStats {
+        &self.stats
+    }
+
+    /// Get the configuration for this pool.
+    pub fn config(&self) -> &SharedMemoryConfig {
+        &self.config
+    }
+
+    /// Check if the pool is enabled.
+    pub fn is_enabled(&self) -> bool {
+        self.config.enabled
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn test_arc_data_new() {
+        let data = vec![1u8, 2, 3, 4, 5];
+        let arc_data = ArcData::new(data.clone());
+
+        assert_eq!(arc_data.as_ref(), &data);
+        assert_eq!(arc_data.ref_count(), 1);
+    }
+
+    #[test]
+    fn test_arc_data_clone() {
+        let data = vec![1u8, 2, 3, 4, 5];
+        let arc_data = ArcData::new(data);
+
+        assert_eq!(arc_data.ref_count(), 1);
+
+        let arc_data2 = arc_data.clone();
+        assert_eq!(arc_data.ref_count(), 2);
+        assert_eq!(arc_data2.ref_count(), 2);
+
+        let arc_data3 = arc_data.clone();
+        assert_eq!(arc_data.ref_count(), 3);
+        assert_eq!(arc_data2.ref_count(), 3);
+        assert_eq!(arc_data3.ref_count(), 3);
+    }
+
+    #[test]
+    fn test_arc_data_deref() {
+        let data = vec![1u8, 2, 3, 4, 5];
+        let arc_data = ArcData::new(data);
+
+        // Test Deref trait
+        assert_eq!(arc_data.len(), 5);
+        assert_eq!(arc_data[0], 1);
+    }
+
+    #[test]
+    fn test_shared_memory_pool_create() {
+        let pool = SharedMemoryPool::with_defaults();
+        let data = vec![1u8, 2, 3, 4, 5];
+
+        let arc_data = pool.create(data.clone());
+
+        assert_eq!(arc_data.as_ref(), &data);
+        assert_eq!(pool.stats().total_objects.load(Ordering::Relaxed), 1);
+    }
+
+    #[test]
+    fn test_shared_memory_pool_share() {
+        let pool = SharedMemoryPool::with_defaults();
+        let data = vec![1u8, 2, 3, 4, 5];
+
+        let arc_data = pool.create(data);
+        assert_eq!(arc_data.ref_count(), 1);
+
+        let shared = pool.share(&arc_data);
+        assert_eq!(arc_data.ref_count(), 2);
+        assert_eq!(shared.ref_count(), 2);
+        assert_eq!(pool.stats().total_shared_refs.load(Ordering::Relaxed), 1);
+    }
+
+    #[test]
+    fn test_shared_memory_pool_with_size() {
+        let pool = SharedMemoryPool::with_defaults();
+        let data = vec![1u8; 1024];
+
+        let arc_data = pool.create_with_size(data, 1024);
+
+        assert_eq!(arc_data.size(), Some(1024));
+        assert_eq!(pool.stats().current_memory.load(Ordering::Relaxed), 1024);
+    }
+
+    #[test]
+    fn test_default_config() {
+        let config = SharedMemoryConfig::default();
+
+        assert!(config.enabled);
+        assert_eq!(config.max_pool_size, 100 * 1024 * 1024);
+        assert_eq!(config.max_object_size, 10 * 1024 * 1024);
+    }
+}

crates/io-core/src/timeout_wrapper.rs

@@ -0,0 +1,501 @@
+// Copyright 2024 RustFS Team
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+//! Timeout wrapper for I/O operations.
+//!
+//! This module provides timeout management for I/O operations with
+//! dynamic timeout calculation based on operation size.
+
+use std::sync::atomic::{AtomicU64, Ordering};
+use std::time::{Duration, Instant};
+
+/// Timeout configuration.
+#[derive(Debug, Clone)]
+pub struct TimeoutConfig {
+    /// Base timeout for small operations.
+    pub base_timeout: Duration,
+    /// Timeout per MB of data.
+    pub timeout_per_mb: Duration,
+    /// Maximum timeout.
+    pub max_timeout: Duration,
+    /// Minimum timeout.
+    pub min_timeout: Duration,
+    /// GetObject operation timeout.
+    pub get_object_timeout: Duration,
+    /// PutObject operation timeout.
+    pub put_object_timeout: Duration,
+    /// ListObjects operation timeout.
+    pub list_objects_timeout: Duration,
+    /// Whether dynamic timeout is enabled.
+    pub enable_dynamic_timeout: bool,
+}
+
+impl Default for TimeoutConfig {
+    fn default() -> Self {
+        Self {
+            base_timeout: Duration::from_secs(5),
+            timeout_per_mb: Duration::from_millis(100),
+            max_timeout: Duration::from_secs(300),
+            min_timeout: Duration::from_secs(1),
+            get_object_timeout: Duration::from_secs(30),
+            put_object_timeout: Duration::from_secs(60),
+            list_objects_timeout: Duration::from_secs(10),
+            enable_dynamic_timeout: true,
+        }
+    }
+}
+
+impl TimeoutConfig {
+    /// Create new timeout configuration.
+    pub fn new() -> Self {
+        Self::default()
+    }
+
+    /// Calculate dynamic timeout based on size.
+    pub fn calculate_timeout(&self, size_bytes: u64) -> Duration {
+        if !self.enable_dynamic_timeout {
+            return self.base_timeout;
+        }
+
+        let mb = size_bytes as f64 / (1024.0 * 1024.0);
+        let timeout = self.base_timeout + self.timeout_per_mb.mul_f64(mb);
+        timeout.clamp(self.min_timeout, self.max_timeout)
+    }
+
+    /// Validate the configuration.
+    pub fn validate(&self) -> Result<(), TimeoutError> {
+        if self.min_timeout > self.max_timeout {
+            return Err(TimeoutError::InvalidConfig("min_timeout must be <= max_timeout".to_string()));
+        }
+        if self.base_timeout < self.min_timeout || self.base_timeout > self.max_timeout {
+            return Err(TimeoutError::InvalidConfig(
+                "base_timeout must be between min_timeout and max_timeout".to_string(),
+            ));
+        }
+        Ok(())
+    }
+}
+
+/// Timeout error.
+#[derive(Debug, Clone, thiserror::Error)]
+pub enum TimeoutError {
+    /// Operation timed out.
+    #[error("Operation timed out after {0:?}")]
+    TimedOut(Duration),
+    /// Invalid configuration.
+    #[error("Invalid timeout config: {0}")]
+    InvalidConfig(String),
+}
+
+/// Operation progress tracker.
+#[derive(Debug)]
+pub struct OperationProgress {
+    /// Total size (if known).
+    pub total_size: Option<u64>,
+    /// Bytes processed.
+    bytes_processed: AtomicU64,
+    /// Last update time.
+    last_update: std::sync::Mutex<Instant>,
+    /// Stale timeout.
+    stale_timeout: Duration,
+    /// Start time for transfer rate calculation.
+    start_time: Instant,
+}
+
+impl OperationProgress {
+    /// Create new operation progress.
+    pub fn new(total_size: Option<u64>, stale_timeout: Duration) -> Self {
+        Self {
+            total_size,
+            bytes_processed: AtomicU64::new(0),
+            last_update: std::sync::Mutex::new(Instant::now()),
+            stale_timeout,
+            start_time: Instant::now(),
+        }
+    }
+
+    /// Update progress.
+    pub fn update(&self, bytes: u64) {
+        self.bytes_processed.store(bytes, Ordering::Relaxed);
+        if let Ok(mut last) = self.last_update.lock() {
+            *last = Instant::now();
+        }
+    }
+
+    /// Add to progress.
+    pub fn add(&self, bytes: u64) {
+        self.bytes_processed.fetch_add(bytes, Ordering::Relaxed);
+        if let Ok(mut last) = self.last_update.lock() {
+            *last = Instant::now();
+        }
+    }
+
+    /// Get current progress.
+    pub fn current(&self) -> u64 {
+        self.bytes_processed.load(Ordering::Relaxed)
+    }
+
+    /// Check if progress is stale.
+    pub fn is_stale(&self) -> bool {
+        if let Ok(last) = self.last_update.lock() {
+            last.elapsed() > self.stale_timeout
+        } else {
+            false
+        }
+    }
+
+    /// Get progress percentage.
+    pub fn progress_percent(&self) -> Option<f64> {
+        self.total_size.map(|total| {
+            if total == 0 {
+                100.0
+            } else {
+                let processed = self.bytes_processed.load(Ordering::Relaxed);
+                (processed as f64 / total as f64 * 100.0).min(100.0)
+            }
+        })
+    }
+
+    /// Get remaining bytes.
+    pub fn remaining(&self) -> Option<u64> {
+        self.total_size.map(|total| {
+            let processed = self.bytes_processed.load(Ordering::Relaxed);
+            total.saturating_sub(processed)
+        })
+    }
+
+    /// Calculate transfer rate in bytes per second.
+    ///
+    /// Returns 0 if no time has elapsed or no data transferred.
+    pub fn transfer_rate(&self) -> u64 {
+        let processed = self.bytes_processed.load(Ordering::Relaxed);
+        if processed == 0 {
+            return 0;
+        }
+
+        let elapsed = self.start_time.elapsed().as_secs_f64();
+        if elapsed > 0.0 {
+            (processed as f64 / elapsed) as u64
+        } else {
+            0
+        }
+    }
+}
+
+/// Request timeout wrapper.
+pub struct RequestTimeoutWrapper {
+    /// Configuration.
+    config: TimeoutConfig,
+    /// Start time.
+    start_time: Instant,
+    /// Operation progress.
+    progress: Option<OperationProgress>,
+}
+
+impl RequestTimeoutWrapper {
+    /// Create a new timeout wrapper.
+    pub fn new(config: TimeoutConfig) -> Self {
+        Self {
+            config,
+            start_time: Instant::now(),
+            progress: None,
+        }
+    }
+
+    /// Create with progress tracking.
+    pub fn with_progress(config: TimeoutConfig, total_size: Option<u64>, stale_timeout: Duration) -> Self {
+        Self {
+            config,
+            start_time: Instant::now(),
+            progress: Some(OperationProgress::new(total_size, stale_timeout)),
+        }
+    }
+
+    /// Get the configuration.
+    pub fn config(&self) -> &TimeoutConfig {
+        &self.config
+    }
+
+    /// Get elapsed time.
+    pub fn elapsed(&self) -> Duration {
+        self.start_time.elapsed()
+    }
+
+    /// Get remaining time.
+    pub fn remaining(&self, timeout: Duration) -> Option<Duration> {
+        let elapsed = self.elapsed();
+        if elapsed >= timeout { None } else { Some(timeout - elapsed) }
+    }
+
+    /// Check if timed out.
+    pub fn is_timed_out(&self, size: Option<u64>) -> bool {
+        let timeout = self.get_timeout(size);
+        self.elapsed() > timeout
+    }
+
+    /// Get the timeout for a given size.
+    pub fn get_timeout(&self, size: Option<u64>) -> Duration {
+        if self.config.enable_dynamic_timeout {
+            if let Some(s) = size {
+                self.config.calculate_timeout(s)
+            } else {
+                self.config.base_timeout
+            }
+        } else {
+            self.config.base_timeout
+        }
+    }
+
+    /// Check if timed out and return error if so.
+    pub fn check_timeout(&self, size: Option<u64>) -> Result<(), TimeoutError> {
+        if self.is_timed_out(size) {
+            Err(TimeoutError::TimedOut(self.get_timeout(size)))
+        } else {
+            Ok(())
+        }
+    }
+
+    /// Get progress.
+    pub fn progress(&self) -> Option<&OperationProgress> {
+        self.progress.as_ref()
+    }
+
+    /// Update progress.
+    pub fn update_progress(&self, bytes: u64) {
+        if let Some(ref progress) = self.progress {
+            progress.update(bytes);
+        }
+    }
+
+    /// Check if operation is stalled (no progress for a while).
+    pub fn is_stalled(&self) -> bool {
+        self.progress.as_ref().is_some_and(|p| p.is_stale())
+    }
+
+    /// Get progress percentage.
+    pub fn progress_percent(&self) -> Option<f64> {
+        self.progress.as_ref().and_then(|p| p.progress_percent())
+    }
+}
+
+/// Timeout statistics.
+#[derive(Debug, Default)]
+pub struct TimeoutStats {
+    /// Total operations.
+    pub total_operations: AtomicU64,
+    /// Timed out operations.
+    pub timed_out: AtomicU64,
+    /// Total wait time in nanoseconds.
+    pub total_wait_time_ns: AtomicU64,
+    /// Maximum wait time in nanoseconds.
+    pub max_wait_time_ns: AtomicU64,
+}
+
+impl TimeoutStats {
+    /// Create new timeout statistics.
+    pub fn new() -> Self {
+        Self::default()
+    }
+
+    /// Record an operation.
+    pub fn record_operation(&self, wait_time: Duration) {
+        self.total_operations.fetch_add(1, Ordering::Relaxed);
+        let ns = wait_time.as_nanos() as u64;
+        self.total_wait_time_ns.fetch_add(ns, Ordering::Relaxed);
+
+        let mut current = self.max_wait_time_ns.load(Ordering::Relaxed);
+        while ns > current {
+            match self
+                .max_wait_time_ns
+                .compare_exchange_weak(current, ns, Ordering::Relaxed, Ordering::Relaxed)
+            {
+                Ok(_) => break,
+                Err(actual) => current = actual,
+            }
+        }
+    }
+
+    /// Record a timeout.
+    pub fn record_timeout(&self) {
+        self.timed_out.fetch_add(1, Ordering::Relaxed);
+    }
+
+    /// Get timeout rate.
+    pub fn timeout_rate(&self) -> f64 {
+        let total = self.total_operations.load(Ordering::Relaxed);
+        let timed_out = self.timed_out.load(Ordering::Relaxed);
+        if total == 0 { 0.0 } else { timed_out as f64 / total as f64 }
+    }
+
+    /// Get average wait time.
+    pub fn avg_wait_time(&self) -> Duration {
+        let total = self.total_wait_time_ns.load(Ordering::Relaxed);
+        let count = self.total_operations.load(Ordering::Relaxed);
+        total.checked_div(count).map(Duration::from_nanos).unwrap_or(Duration::ZERO)
+    }
+
+    /// Reset statistics.
+    pub fn reset(&self) {
+        self.total_operations.store(0, Ordering::Relaxed);
+        self.timed_out.store(0, Ordering::Relaxed);
+        self.total_wait_time_ns.store(0, Ordering::Relaxed);
+        self.max_wait_time_ns.store(0, Ordering::Relaxed);
+    }
+}
+
+/// Calculate adaptive timeout based on historical data and current conditions.
+///
+/// This function adjusts the timeout based on:
+/// - Historical transfer rate
+/// - Recent timeout count
+/// - Object size
+pub fn calculate_adaptive_timeout(
+    base_timeout: Duration,
+    historical_rate_bps: Option<u64>,
+    recent_timeout_count: u32,
+    object_size: u64,
+) -> Duration {
+    // If we have recent timeouts, increase timeout
+    let timeout_multiplier = if recent_timeout_count > 3 {
+        2.0 // Double timeout if many recent timeouts
+    } else if recent_timeout_count > 1 {
+        1.5 // 50% increase if some timeouts
+    } else {
+        1.0 // No adjustment
+    };
+
+    // Adaptive timeout bounds: 5 seconds minimum, 10 minutes maximum.
+    const MIN_SECS: f64 = 5.0;
+    const MAX_SECS: f64 = 600.0;
+
+    // If we have historical rate data, use it for estimation
+    let estimated_secs = match historical_rate_bps {
+        Some(rate) if rate > 0 => (object_size as f64 / rate as f64) * 1.2, // 20% buffer
+        _ => base_timeout.as_secs_f64(),
+    };
+
+    // Clamp BEFORE constructing the Duration: `from_secs_f64` panics when the
+    // estimate overflows Duration (huge object_size with a tiny historical rate).
+    Duration::from_secs_f64((estimated_secs * timeout_multiplier).clamp(MIN_SECS, MAX_SECS))
+}
+
+/// Estimate bytes per second transfer rate.
+///
+/// This is used for adaptive timeout calculation.
+pub fn estimate_bytes_per_second(object_size: u64, expected_duration: Duration) -> u64 {
+    let secs = expected_duration.as_secs_f64();
+    if secs > 0.0 {
+        (object_size as f64 / secs) as u64
+    } else {
+        // Return a reasonable default (1 MB/s)
+        1024 * 1024
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn test_timeout_config() {
+        let config = TimeoutConfig::default();
+        assert!(config.validate().is_ok());
+
+        // Small file
+        let timeout = config.calculate_timeout(1024);
+        assert!(timeout >= config.min_timeout);
+
+        // Large file
+        let timeout = config.calculate_timeout(100 * 1024 * 1024);
+        assert!(timeout <= config.max_timeout);
+    }
+
+    #[test]
+    fn test_timeout_config_validation() {
+        let config = TimeoutConfig {
+            min_timeout: Duration::from_secs(10),
+            max_timeout: Duration::from_secs(5),
+            ..Default::default()
+        };
+        assert!(config.validate().is_err());
+    }
+
+    #[test]
+    fn test_adaptive_timeout_extreme_estimate_does_not_panic() {
+        // A huge object with a tiny historical rate used to overflow
+        // Duration::from_secs_f64 and panic; it must clamp to the upper bound.
+        let timeout = calculate_adaptive_timeout(Duration::from_secs(30), Some(1), 0, u64::MAX);
+        assert_eq!(timeout, Duration::from_secs(600));
+
+        // Tiny estimates clamp to the lower bound.
+        let timeout = calculate_adaptive_timeout(Duration::from_secs(30), Some(u64::MAX), 0, 1);
+        assert_eq!(timeout, Duration::from_secs(5));
+    }
+
+    #[test]
+    fn test_operation_progress() {
+        let progress = OperationProgress::new(Some(1000), Duration::from_secs(5));
+
+        assert_eq!(progress.current(), 0);
+        assert_eq!(progress.progress_percent(), Some(0.0));
+
+        progress.update(500);
+        assert_eq!(progress.current(), 500);
+        assert_eq!(progress.progress_percent(), Some(50.0));
+
+        progress.add(300);
+        assert_eq!(progress.current(), 800);
+        assert_eq!(progress.remaining(), Some(200));
+    }
+
+    #[test]
+    fn test_request_timeout_wrapper() {
+        let config = TimeoutConfig {
+            base_timeout: Duration::from_millis(100),
+            enable_dynamic_timeout: false,
+            ..Default::default()
+        };
+        let wrapper = RequestTimeoutWrapper::new(config);
+
+        assert!(!wrapper.is_timed_out(None));
+
+        std::thread::sleep(Duration::from_millis(150));
+
+        assert!(wrapper.is_timed_out(None));
+        assert!(wrapper.check_timeout(None).is_err());
+    }
+
+    #[test]
+    fn test_timeout_stats() {
+        let stats = TimeoutStats::new();
+
+        stats.record_operation(Duration::from_millis(10));
+        stats.record_operation(Duration::from_millis(20));
+        stats.record_timeout();
+
+        assert_eq!(stats.total_operations.load(Ordering::Relaxed), 2);
+        assert_eq!(stats.timed_out.load(Ordering::Relaxed), 1);
+        assert!((stats.timeout_rate() - 0.5).abs() < 0.01);
+    }
+
+    #[test]
+    fn test_progress_tracking() {
+        let config = TimeoutConfig::default();
+        let wrapper = RequestTimeoutWrapper::with_progress(config, Some(1000), Duration::from_secs(1));
+
+        wrapper.update_progress(500);
+        assert_eq!(wrapper.progress_percent(), Some(50.0));
+        assert!(!wrapper.is_stalled());
+    }
+}

crates/io-core/src/writer.rs

@@ -0,0 +1,443 @@
+// Copyright 2024 RustFS Team
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+//! BytesMut-backed object writer for optimized write operations.
+//!
+//! It uses `BytesMut` for efficient buffering; writes into that buffer may
+//! still copy input bytes. The historical `ZeroCopyObjectWriter` name remains
+//! available as a deprecated compatibility alias.
+
+use bytes::{BufMut, Bytes, BytesMut};
+use std::pin::Pin;
+use std::task::{Context, Poll};
+use tokio::io::AsyncWrite;
+
+/// BytesMut-backed object writer for optimized write operations.
+///
+/// This writer minimizes memory allocations by:
+/// - Using BytesMut for efficient buffer growth
+/// - Accepting `Bytes` inputs for efficient buffer handling
+/// - Optional integration with BytesPool for buffer reuse
+///
+/// # Example
+///
+/// ```ignore
+/// use rustfs_io_core::BytesMutWriter;
+/// use bytes::Bytes;
+///
+/// #[tokio::main]
+/// async fn main() -> Result<(), Box<dyn std::error::Error>> {
+///     let mut writer = BytesMutWriter::new();
+///
+///     // Write into the internal BytesMut buffer
+///     let data = Bytes::from("hello world");
+///     writer.write_buffered(data).await?;
+///
+///     // Get the result as Bytes (zero-copy conversion)
+///     let result = writer.into_bytes();
+///
+///     Ok(())
+/// }
+/// ```
+pub struct BytesMutWriter {
+    /// Internal buffer using BytesMut for efficient growth
+    buffer: BytesMut,
+    /// Total bytes written
+    bytes_written: usize,
+    /// Whether the writer has been finalized
+    finalized: bool,
+}
+
+/// Historical name for the BytesMut-backed object writer.
+#[deprecated(since = "1.0.0-beta.8", note = "use BytesMutWriter; writes append into a BytesMut buffer")]
+pub type ZeroCopyObjectWriter = BytesMutWriter;
+
+impl BytesMutWriter {
+    /// Create a new bytes-backed object writer with default capacity (8KB).
+    ///
+    /// # Example
+    ///
+    /// ```ignore
+    /// let writer = BytesMutWriter::new();
+    /// ```
+    pub fn new() -> Self {
+        Self::with_capacity(8 * 1024)
+    }
+
+    /// Create a new bytes-backed object writer with specified capacity.
+    ///
+    /// # Arguments
+    ///
+    /// * `capacity` - Initial buffer capacity in bytes
+    ///
+    /// # Example
+    ///
+    /// ```ignore
+    /// let writer = BytesMutWriter::with_capacity(64 * 1024);
+    /// ```
+    pub fn with_capacity(capacity: usize) -> Self {
+        Self {
+            buffer: BytesMut::with_capacity(capacity),
+            bytes_written: 0,
+            finalized: false,
+        }
+    }
+
+    /// Write data into the internal buffer.
+    ///
+    /// This method accepts `Bytes` for API compatibility, then appends the
+    /// bytes into the internal `BytesMut` buffer.
+    ///
+    /// # Arguments
+    ///
+    /// * `data` - Data to append to the internal buffer
+    ///
+    /// # Returns
+    ///
+    /// * `Ok(usize)` - Number of bytes written
+    /// * `Err(ZeroCopyWriteError)` - Write error
+    ///
+    /// # Example
+    ///
+    /// ```ignore
+    /// let data = Bytes::from("hello world");
+    /// let written = writer.write_buffered(data).await?;
+    /// ```
+    pub async fn write_buffered(&mut self, data: Bytes) -> Result<usize, ZeroCopyWriteError> {
+        if self.finalized {
+            return Err(ZeroCopyWriteError::Finalized("Cannot write to finalized writer".to_string()));
+        }
+
+        let len = data.len();
+        self.buffer.put(data);
+
+        self.bytes_written += len;
+        Ok(len)
+    }
+
+    /// Historical name for `write_buffered`.
+    #[deprecated(
+        since = "1.0.0-beta.8",
+        note = "use write_buffered; this method appends bytes into an internal buffer"
+    )]
+    pub async fn write_zero_copy(&mut self, data: Bytes) -> Result<usize, ZeroCopyWriteError> {
+        self.write_buffered(data).await
+    }
+
+    /// Write a slice of data.
+    ///
+    /// # Arguments
+    ///
+    /// * `data` - Data slice to write
+    ///
+    /// # Returns
+    ///
+    /// * `Ok(usize)` - Number of bytes written
+    /// * `Err(ZeroCopyWriteError)` - Write error
+    pub async fn write_slice(&mut self, data: &[u8]) -> Result<usize, ZeroCopyWriteError> {
+        if self.finalized {
+            return Err(ZeroCopyWriteError::Finalized("Cannot write to finalized writer".to_string()));
+        }
+
+        let len = data.len();
+        self.buffer.put_slice(data);
+        self.bytes_written += len;
+        Ok(len)
+    }
+
+    /// Finalize the writer and consume it, returning the written data as Bytes.
+    ///
+    /// This converts the internal BytesMut to Bytes, which is a zero-copy
+    /// operation that freezes the buffer.
+    ///
+    /// # Returns
+    ///
+    /// The written data as Bytes
+    ///
+    /// # Example
+    ///
+    /// ```ignore
+    /// let result = writer.into_bytes();
+    /// ```
+    pub fn into_bytes(mut self) -> Bytes {
+        self.finalized = true;
+        self.buffer.freeze()
+    }
+
+    /// Get the current buffer as a slice (without consuming).
+    ///
+    /// # Returns
+    ///
+    /// Slice of the current buffer content
+    pub fn as_slice(&self) -> &[u8] {
+        &self.buffer[..]
+    }
+
+    /// Get the total number of bytes written.
+    ///
+    /// # Returns
+    ///
+    /// Number of bytes written
+    pub fn bytes_written(&self) -> usize {
+        self.bytes_written
+    }
+
+    /// Get the current buffer capacity.
+    ///
+    /// # Returns
+    ///
+    /// Current buffer capacity in bytes
+    pub fn capacity(&self) -> usize {
+        self.buffer.capacity()
+    }
+
+    /// Get the current buffer length.
+    ///
+    /// # Returns
+    ///
+    /// Current buffer length in bytes
+    pub fn len(&self) -> usize {
+        self.buffer.len()
+    }
+
+    /// Check if the buffer is empty.
+    ///
+    /// # Returns
+    ///
+    /// `true` if buffer is empty, `false` otherwise
+    pub fn is_empty(&self) -> bool {
+        self.buffer.is_empty()
+    }
+
+    /// Clear the buffer, resetting it to empty.
+    ///
+    /// This does not change the capacity, just resets the length to 0.
+    pub fn clear(&mut self) {
+        self.buffer.clear();
+        self.bytes_written = 0;
+        self.finalized = false;
+    }
+
+    /// Reserve additional capacity in the buffer.
+    ///
+    /// # Arguments
+    ///
+    /// * `additional` - Additional capacity to reserve
+    pub fn reserve(&mut self, additional: usize) {
+        self.buffer.reserve(additional);
+    }
+}
+
+impl Default for BytesMutWriter {
+    fn default() -> Self {
+        Self::new()
+    }
+}
+
+impl std::fmt::Debug for BytesMutWriter {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.debug_struct("BytesMutWriter")
+            .field("buffer_len", &self.buffer.len())
+            .field("buffer_capacity", &self.buffer.capacity())
+            .field("bytes_written", &self.bytes_written)
+            .field("finalized", &self.finalized)
+            .finish()
+    }
+}
+
+/// AsyncWrite implementation for BytesMutWriter.
+///
+/// This allows the writer to be used with tokio's async I/O utilities.
+impl AsyncWrite for BytesMutWriter {
+    fn poll_write(mut self: Pin<&mut Self>, _cx: &mut Context<'_>, buf: &[u8]) -> Poll<Result<usize, tokio::io::Error>> {
+        if self.finalized {
+            return Poll::Ready(Err(tokio::io::Error::new(
+                tokio::io::ErrorKind::WriteZero,
+                "Cannot write to finalized writer",
+            )));
+        }
+
+        let len = buf.len();
+        self.buffer.put_slice(buf);
+        self.bytes_written += len;
+        Poll::Ready(Ok(len))
+    }
+
+    fn poll_flush(self: Pin<&mut Self>, _cx: &mut Context<'_>) -> Poll<Result<(), tokio::io::Error>> {
+        // Nothing to flush for in-memory buffer
+        Poll::Ready(Ok(()))
+    }
+
+    fn poll_shutdown(mut self: Pin<&mut Self>, _cx: &mut Context<'_>) -> Poll<Result<(), tokio::io::Error>> {
+        self.finalized = true;
+        Poll::Ready(Ok(()))
+    }
+}
+
+/// Zero-copy write error types.
+#[derive(Debug, thiserror::Error)]
+pub enum ZeroCopyWriteError {
+    /// I/O error occurred
+    #[error("I/O error: {0}")]
+    Io(#[from] tokio::io::Error),
+
+    /// Writer has been finalized and cannot accept more writes
+    #[error("Writer finalized: {0}")]
+    Finalized(String),
+
+    /// Invalid input provided
+    #[error("Invalid input: {0}")]
+    InvalidInput(String),
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[tokio::test]
+    async fn test_new_writer() {
+        let writer = BytesMutWriter::new();
+        assert!(writer.is_empty());
+        assert_eq!(writer.bytes_written(), 0);
+        assert!(writer.capacity() >= 8 * 1024);
+    }
+
+    #[tokio::test]
+    async fn test_write_buffered() {
+        let mut writer = BytesMutWriter::new();
+        let data = Bytes::from("hello world");
+
+        let written = writer.write_buffered(data).await.unwrap();
+        assert_eq!(written, 11);
+        assert_eq!(writer.bytes_written(), 11);
+        assert_eq!(writer.as_slice(), b"hello world");
+    }
+
+    #[tokio::test]
+    async fn test_preferred_writer_alias() {
+        let mut writer = BytesMutWriter::new();
+        let written = writer
+            .write_buffered(Bytes::from("hello world"))
+            .await
+            .expect("write bytes through alias");
+
+        assert_eq!(written, 11);
+        assert_eq!(writer.as_slice(), b"hello world");
+    }
+
+    #[tokio::test]
+    async fn test_write_slice() {
+        let mut writer = BytesMutWriter::new();
+        let data = b"hello world";
+
+        let written = writer.write_slice(data).await.unwrap();
+        assert_eq!(written, 11);
+        assert_eq!(writer.bytes_written(), 11);
+        assert_eq!(writer.as_slice(), b"hello world");
+    }
+
+    #[tokio::test]
+    async fn test_into_bytes() {
+        let mut writer = BytesMutWriter::new();
+        let data = Bytes::from("hello world");
+
+        writer.write_buffered(data).await.unwrap();
+        let result = writer.into_bytes();
+
+        assert_eq!(result.as_ref(), b"hello world");
+    }
+
+    #[tokio::test]
+    async fn test_write_after_finalize() {
+        let mut writer = BytesMutWriter::new();
+        let data = Bytes::from("hello");
+
+        writer.write_buffered(data).await.unwrap();
+        let _result = writer.into_bytes();
+
+        // Create new writer and try to write after finalize
+        let mut writer2 = BytesMutWriter::new();
+        writer2.write_buffered(Bytes::from("test")).await.unwrap();
+        let _ = writer2.into_bytes();
+
+        // Writing to a consumed writer should work via new writer
+        let mut writer3 = BytesMutWriter::new();
+        let result = writer3.write_buffered(Bytes::from("final")).await;
+        assert!(result.is_ok());
+    }
+
+    #[tokio::test]
+    async fn test_clear() {
+        let mut writer = BytesMutWriter::new();
+        writer.write_slice(b"hello").await.unwrap();
+
+        writer.clear();
+        assert!(writer.is_empty());
+        assert_eq!(writer.bytes_written(), 0);
+        // Capacity should remain
+        assert!(writer.capacity() > 0);
+    }
+
+    #[tokio::test]
+    async fn test_reserve() {
+        let mut writer = BytesMutWriter::with_capacity(10);
+        let initial_capacity = writer.capacity();
+
+        writer.reserve(1000);
+        // Reserve ensures at least the additional capacity can be added
+        // but may allocate more than requested
+        assert!(writer.capacity() >= initial_capacity);
+    }
+
+    #[tokio::test]
+    async fn test_multiple_writes() {
+        let mut writer = BytesMutWriter::new();
+
+        writer.write_buffered(Bytes::from("hello ")).await.unwrap();
+        writer.write_slice(b"world").await.unwrap();
+
+        assert_eq!(writer.as_slice(), b"hello world");
+        assert_eq!(writer.bytes_written(), 11);
+    }
+
+    #[tokio::test]
+    async fn test_async_write() {
+        use tokio::io::AsyncWriteExt;
+
+        let mut writer = BytesMutWriter::new();
+        let data = b"hello world";
+
+        let written = writer.write(data).await.unwrap();
+        assert_eq!(written, 11);
+        assert_eq!(writer.as_slice(), b"hello world");
+    }
+
+    #[tokio::test]
+    async fn test_debug() {
+        let writer = BytesMutWriter::new();
+        let debug_str = format!("{:?}", writer);
+        assert!(debug_str.contains("BytesMutWriter"));
+        assert!(debug_str.contains("buffer_len"));
+    }
+
+    #[tokio::test]
+    #[allow(deprecated)]
+    async fn test_legacy_writer_alias() {
+        let mut writer = ZeroCopyObjectWriter::new();
+        let written = writer.write_zero_copy(Bytes::from("hello")).await.unwrap();
+
+        assert_eq!(written, 5);
+        assert_eq!(writer.as_slice(), b"hello");
+    }
+}

crates/kms/src/api_types.rs

@@ -293,15 +293,6 @@ enum StrictVaultAuthMethod {
         #[serde(default)]
         refresh_safety_window_secs: Option<u64>,
     },
-    Kubernetes {
-        role: String,
-        #[serde(default)]
-        mount: Option<String>,
-        #[serde(default)]
-        jwt_path: Option<std::path::PathBuf>,
-        #[serde(default)]
-        refresh_safety_window_secs: Option<u64>,
-    },
     TokenFile {
         path: std::path::PathBuf,
         #[serde(default)]
@@ -328,17 +319,6 @@ impl From<StrictVaultAuthMethod> for VaultAuthMethod {
                 mount: mount.unwrap_or_else(|| crate::config::DEFAULT_VAULT_APPROLE_MOUNT.to_string()),
                 refresh_safety_window_secs,
             },
-            StrictVaultAuthMethod::Kubernetes {
-                role,
-                mount,
-                jwt_path,
-                refresh_safety_window_secs,
-            } => Self::Kubernetes {
-                role,
-                mount: mount.unwrap_or_else(|| crate::config::DEFAULT_VAULT_KUBERNETES_MOUNT.to_string()),
-                jwt_path: jwt_path.unwrap_or_else(|| std::path::PathBuf::from(crate::config::DEFAULT_VAULT_KUBERNETES_JWT_PATH)),
-                refresh_safety_window_secs,
-            },
             StrictVaultAuthMethod::TokenFile {
                 path,
                 poll_interval_secs,
@@ -519,7 +499,6 @@ impl From<&KmsConfig> for KmsConfigSummary {
                 auth_method_type: match &vault_config.auth_method {
                     VaultAuthMethod::Token { .. } => "token".to_string(),
                     VaultAuthMethod::AppRole { .. } => "approle".to_string(),
-                    VaultAuthMethod::Kubernetes { .. } => "kubernetes".to_string(),
                     VaultAuthMethod::TokenFile { .. } => "token_file".to_string(),
                 },
                 has_stored_credentials: true,
@@ -534,7 +513,6 @@ impl From<&KmsConfig> for KmsConfigSummary {
                 auth_method_type: match &vault_config.auth_method {
                     VaultAuthMethod::Token { .. } => "token".to_string(),
                     VaultAuthMethod::AppRole { .. } => "approle".to_string(),
-                    VaultAuthMethod::Kubernetes { .. } => "kubernetes".to_string(),
                     VaultAuthMethod::TokenFile { .. } => "token_file".to_string(),
                 },
                 has_stored_credentials: true,
@@ -923,42 +901,6 @@ mod tests {
         assert!(request.to_kms_config().validate().is_ok());
     }
 
-    /// The admin API reaches Kubernetes auth with the role alone; the mount and
-    /// the projected token path fall back to the cluster defaults, so a Tenant
-    /// manifest carries no credential and no cluster-specific paths.
-    #[test]
-    fn test_deserialize_vault_configure_request_accepts_kubernetes_auth() {
-        let raw = serde_json::json!({
-            "backend_type": "vault-transit",
-            "address": "https://vault.example.com:8200",
-            "mount_path": "rustfs",
-            "auth_method": { "Kubernetes": { "role": "rustfs" } }
-        });
-
-        let request: ConfigureKmsRequest = serde_json::from_value(raw).expect("kubernetes auth should deserialize");
-        let config = request.to_kms_config();
-        config.validate().expect("kubernetes auth must validate");
-
-        let vault = config.vault_transit_config().expect("vault transit backend config");
-        let VaultAuthMethod::Kubernetes {
-            role, mount, jwt_path, ..
-        } = &vault.auth_method
-        else {
-            panic!("expected Kubernetes auth, got {:?}", vault.auth_method);
-        };
-        assert_eq!(role, "rustfs");
-        assert_eq!(mount, crate::config::DEFAULT_VAULT_KUBERNETES_MOUNT);
-        assert_eq!(jwt_path, std::path::Path::new(crate::config::DEFAULT_VAULT_KUBERNETES_JWT_PATH));
-
-        let unknown_field = serde_json::json!({
-            "backend_type": "vault-transit",
-            "address": "https://vault.example.com:8200",
-            "auth_method": { "Kubernetes": { "role": "rustfs", "service_account": "rustfs" } }
-        });
-        serde_json::from_value::<ConfigureKmsRequest>(unknown_field)
-            .expect_err("an unknown auth field must be rejected rather than silently dropped");
-    }
-
     #[test]
     fn test_deserialize_aws_configure_request_accepts_type_aliases() {
         for backend_type in ["AWS", "AwsKms", "aws", "aws-kms", "aws_kms"] {

crates/kms/src/backends/vault.rs

@@ -550,7 +550,6 @@ impl VaultKmsClient {
             address: config.address.clone(),
             namespace: config.namespace.clone(),
             attempt_timeout: kms_config.effective_timeout(),
-            skip_tls_verify: config.tls.as_ref().is_some_and(|tls| tls.skip_verify),
         };
         let source = token_source_for(&config.auth_method, &settings)?;
         let policy = VaultCredentialPolicy::from_kms_config(

crates/kms/src/backends/vault_credentials.rs

@@ -326,97 +326,6 @@ impl fmt::Debug for AppRoleLogin {
     }
 }
 
-/// Token source for [`VaultAuthMethod::Kubernetes`]: exchanges the pod's
-/// projected ServiceAccount token for a lease-bound Vault token.
-///
-/// The JWT is re-read on every login because the kubelet rotates a projected
-/// token well inside the pod's lifetime; caching it would strand the source on
-/// an expired assertion once the current Vault token can no longer be renewed.
-///
-/// Unlike [`TokenFileSource`], the file mode is not checked: the kubelet owns
-/// the projected token and mounts it world-readable by default, so rejecting
-/// group/other bits would refuse every standard pod rather than catch a
-/// deployment error.
-pub(crate) struct KubernetesLogin {
-    /// Unauthenticated client used only for the login exchange.
-    login_client: VaultClient,
-    mount: String,
-    role: String,
-    jwt_path: PathBuf,
-}
-
-impl KubernetesLogin {
-    pub(crate) fn new(settings: &VaultConnectionSettings, mount: String, role: String, jwt_path: PathBuf) -> Result<Self> {
-        Ok(Self {
-            login_client: settings.build_login_client()?,
-            mount,
-            role,
-            jwt_path,
-        })
-    }
-
-    /// Read the ServiceAccount token for one login attempt.
-    ///
-    /// Mirrors [`AppRoleLogin::resolve_secret_id`]: a read failure is fatal for
-    /// the attempt but the refresh loop keeps retrying, so a token the kubelet
-    /// has not projected yet heals the source without a restart.
-    async fn resolve_jwt(&self) -> AttemptResult<SecretString> {
-        let mut raw = tokio::fs::read_to_string(&self.jwt_path)
-            .await
-            .map_err(|error| AttemptError {
-                class: ErrorClass::Fatal,
-                error: KmsError::configuration_error(format!(
-                    "Failed to read Kubernetes ServiceAccount token {}: {error}",
-                    self.jwt_path.display()
-                )),
-            })?;
-        let trimmed = raw.trim();
-        if trimmed.is_empty() {
-            raw.zeroize();
-            return Err(AttemptError {
-                class: ErrorClass::Fatal,
-                error: KmsError::configuration_error(format!(
-                    "Kubernetes ServiceAccount token {} is empty",
-                    self.jwt_path.display()
-                )),
-            });
-        }
-        let jwt = SecretString::new(trimmed.to_string());
-        raw.zeroize();
-        Ok(jwt)
-    }
-}
-
-#[async_trait]
-impl TokenSource for KubernetesLogin {
-    async fn acquire(&self) -> AttemptResult<TokenLease> {
-        let jwt = self.resolve_jwt().await?;
-        let auth = vaultrs::auth::kubernetes::login(&self.login_client, &self.mount, &self.role, jwt.expose())
-            .await
-            .map_err(|error| attempt_error("Kubernetes login", error))?;
-        Ok(TokenLease::from_auth(auth))
-    }
-
-    async fn renew(&self, client: &VaultClient) -> AttemptResult<TokenLease> {
-        let auth = vaultrs::token::renew_self(client, None)
-            .await
-            .map_err(|error| attempt_error("token renewal", error))?;
-        Ok(TokenLease::from_auth(auth))
-    }
-}
-
-impl fmt::Debug for KubernetesLogin {
-    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
-        // The login client embeds Vault client settings and must stay out of
-        // Debug output; the role name is not a secret, and the JWT is never held.
-        f.debug_struct("KubernetesLogin")
-            .field("mount", &self.mount)
-            .field("role", &self.role)
-            .field("jwt_path", &self.jwt_path)
-            .finish_non_exhaustive()
-    }
-}
-
 /// Token source for [`VaultAuthMethod::TokenFile`]: reads an agent-managed
 /// token file (for example a Vault Agent auto-auth sink).
 ///
@@ -555,9 +464,6 @@ pub(crate) fn token_source_for(
             secret_id.clone(),
             secret_id_file.clone(),
         )?)),
-        VaultAuthMethod::Kubernetes {
-            role, mount, jwt_path, ..
-        } => Ok(Box::new(KubernetesLogin::new(settings, mount.clone(), role.clone(), jwt_path.clone())?)),
         VaultAuthMethod::TokenFile {
             path,
             poll_interval_secs,
@@ -580,9 +486,6 @@ pub(crate) struct VaultConnectionSettings {
     pub(crate) namespace: Option<String>,
     /// Per-attempt HTTP timeout applied to the underlying reqwest client.
     pub(crate) attempt_timeout: Duration,
-    /// Whether to accept an unverified Vault server certificate. Gated on
-    /// `allow_insecure_dev_defaults` by `KmsConfig::validate`.
-    pub(crate) skip_tls_verify: bool,
 }
 
 impl VaultConnectionSettings {
@@ -596,11 +499,6 @@ impl VaultConnectionSettings {
         // operation-level retry policy.
         settings_builder.timeout(Some(self.attempt_timeout));
         settings_builder.token(token);
-        // Always set explicitly: left unset, vaultrs derives this from its own
-        // VAULT_SKIP_VERIFY variable, so a stray value in the environment would
-        // disable certificate verification behind the KMS configuration and its
-        // insecure-defaults gate.
-        settings_builder.verify(!self.skip_tls_verify);
 
         if let Some(namespace) = &self.namespace {
             settings_builder.namespace(Some(namespace.clone()));
@@ -653,10 +551,6 @@ impl VaultCredentialPolicy {
                 refresh_safety_window_secs: Some(secs),
                 ..
             }
-            | VaultAuthMethod::Kubernetes {
-                refresh_safety_window_secs: Some(secs),
-                ..
-            }
             | VaultAuthMethod::TokenFile {
                 refresh_safety_window_secs: Some(secs),
                 ..
@@ -690,25 +584,15 @@ pub(crate) struct VaultClientHandle {
 
 impl VaultClientHandle {
     /// Absolute expiry of this generation's token.
-    ///
-    /// `lease.ttl` is built from the `lease_duration` the Vault server sent, so
-    /// a value too large to add to `issued_at` would panic on the bare `+`. A
-    /// TTL that cannot be represented is indistinguishable from no expiry, so it
-    /// collapses to `None` — the same answer already given for the zero-lease
-    /// tokens Vault issues, which keeps the token in use and still fully
-    /// validated by Vault on every call.
     fn expires_at(&self) -> Option<Instant> {
-        self.lease.and_then(|lease| self.issued_at.checked_add(lease.ttl))
+        self.lease.map(|lease| self.issued_at + lease.ttl)
     }
 
     /// When the renewal task should refresh this generation: half the TTL,
     /// leaving the second half as budget for retries before the fail-closed
     /// window is reached.
-    ///
-    /// Unrepresentable TTLs collapse to `None` as in [`Self::expires_at`],
-    /// leaving a token that never expires with nothing to renew.
     fn renew_at(&self) -> Option<Instant> {
-        self.lease.and_then(|lease| self.issued_at.checked_add(lease.ttl / 2))
+        self.lease.map(|lease| self.issued_at + lease.ttl / 2)
     }
 }
 
@@ -778,7 +662,7 @@ impl VaultCredentialProvider {
         let handle = self.current.load_full();
         if let Some(expires_at) = handle.expires_at() {
             let now = Instant::now();
-            if self.inside_safety_window(now, expires_at) {
+            if now + self.policy.safety_window >= expires_at {
                 return Err(KmsError::credentials_unavailable(format!(
                     "Vault token (generation {}) is within {:?} of expiry and has not been refreshed; refusing to use it",
                     handle.generation, self.policy.safety_window
@@ -788,18 +672,6 @@ impl VaultCredentialProvider {
         Ok(handle)
     }
 
-    /// Whether the token expiring at `expires_at` is close enough to refuse.
-    ///
-    /// `safety_window` reaches here from persisted configuration, so it is not
-    /// guaranteed to have passed this version's validation: a window too large
-    /// to add to the current instant would panic on the bare `+`. Such a window
-    /// means every token is always inside it, so saturating to "refuse" is both
-    /// the fail-closed answer and the one the arithmetic was reaching for.
-    fn inside_safety_window(&self, now: Instant, expires_at: Instant) -> bool {
-        now.checked_add(self.policy.safety_window)
-            .is_none_or(|deadline| deadline >= expires_at)
-    }
-
     /// Publish the credential gauges for the generation currently installed.
     ///
     /// The fail-closed gauge re-evaluates the very gate
@@ -811,7 +683,7 @@ impl VaultCredentialProvider {
         let fail_closed = match handle.expires_at() {
             Some(expires_at) => {
                 metrics::gauge!(METRIC_TOKEN_TTL_SECONDS).set(expires_at.saturating_duration_since(now).as_secs_f64());
-                self.inside_safety_window(now, expires_at)
+                now + self.policy.safety_window >= expires_at
             }
             // A generation without an expiry has no remaining TTL to report
             // and can never lapse, so it can never fail closed either.
@@ -988,7 +860,7 @@ impl Drop for CredentialTaskHandle {
 #[cfg(test)]
 mod tests {
     use super::*;
-    use crate::config::{DEFAULT_VAULT_KUBERNETES_MOUNT, REDACTED_SECRET};
+    use crate::config::REDACTED_SECRET;
     use std::sync::atomic::{AtomicBool, AtomicU32, Ordering};
 
     const TEST_TOKEN: &str = "vault-token-debug-leak-canary";
@@ -999,7 +871,6 @@ mod tests {
             address: "http://127.0.0.1:8200".to_string(),
             namespace: Some("team-namespace".to_string()),
             attempt_timeout: Duration::from_secs(30),
-            skip_tls_verify: false,
         }
     }
 
@@ -1186,143 +1057,6 @@ mod tests {
         assert!(format!("{source:?}").contains("AppRoleLogin"));
     }
 
-    #[tokio::test]
-    async fn test_kubernetes_auth_method_maps_to_login_source() {
-        let settings = test_settings();
-        let source = token_source_for(&VaultAuthMethod::kubernetes("rustfs".to_string()), &settings)
-            .expect("kubernetes auth must map to a login source");
-
-        assert!(format!("{source:?}").contains("KubernetesLogin"));
-    }
-
-    /// `refresh_safety_window_secs` is operator-supplied and reaches the request
-    /// path from persisted configuration, so the fail-closed comparison must
-    /// survive a window too large to add to the current instant. Before the
-    /// checked arithmetic this panicked with "overflow when adding duration to
-    /// instant" on the first request after a lease-bearing login.
-    #[tokio::test]
-    async fn test_current_refuses_rather_than_panics_on_an_unrepresentable_safety_window() {
-        let (provider, _state) = scripted_provider(
-            Duration::from_secs(60),
-            true,
-            test_policy(Duration::from_secs(u64::MAX), Duration::from_secs(5)),
-        )
-        .await;
-
-        let error = provider
-            .current()
-            .expect_err("a window wider than any lease must refuse the token");
-        assert!(
-            matches!(error, KmsError::CredentialsUnavailable { .. }),
-            "expected CredentialsUnavailable, got {error:?}"
-        );
-    }
-
-    /// `lease_duration` is a bare u64 straight off the Vault response and forms
-    /// the other side of the same comparison, so an absurd one must not panic
-    /// either. It is indistinguishable from a non-expiring token, which is how
-    /// the zero-lease case already behaves.
-    #[tokio::test]
-    async fn test_an_unrepresentable_lease_is_treated_as_non_expiring() {
-        let (provider, _state) = scripted_provider(
-            Duration::from_secs(u64::MAX),
-            true,
-            test_policy(Duration::from_secs(30), Duration::from_secs(5)),
-        )
-        .await;
-
-        provider
-            .current()
-            .expect("a token whose expiry cannot be represented must stay usable");
-    }
-
-    /// The configured flag has to reach the HTTP client, not just the config
-    /// struct: every generation (authenticated and login) builds its own client,
-    /// and a Vault with a self-signed certificate fails the handshake unless
-    /// each one carries the setting.
-    #[test]
-    fn test_skip_tls_verify_reaches_every_vault_client_generation() {
-        for skip_tls_verify in [false, true] {
-            let settings = VaultConnectionSettings {
-                address: "https://vault.example.com:8200".to_string(),
-                namespace: None,
-                attempt_timeout: Duration::from_secs(30),
-                skip_tls_verify,
-            };
-
-            let authenticated = settings.build_client(TEST_TOKEN).expect("authenticated client must build");
-            assert_eq!(authenticated.settings.verify, !skip_tls_verify);
-
-            let login = settings.build_login_client().expect("login client must build");
-            assert_eq!(login.settings.verify, !skip_tls_verify);
-        }
-    }
-
-    /// vaultrs derives `verify` from its own VAULT_SKIP_VERIFY variable when the
-    /// builder leaves it unset, which would disable certificate verification
-    /// without passing the KMS insecure-defaults gate.
-    #[test]
-    fn test_vaultrs_skip_verify_env_cannot_override_the_configured_setting() {
-        temp_env::with_var("VAULT_SKIP_VERIFY", Some("true"), || {
-            let client = test_settings().build_client(TEST_TOKEN).expect("client must build");
-            assert!(
-                client.settings.verify,
-                "a stray VAULT_SKIP_VERIFY must not disable verification behind the KMS configuration"
-            );
-        });
-    }
-
-    /// The projected token is read fresh per login attempt and trimmed, so a
-    /// kubelet rotation is picked up without a restart and a trailing newline
-    /// does not corrupt the assertion sent to Vault.
-    #[tokio::test]
-    async fn test_kubernetes_login_rereads_and_trims_the_service_account_token() {
-        let dir = tempfile::tempdir().expect("temp dir");
-        let path = dir.path().join("token");
-        tokio::fs::write(&path, "  first-jwt\n").await.expect("write token");
-
-        let login = KubernetesLogin::new(
-            &test_settings(),
-            DEFAULT_VAULT_KUBERNETES_MOUNT.to_string(),
-            "rustfs".to_string(),
-            path.clone(),
-        )
-        .expect("login source must build");
-
-        assert_eq!(login.resolve_jwt().await.expect("first read").expose(), "first-jwt");
-
-        tokio::fs::write(&path, "rotated-jwt").await.expect("rotate token");
-        assert_eq!(
-            login.resolve_jwt().await.expect("second read").expose(),
-            "rotated-jwt",
-            "a rotated projected token must be picked up without a restart"
-        );
-    }
-
-    /// The ServiceAccount token is re-read per attempt, so an unreadable or
-    /// empty one fails that attempt without reaching Vault; the refresh loop
-    /// keeps retrying, which is what lets a late projection heal the source.
-    #[tokio::test]
-    async fn test_kubernetes_login_rejects_an_unusable_service_account_token() {
-        let dir = tempfile::tempdir().expect("temp dir");
-        let missing = dir.path().join("absent-token");
-        let empty = dir.path().join("empty-token");
-        tokio::fs::write(&empty, "  \n").await.expect("write empty token");
-
-        for (path, expected) in [(missing, "Failed to read"), (empty, "is empty")] {
-            let login =
-                KubernetesLogin::new(&test_settings(), DEFAULT_VAULT_KUBERNETES_MOUNT.to_string(), "rustfs".to_string(), path)
-                    .expect("login source must build");
-
-            let error = login
-                .acquire()
-                .await
-                .expect_err("an unusable ServiceAccount token must fail the attempt");
-            assert!(matches!(error.class, ErrorClass::Fatal));
-            assert!(error.error.to_string().contains(expected), "got {}", error.error);
-        }
-    }
-
     #[tokio::test(start_paused = true)]
     async fn test_renewal_task_renews_at_half_ttl() {
         let (provider, state) = scripted_provider(

crates/kms/src/backends/vault_transit.rs

@@ -415,7 +415,6 @@ impl VaultTransitKmsClient {
             address: config.address.clone(),
             namespace: config.namespace.clone(),
             attempt_timeout: kms_config.effective_timeout(),
-            skip_tls_verify: config.tls.as_ref().is_some_and(|tls| tls.skip_verify),
         };
         let source = token_source_for(&config.auth_method, &settings)?;
         let policy = VaultCredentialPolicy::from_kms_config(

crates/kms/src/backup/vault_restore.rs

@@ -450,10 +450,6 @@ impl VaultRestoreClient {
             address: target.address.clone(),
             namespace: target.namespace.clone(),
             attempt_timeout: kms_config.effective_timeout(),
-            // A restore target carries no TLS settings, so certificates are
-            // always verified: recovery is the last path that should accept an
-            // unauthenticated Vault.
-            skip_tls_verify: false,
         };
         let source = token_source_for(&target.auth_method, &settings)?;
         let policy = VaultCredentialPolicy::from_kms_config(