Merge branch 'main' into fix/b5-t4-b2-remote-target-serde

madmin-go v3.0.109 `BucketTarget` (bucket-targets.go) tags the limit
`json:"bandwidthlimit,omitempty"`, not `bandwidth`, so the previous rename
still left mc decoding a zero bandwidth limit for every nonzero target.
Emit the exact tag in remote_target_admin_json, and add the same
`bandwidthlimit` alias on the ecstore `BucketTarget` reader so a
MinIO-written bucket-targets.json keeps its limit on migration (the legacy
`bandwidth` alias stays for compatibility). The persisted snake_case wire
key and the inbound RemoteTargetRequest aliases are unchanged.

Cover it with a madmin-shaped decode regression: the admin response is
decoded through a mirror of the v3.0.109 json tags and must yield the
nonzero bandwidth limit plus the other renamed fields.

.github/workflows/nightly-gnu.yml

@@ -39,10 +39,11 @@ jobs:
     env:
       FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
     steps:
-      - name: Checkout repository
+      - name: Checkout main branch
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
         with:
           persist-credentials: false
+          ref: main
 
       - name: Setup Rust environment
         uses: ./.github/actions/setup
@@ -88,10 +89,11 @@ jobs:
       # either casing.
       NO_PROXY: 127.0.0.1,localhost
     steps:
-      - name: Checkout repository
+      - name: Checkout main branch
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
         with:
           persist-credentials: false
+          ref: main
 
       - name: Setup Rust environment
         uses: ./.github/actions/setup
@@ -176,10 +178,11 @@ jobs:
       FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
       NO_PROXY: 127.0.0.1,localhost
     steps:
-      - name: Checkout repository
+      - name: Checkout main branch
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
         with:
           persist-credentials: false
+          ref: main
 
       - name: Setup Rust environment
         uses: ./.github/actions/setup

crates/ecstore/src/bucket/target/bucket_target.rs

@@ -32,6 +32,10 @@ pub struct Credentials {
     pub access_key: String,
     #[serde(rename = "secretKey")]
     pub secret_key: String,
+    // The aliases accept madmin's JSON tags (MinIO-written bucket-targets
+    // metadata and mc request bodies) without changing the snake_case
+    // persisted/peer wire format this struct serializes to.
+    #[serde(alias = "sessionToken")]
     pub session_token: Option<String>,
     pub expiration: Option<Timestamp>,
 }
@@ -202,12 +206,14 @@ pub struct BucketTarget {
     #[serde(default)]
     pub region: String,
 
-    #[serde(alias = "bandwidth", default)]
+    // madmin-go v3.0.109 tags this `bandwidthlimit`; `bandwidth` is a legacy
+    // alias kept for inputs written before the madmin tag was verified.
+    #[serde(alias = "bandwidthlimit", alias = "bandwidth", default)]
     pub bandwidth_limit: i64,
 
     #[serde(rename = "replicationSync", default)]
     pub replication_sync: bool,
-    #[serde(default)]
+    #[serde(alias = "storageclass", default)]
     pub storage_class: String,
     #[serde(rename = "skipTlsVerify", default)]
     pub skip_tls_verify: bool,
@@ -220,7 +226,7 @@ pub struct BucketTarget {
 
     #[serde(rename = "resetBeforeDate", with = "time::serde::rfc3339::option", default)]
     pub reset_before_date: Option<OffsetDateTime>,
-    #[serde(default)]
+    #[serde(alias = "resetID", default)]
     pub reset_id: String,
     #[serde(rename = "totalDowntime", with = "duration_seconds", default)]
     pub total_downtime: Duration,
@@ -233,7 +239,7 @@ pub struct BucketTarget {
     #[serde(default)]
     pub latency: LatencyStat,
 
-    #[serde(default)]
+    #[serde(alias = "deploymentID", default)]
     pub deployment_id: String,
 
     #[serde(default)]
@@ -531,6 +537,85 @@ mod tests {
         assert_eq!(value["totalDowntime"], 90);
     }
 
+    #[test]
+    fn bucket_target_persisted_wire_keys_stay_snake_case() {
+        // bucket-targets.json (persisted via `serde_json::to_vec(&BucketTargets)`
+        // in the admin set/remove handlers) and the msgpack struct-map form
+        // (`BucketTargets::marshal_msg`) both come straight from this struct's
+        // serde field names. madmin naming is applied only in the admin
+        // response layer (`remote_target_admin_json`); renaming here would
+        // silently break every existing deployment's persisted metadata.
+        let targets = BucketTargets {
+            targets: vec![BucketTarget {
+                credentials: Some(Credentials {
+                    access_key: "ak".to_string(),
+                    secret_key: "sk".to_string(),
+                    session_token: Some("token".to_string()),
+                    expiration: None,
+                }),
+                bandwidth_limit: 5,
+                storage_class: "STANDARD".to_string(),
+                reset_id: "reset-1".to_string(),
+                deployment_id: "deploy-1".to_string(),
+                ..Default::default()
+            }],
+        };
+
+        let json = serde_json::to_value(&targets).expect("targets should serialize to JSON");
+        let msgpack: serde_json::Value =
+            rmp_serde::from_slice(&targets.marshal_msg().expect("targets should marshal to msgpack"))
+                .expect("msgpack struct map should decode into a JSON value");
+
+        for (wire, entry) in [("JSON", &json["targets"][0]), ("msgpack", &msgpack["targets"][0])] {
+            assert_eq!(entry["bandwidth_limit"], 5, "{wire} key `bandwidth_limit` must stay");
+            assert_eq!(entry["storage_class"], "STANDARD", "{wire} key `storage_class` must stay");
+            assert_eq!(entry["reset_id"], "reset-1", "{wire} key `reset_id` must stay");
+            assert_eq!(entry["deployment_id"], "deploy-1", "{wire} key `deployment_id` must stay");
+            assert_eq!(entry["credentials"]["session_token"], "token", "{wire} key `session_token` must stay");
+        }
+    }
+
+    #[test]
+    fn minio_written_bucket_targets_json_populates_madmin_named_fields() {
+        // A MinIO-written bucket-targets.json carries madmin's JSON tags
+        // (`bandwidthlimit`, `storageclass`, `resetID`, `deploymentID`,
+        // `credentials.sessionToken` — madmin-go v3.0.109 bucket-targets.go).
+        // On migration these must land in the matching fields instead of
+        // silently defaulting (backlog#1951).
+        let targets: BucketTargets = serde_json::from_value(serde_json::json!({
+            "targets": [{
+                "sourcebucket": "src",
+                "endpoint": "minio.example:9000",
+                "credentials": {
+                    "accessKey": "ak",
+                    "secretKey": "sk",
+                    "sessionToken": "minio-session-token"
+                },
+                "targetbucket": "dst",
+                "type": "replication",
+                "replicationSync": true,
+                "bandwidthlimit": 107374182400i64,
+                "storageclass": "STANDARD",
+                "resetID": "reset-789",
+                "deploymentID": "deploy-123"
+            }]
+        }))
+        .expect("MinIO-written bucket-targets.json must deserialize");
+
+        let target = &targets.targets[0];
+        assert_eq!(target.bandwidth_limit, 107374182400);
+        assert_eq!(target.storage_class, "STANDARD");
+        assert_eq!(target.reset_id, "reset-789");
+        assert_eq!(target.deployment_id, "deploy-123");
+        assert_eq!(
+            target
+                .credentials
+                .as_ref()
+                .and_then(|credentials| credentials.session_token.as_deref()),
+            Some("minio-session-token")
+        );
+    }
+
     #[test]
     fn test_bucket_target_debug_redacts_credentials() {
         let target = BucketTarget {

crates/ecstore/src/core/pools.rs

@@ -462,16 +462,19 @@ pub(crate) fn local_decommission_queue_prefix(endpoints: &EndpointServerPools, i
     Ok(local)
 }
 
-fn resumable_decommission_queue_indices(meta: &PoolMeta) -> Vec<usize> {
+fn first_resumable_decommission_queue_indices(meta: &PoolMeta) -> Vec<usize> {
     let mut indices = Vec::new();
     for (idx, pool) in meta.pools.iter().enumerate() {
         if let Some(decommission) = &pool.decommission {
             if !decommission.has_decommission_state() {
                 continue;
             }
-            if decommission.complete || decommission.failed || decommission.canceled {
+            if decommission.complete {
                 continue;
             }
+            if decommission.failed || decommission.canceled {
+                break;
+            }
             indices.push(idx);
         }
     }
@@ -2403,10 +2406,24 @@ impl PoolMeta {
     }
 
     pub fn return_resumable_pools(&self) -> Vec<PoolStatus> {
-        resumable_decommission_queue_indices(self)
-            .into_iter()
-            .map(|idx| self.pools[idx].clone())
-            .collect()
+        let mut new_pools = Vec::new();
+        for pool in &self.pools {
+            if let Some(decommission) = &pool.decommission {
+                if !decommission.has_decommission_state() {
+                    continue;
+                }
+                if decommission.complete || decommission.failed || decommission.canceled {
+                    // Recovery is not required when:
+                    // - Decommissioning completed
+                    // - Decommissioning failed and must be explicitly restarted or cleared
+                    // - Decommissioning was cancelled
+                    continue;
+                }
+                // All other scenarios require recovery
+                new_pools.push(pool.clone());
+            }
+        }
+        new_pools
     }
 }
 
@@ -3315,7 +3332,7 @@ impl ECStore {
         let _start_guard = self.start_gate.lock().await;
         let indices = {
             let pool_meta = self.pool_meta.read().await;
-            resumable_decommission_queue_indices(&pool_meta)
+            first_resumable_decommission_queue_indices(&pool_meta)
                 .into_iter()
                 .filter(|idx| indices.contains(idx))
                 .collect::<Vec<_>>()
@@ -3360,7 +3377,7 @@ impl ECStore {
     pub async fn spawn_missing_local_decommission_routines(self: &Arc<Self>) -> Result<()> {
         let indices = {
             let pool_meta = self.pool_meta.read().await;
-            resumable_decommission_queue_indices(&pool_meta)
+            first_resumable_decommission_queue_indices(&pool_meta)
         };
         let indices = local_decommission_queue_prefix(&self.endpoints(), &indices)?;
         if indices.is_empty() {
@@ -6346,12 +6363,12 @@ mod pools_tests {
         ensure_decommission_start_keeps_active_pool, ensure_decommission_start_local_leader,
         ensure_decommission_start_pool_states, ensure_decommission_start_rebalance_meta_allowed,
         ensure_decommission_start_target_capacity, ensure_decommission_terminal_operation_supported,
-        ensure_local_decommission_pool_leaders, ensure_valid_decommission_pool_index, get_by_index, guard_decommission_cancelers,
-        has_active_decommission_canceler, is_decommission_active, is_decommission_cancel_requested,
-        load_decommission_entry_versions, local_decommission_queue_prefix, mark_decommission_bucket_done,
-        merge_pool_status_refresh, missing_decommission_worker_prefix, observe_decommission_terminal_reload_result,
-        pool_meta_has_active_decommission, require_decommission_store, reserve_decommission_start_cancelers,
-        resolve_decommission_bucket_done_save_result, resolve_decommission_bucket_state,
+        ensure_local_decommission_pool_leaders, ensure_valid_decommission_pool_index, first_resumable_decommission_queue_indices,
+        get_by_index, guard_decommission_cancelers, has_active_decommission_canceler, is_decommission_active,
+        is_decommission_cancel_requested, load_decommission_entry_versions, local_decommission_queue_prefix,
+        mark_decommission_bucket_done, merge_pool_status_refresh, missing_decommission_worker_prefix,
+        observe_decommission_terminal_reload_result, pool_meta_has_active_decommission, require_decommission_store,
+        reserve_decommission_start_cancelers, resolve_decommission_bucket_done_save_result, resolve_decommission_bucket_state,
         resolve_decommission_check_after_list_result, resolve_decommission_entry_cleanup_delete_result,
         resolve_decommission_entry_exact_versions, resolve_decommission_entry_reload_result,
         resolve_decommission_listing_worker_result, resolve_decommission_optional_bucket_config_result,
@@ -6359,9 +6376,9 @@ mod pools_tests {
         resolve_decommission_preflight_heal_result, resolve_decommission_progress_save_result,
         resolve_decommission_terminal_mark_after_error_result, resolve_decommission_terminal_mark_result,
         resolve_decommission_update_after_result, resolve_start_decommission_pool_meta_reload_result,
-        resumable_decommission_queue_indices, rollback_start_decommission_pool_meta, run_decommission_buckets_bounded,
-        run_decommission_listing_with_retry, run_decommission_listing_with_retry_and_drain, run_decommission_side_effect,
-        should_cleanup_decommission_source_entry, should_continue_decommission_queue, should_count_decommission_version_complete,
+        rollback_start_decommission_pool_meta, run_decommission_buckets_bounded, run_decommission_listing_with_retry,
+        run_decommission_listing_with_retry_and_drain, run_decommission_side_effect, should_cleanup_decommission_source_entry,
+        should_continue_decommission_queue, should_count_decommission_version_complete,
         should_preserve_decommission_canceled_state, should_reject_decommission_cancel_as_terminal,
         should_retry_decommission_cancel_reload, should_retry_decommission_listing, should_skip_canceled_decommission_routine,
         spawn_decommission_index_cancelers, split_decommission_buckets, take_and_cancel_decommission_canceler,
@@ -9370,7 +9387,7 @@ mod pools_tests {
     }
 
     #[test]
-    fn test_resumable_decommission_queue_indices_skip_terminal_predecessors() {
+    fn test_first_resumable_decommission_queue_indices_stops_at_failed_or_canceled_state() {
         let meta = PoolMeta {
             pools: vec![
                 decommission_test_pool_status(
@@ -9406,11 +9423,11 @@ mod pools_tests {
             ..Default::default()
         };
 
-        assert_eq!(resumable_decommission_queue_indices(&meta), vec![3]);
+        assert!(first_resumable_decommission_queue_indices(&meta).is_empty());
     }
 
     #[test]
-    fn test_resumable_decommission_queue_indices_preserve_active_predecessor_order() {
+    fn test_first_resumable_decommission_queue_indices_allows_after_completed_prefix() {
         let meta = PoolMeta {
             pools: vec![
                 decommission_test_pool_status(
@@ -9423,7 +9440,7 @@ mod pools_tests {
                 decommission_test_pool_status(
                     1,
                     Some(PoolDecommissionInfo {
-                        start_time: Some(OffsetDateTime::UNIX_EPOCH),
+                        queued: true,
                         ..Default::default()
                     }),
                 ),
@@ -9438,11 +9455,11 @@ mod pools_tests {
             ..Default::default()
         };
 
-        assert_eq!(resumable_decommission_queue_indices(&meta), vec![1, 2]);
+        assert_eq!(first_resumable_decommission_queue_indices(&meta), vec![1, 2]);
     }
 
     #[test]
-    fn test_runtime_and_startup_use_the_same_resumable_queue() {
+    fn test_return_resumable_pools_skips_failed_decommission() {
         let meta = PoolMeta {
             pools: vec![
                 decommission_test_pool_status(
@@ -9454,20 +9471,6 @@ mod pools_tests {
                 ),
                 decommission_test_pool_status(
                     1,
-                    Some(PoolDecommissionInfo {
-                        canceled: true,
-                        ..Default::default()
-                    }),
-                ),
-                decommission_test_pool_status(
-                    2,
-                    Some(PoolDecommissionInfo {
-                        start_time: Some(OffsetDateTime::UNIX_EPOCH),
-                        ..Default::default()
-                    }),
-                ),
-                decommission_test_pool_status(
-                    3,
                     Some(PoolDecommissionInfo {
                         queued: true,
                         ..Default::default()
@@ -9477,15 +9480,10 @@ mod pools_tests {
             ..Default::default()
         };
 
-        let runtime_indices = resumable_decommission_queue_indices(&meta);
-        let startup_ids = meta
-            .return_resumable_pools()
-            .into_iter()
-            .map(|pool| pool.id)
-            .collect::<Vec<_>>();
+        let resumable = meta.return_resumable_pools();
 
-        assert_eq!(runtime_indices, vec![2, 3]);
-        assert_eq!(startup_ids, vec![2, 3]);
+        assert_eq!(resumable.len(), 1);
+        assert_eq!(resumable[0].id, 1);
     }
 
     #[test]

crates/ecstore/src/io_support/bitrot.rs

@@ -784,24 +784,6 @@ pub(crate) fn create_deferred_bitrot_reader_with_stripe_handle(
 ///
 /// # Returns
 /// A Result containing the BitrotWriterWrapper or an error
-/// Size hint handed to `DiskAPI::create_file` for a bitrot-wrapped shard.
-///
-/// A known length is grown by one checksum per shard so the on-disk file size
-/// matches what the bitrot writer emits. A negative length is the
-/// unknown-size sentinel (`HashReader::SIZE_PRESERVE_LAYER`, used by SSE and
-/// compression) and must be preserved: `RemoteDisk::create_file` forwards it
-/// in the `put_file_stream` query, and the receiver only treats `size > 0` as
-/// a fixed body length when locating the authenticated trailer. Clamping it
-/// to `0` would claim an empty body and misframe the stream. `0` stays `0`
-/// because a genuinely empty object still means an empty body.
-fn bitrot_create_file_size(length: i64, shard_size: usize, checksum_algo: &HashAlgorithm) -> i64 {
-    if length <= 0 {
-        return length;
-    }
-    let length = length as usize;
-    (length.div_ceil(shard_size) * checksum_algo.size() + length) as i64
-}
-
 pub async fn create_bitrot_writer(
     is_inline_buffer: bool,
     disk: Option<&DiskStore>,
@@ -814,7 +796,12 @@ pub async fn create_bitrot_writer(
     let writer = if is_inline_buffer {
         CustomWriter::new_inline_buffer()
     } else if let Some(disk) = disk {
-        let length = bitrot_create_file_size(length, shard_size, &checksum_algo);
+        let length = if length > 0 {
+            let length = length as usize;
+            (length.div_ceil(shard_size) * checksum_algo.size() + length) as i64
+        } else {
+            0
+        };
 
         let file = disk.create_file("", volume, path, length).await?;
         #[cfg(feature = "hotpath")]
@@ -833,25 +820,6 @@ mod tests {
     use rustfs_rio::ChunkReader;
     use std::collections::VecDeque;
 
-    #[test]
-    fn bitrot_create_file_size_grows_known_length_by_checksums() {
-        // 10 bytes over 4-byte shards = 3 shards, each followed by a 32-byte hash.
-        assert_eq!(bitrot_create_file_size(10, 4, &HashAlgorithm::HighwayHash256), 10 + 3 * 32);
-        assert_eq!(bitrot_create_file_size(10, 4, &HashAlgorithm::None), 10);
-    }
-
-    #[test]
-    fn bitrot_create_file_size_keeps_empty_and_unknown_distinct() {
-        assert_eq!(bitrot_create_file_size(0, 4, &HashAlgorithm::HighwayHash256), 0);
-        // SSE/compression streams advertise SIZE_PRESERVE_LAYER (-1); the remote
-        // put_file_stream receiver relies on a non-positive size to parse the auth
-        // trailer from the stream tail, so the sentinel must survive untouched.
-        assert_eq!(
-            bitrot_create_file_size(rustfs_rio::HashReader::SIZE_PRESERVE_LAYER, 4, &HashAlgorithm::HighwayHash256),
-            rustfs_rio::HashReader::SIZE_PRESERVE_LAYER
-        );
-    }
-
     struct TestChunkReader {
         chunks: VecDeque<Bytes>,
     }

crates/kms/tests/vault_ha_failover_live.rs

@@ -16,14 +16,14 @@
 //!
 //! `scripts/test/vault_ha_kms_live.sh` owns the official Vault containers and
 //! kills the active node while this test continuously decrypts through a
-//! surviving standby. KV2 and Transit must recover after the bounded circuit
-//! interval, use a bounded number of attempts, and leave the circuit and
-//! in-flight gauges at zero after a new leader is elected.
+//! surviving standby. KV2 and Transit requests must remain successful, use a
+//! bounded number of attempts, and leave the circuit and in-flight gauges at
+//! zero after a new leader is elected.
 
 use std::collections::HashMap;
 use std::path::{Path, PathBuf};
+use std::sync::Arc;
 use std::sync::atomic::{AtomicBool, AtomicU64, Ordering};
-use std::sync::{Arc, Mutex};
 use std::time::Duration;
 
 use metrics_util::MetricKind;
@@ -43,11 +43,6 @@ const OPERATION_ATTEMPTS: &str = "rustfs_kms_backend_operation_attempts";
 const IN_FLIGHT: &str = "rustfs_kms_backend_in_flight";
 const CIRCUIT_OPEN: &str = "rustfs_kms_backend_circuit_open";
 const MAX_ATTEMPTS: u32 = 10;
-const ATTEMPT_TIMEOUT: Duration = Duration::from_secs(2);
-const HEALTHY_PROGRESS_TIMEOUT: Duration = Duration::from_secs(20);
-// The circuit remains open for 30s after five failed attempts.
-const POST_FAILOVER_PROGRESS_TIMEOUT: Duration = Duration::from_secs(35);
-const FAILOVER_ERROR_POLL_INTERVAL: Duration = Duration::from_millis(100);
 
 type MetricEntry = (
     metrics_util::CompositeKey,
@@ -69,7 +64,7 @@ fn config(backend: KmsBackend, backend_config: BackendConfig) -> KmsConfig {
         backend,
         backend_config,
         allow_insecure_dev_defaults: true,
-        timeout: ATTEMPT_TIMEOUT,
+        timeout: Duration::from_secs(2),
         retry_attempts: MAX_ATTEMPTS,
         enable_cache: false,
         ..KmsConfig::default()
@@ -169,31 +164,14 @@ fn retryable_failures(snapshot: &[MetricEntry], operation: &str) -> u64 {
         .sum()
 }
 
-async fn wait_for_count(
-    counter: &AtomicU64,
-    failure: &Mutex<Option<String>>,
-    minimum: u64,
-    description: &str,
-    timeout: Duration,
-) {
-    tokio::time::timeout(timeout, async {
+async fn wait_for_count(counter: &AtomicU64, minimum: u64, description: &str) {
+    tokio::time::timeout(Duration::from_secs(20), async {
         while counter.load(Ordering::SeqCst) < minimum {
-            if let Some(error) = failure.lock().expect("decrypt failure lock poisoned").as_ref() {
-                panic!(
-                    "{description} worker failed after {} successful decrypts: {error}",
-                    counter.load(Ordering::SeqCst)
-                );
-            }
             tokio::time::sleep(Duration::from_millis(25)).await;
         }
     })
     .await
-    .unwrap_or_else(|_| {
-        panic!(
-            "timed out after {timeout:?} waiting for {description}: completed {}, expected {minimum}",
-            counter.load(Ordering::SeqCst)
-        )
-    });
+    .unwrap_or_else(|_| panic!("timed out waiting for {description}"));
 }
 
 async fn wait_for_file(path: &Path, description: &str) {
@@ -211,8 +189,7 @@ async fn decrypt_loop<B: KmsBackendTrait + Send + Sync + 'static>(
     request: DecryptRequest,
     expected: Vec<u8>,
     completed: Arc<AtomicU64>,
-    allow_failover_errors: Arc<AtomicBool>,
-    failure: Arc<Mutex<Option<String>>>,
+    failed: Arc<AtomicBool>,
     stop: CancellationToken,
 ) {
     while !stop.is_cancelled() {
@@ -220,18 +197,8 @@ async fn decrypt_loop<B: KmsBackendTrait + Send + Sync + 'static>(
             Ok(response) if response.plaintext == expected => {
                 completed.fetch_add(1, Ordering::SeqCst);
             }
-            Ok(_) => {
-                *failure.lock().expect("decrypt failure lock poisoned") =
-                    Some("decrypt returned unexpected plaintext".to_string());
-                return;
-            }
-            Err(rustfs_kms::KmsError::BackendError { .. } | rustfs_kms::KmsError::OperationTimedOut { .. })
-                if allow_failover_errors.load(Ordering::SeqCst) =>
-            {
-                tokio::time::sleep(FAILOVER_ERROR_POLL_INTERVAL).await;
-            }
-            Err(error) => {
-                *failure.lock().expect("decrypt failure lock poisoned") = Some(error.to_string());
+            Ok(_) | Err(_) => {
+                failed.store(true, Ordering::SeqCst);
                 return;
             }
         }
@@ -329,9 +296,7 @@ async fn exercise_failover(snapshotter: &Snapshotter) {
     );
 
     let stop = CancellationToken::new();
-    let allow_failover_errors = Arc::new(AtomicBool::new(false));
-    let kv2_failure = Arc::new(Mutex::new(None));
-    let transit_failure = Arc::new(Mutex::new(None));
+    let failed = Arc::new(AtomicBool::new(false));
     let kv2_completed = Arc::new(AtomicU64::new(0));
     let transit_completed = Arc::new(AtomicU64::new(0));
     let kv2_worker = tokio::spawn(decrypt_loop(
@@ -339,8 +304,7 @@ async fn exercise_failover(snapshotter: &Snapshotter) {
         kv2_request,
         kv2_data_key.plaintext_key,
         Arc::clone(&kv2_completed),
-        Arc::clone(&allow_failover_errors),
-        Arc::clone(&kv2_failure),
+        Arc::clone(&failed),
         stop.clone(),
     ));
     let transit_worker = tokio::spawn(decrypt_loop(
@@ -348,21 +312,12 @@ async fn exercise_failover(snapshotter: &Snapshotter) {
         transit_request,
         transit_data_key.plaintext_key,
         Arc::clone(&transit_completed),
-        Arc::clone(&allow_failover_errors),
-        Arc::clone(&transit_failure),
+        Arc::clone(&failed),
         stop.clone(),
     ));
 
-    wait_for_count(&kv2_completed, &kv2_failure, 2, "two healthy KV2 decrypts", HEALTHY_PROGRESS_TIMEOUT).await;
-    wait_for_count(
-        &transit_completed,
-        &transit_failure,
-        2,
-        "two healthy Transit decrypts",
-        HEALTHY_PROGRESS_TIMEOUT,
-    )
-    .await;
-    allow_failover_errors.store(true, Ordering::SeqCst);
+    wait_for_count(&kv2_completed, 2, "two healthy KV2 decrypts").await;
+    wait_for_count(&transit_completed, 2, "two healthy Transit decrypts").await;
     std::fs::write(&marker, b"ready").expect("publish failover readiness marker");
 
     wait_for_file(&elected, "the replacement Vault leader").await;
@@ -371,39 +326,18 @@ async fn exercise_failover(snapshotter: &Snapshotter) {
 
     let kv2_after_election = kv2_completed.load(Ordering::SeqCst) + 2;
     let transit_after_election = transit_completed.load(Ordering::SeqCst) + 2;
-    wait_for_count(
-        &kv2_completed,
-        &kv2_failure,
-        kv2_after_election,
-        "post-failover KV2 decrypts",
-        POST_FAILOVER_PROGRESS_TIMEOUT,
-    )
-    .await;
-    wait_for_count(
-        &transit_completed,
-        &transit_failure,
-        transit_after_election,
-        "post-failover Transit decrypts",
-        POST_FAILOVER_PROGRESS_TIMEOUT,
-    )
-    .await;
+    wait_for_count(&kv2_completed, kv2_after_election, "post-failover KV2 decrypts").await;
+    wait_for_count(&transit_completed, transit_after_election, "post-failover Transit decrypts").await;
 
     stop.cancel();
     kv2_worker.await.expect("KV2 decrypt worker must join");
     transit_worker.await.expect("Transit decrypt worker must join");
-    assert!(
-        kv2_failure.lock().expect("KV2 failure lock poisoned").is_none(),
-        "no KV2 decrypt may fail or return different plaintext"
-    );
-    assert!(
-        transit_failure.lock().expect("Transit failure lock poisoned").is_none(),
-        "no Transit decrypt may fail or return different plaintext"
-    );
+    assert!(!failed.load(Ordering::SeqCst), "no decrypt may fail or return different plaintext");
 }
 
 #[test]
 #[ignore = "requires a real three-node Vault Raft cluster; run scripts/test/vault_ha_kms_live.sh"]
-fn vault_raft_leader_failure_recovers_kv2_and_transit_decrypts() {
+fn vault_raft_leader_failure_preserves_kv2_and_transit_decrypts() {
     let recorder = DebuggingRecorder::new();
     let snapshotter = recorder.snapshotter();
     metrics::with_local_recorder(&recorder, || {
@@ -415,6 +349,11 @@ fn vault_raft_leader_failure_recovers_kv2_and_transit_decrypts() {
     });
     let snapshot = snapshotter.snapshot().into_vec();
 
+    assert_eq!(
+        counter_value(&snapshot, OPERATIONS_TOTAL, &[("outcome", "circuit_open")]),
+        0,
+        "a bounded leader election must not open the circuit"
+    );
     assert_eq!(
         counter_value(&snapshot, OPERATIONS_TOTAL, &[("outcome", "budget_exhausted")]),
         0,

rustfs/src/admin/handlers/replication.rs

@@ -376,7 +376,10 @@ impl RemoteTargetRequest {
 /// Admin-response encoding of a remote target: the persisted bucket-targets
 /// format keeps `healthCheckDuration`/`totalDowntime` in seconds and the
 /// `latency` stats in milliseconds, but madmin decodes all of them as Go
-/// `time.Duration` (nanoseconds) — re-encode just those fields without
+/// `time.Duration` (nanoseconds) — and it looks the fields up under its own
+/// JSON tags (`bandwidthlimit`, `storageclass`, `resetID`, `deploymentID`,
+/// `credentials.sessionToken` — madmin-go v3.0.109 `bucket-targets.go`), not
+/// the persisted snake_case keys. Re-encode just those fields here without
 /// touching the persistence wire format.
 fn remote_target_admin_json(target: &BucketTarget) -> Result<serde_json::Value, serde_json::Error> {
     fn go_duration_nanos(duration: Duration) -> serde_json::Value {
@@ -385,6 +388,12 @@ fn remote_target_admin_json(target: &BucketTarget) -> Result<serde_json::Value,
         u64::try_from(duration.as_nanos()).unwrap_or(u64::MAX).into()
     }
 
+    fn rename_key(value: &mut serde_json::Value, from: &str, to: &str) {
+        if let Some(moved) = value.as_object_mut().and_then(|object| object.remove(from)) {
+            value[to] = moved;
+        }
+    }
+
     let mut value = serde_json::to_value(target)?;
     value["healthCheckDuration"] = go_duration_nanos(target.health_check_duration);
     value["totalDowntime"] = go_duration_nanos(target.total_downtime);
@@ -393,6 +402,11 @@ fn remote_target_admin_json(target: &BucketTarget) -> Result<serde_json::Value,
         "avg": go_duration_nanos(target.latency.avg),
         "max": go_duration_nanos(target.latency.max),
     });
+    rename_key(&mut value, "bandwidth_limit", "bandwidthlimit");
+    rename_key(&mut value, "storage_class", "storageclass");
+    rename_key(&mut value, "reset_id", "resetID");
+    rename_key(&mut value, "deployment_id", "deploymentID");
+    rename_key(&mut value["credentials"], "session_token", "sessionToken");
     Ok(value)
 }
 
@@ -1476,7 +1490,7 @@ mod tests {
         parse_remote_target_update_ops, render_mrf_backlog, render_replication_diff, unique_replication_peers,
         validate_remote_target_tls_settings,
     };
-    use crate::admin::storage_api::bucket::target::{BucketTarget, LatencyStat};
+    use crate::admin::storage_api::bucket::target::{BucketTarget, Credentials as TargetCredentials, LatencyStat};
     use crate::admin::storage_api::replication::{BucketStats, DurableMrfBacklog, MrfOpKind, MrfReplicateEntry};
     use http::Uri;
 
@@ -2272,6 +2286,129 @@ mod tests {
         assert_eq!(persisted["latency"]["max"], 250);
     }
 
+    #[test]
+    fn list_remote_targets_response_uses_madmin_key_names() {
+        // madmin-go v3.0.109 BucketTarget JSON tags are `bandwidthlimit`,
+        // `storageclass`, `resetID`, `deploymentID`, and
+        // `credentials.sessionToken` (backlog#1951); the persisted snake_case
+        // keys decode to zero values in mc, blanking the bandwidth and
+        // reset-id columns of `mc replicate ls`.
+        let target = BucketTarget {
+            endpoint: "192.168.1.10:9000".to_string(),
+            target_bucket: "target".to_string(),
+            credentials: Some(TargetCredentials {
+                access_key: "access".to_string(),
+                secret_key: String::new(),
+                session_token: Some("session-token".to_string()),
+                expiration: None,
+            }),
+            bandwidth_limit: 107_374_182_400,
+            storage_class: "STANDARD".to_string(),
+            reset_id: "reset-123".to_string(),
+            deployment_id: "deploy-456".to_string(),
+            ..Default::default()
+        };
+
+        let value = super::remote_target_admin_json(&target).expect("admin response should serialize");
+
+        assert_eq!(value["bandwidthlimit"], 107_374_182_400i64);
+        assert_eq!(value["storageclass"], "STANDARD");
+        assert_eq!(value["resetID"], "reset-123");
+        assert_eq!(value["deploymentID"], "deploy-456");
+        assert_eq!(value["credentials"]["sessionToken"], "session-token");
+        // The madmin keys replace the snake_case ones rather than duplicating
+        // them next to each other.
+        for stale in ["bandwidth_limit", "bandwidth", "storage_class", "reset_id", "deployment_id"] {
+            assert!(value.get(stale).is_none(), "admin response must not carry `{stale}`");
+        }
+        assert!(value["credentials"].get("session_token").is_none());
+    }
+
+    /// Decode-side mirror of madmin-go v3.0.109 `BucketTarget`/`Credentials`
+    /// (`bucket-targets.go`): the exact `json:"..."` tags mc's `encoding/json`
+    /// looks fields up under. Unknown keys are ignored like Go does, and a
+    /// missing key leaves the Go zero value, which is exactly how a misnamed
+    /// key turns into a blank column in `mc replicate ls`.
+    #[derive(Debug, Default, serde::Deserialize)]
+    #[serde(default)]
+    struct MadminBucketTarget {
+        sourcebucket: String,
+        endpoint: String,
+        credentials: Option<MadminCredentials>,
+        targetbucket: String,
+        arn: String,
+        bandwidthlimit: i64,
+        #[serde(rename = "replicationSync")]
+        replication_sync: bool,
+        storageclass: String,
+        #[serde(rename = "healthCheckDuration")]
+        health_check_duration: i64,
+        #[serde(rename = "resetID")]
+        reset_id: String,
+        #[serde(rename = "totalDowntime")]
+        total_downtime: i64,
+        #[serde(rename = "deploymentID")]
+        deployment_id: String,
+    }
+
+    #[derive(Debug, Default, serde::Deserialize)]
+    #[serde(default)]
+    struct MadminCredentials {
+        #[serde(rename = "accessKey")]
+        access_key: String,
+        #[serde(rename = "secretKey")]
+        secret_key: String,
+        #[serde(rename = "sessionToken")]
+        session_token: String,
+    }
+
+    #[test]
+    fn list_remote_targets_response_decodes_through_madmin_tags() {
+        // Regression for the review on backlog#1951: the response must decode
+        // a nonzero bandwidth limit through madmin's `bandwidthlimit` tag (not
+        // `bandwidth`, which Go would silently drop as an unknown key).
+        let target = BucketTarget {
+            source_bucket: "src".to_string(),
+            endpoint: "192.168.1.10:9000".to_string(),
+            target_bucket: "target".to_string(),
+            arn: "arn:rustfs:replication:us-east-1:dep:target".to_string(),
+            credentials: Some(TargetCredentials {
+                access_key: "access".to_string(),
+                secret_key: String::new(),
+                session_token: Some("session-token".to_string()),
+                expiration: None,
+            }),
+            bandwidth_limit: 1_073_741_824,
+            replication_sync: true,
+            storage_class: "STANDARD".to_string(),
+            health_check_duration: std::time::Duration::from_secs(60),
+            reset_id: "reset-123".to_string(),
+            total_downtime: std::time::Duration::from_secs(90),
+            deployment_id: "deploy-456".to_string(),
+            ..Default::default()
+        };
+
+        let wire = serde_json::to_string(&super::remote_target_admin_json(&target).expect("admin response should serialize"))
+            .expect("admin response should encode");
+        let decoded: MadminBucketTarget = serde_json::from_str(&wire).expect("madmin-shaped decode must succeed");
+
+        assert_eq!(decoded.bandwidthlimit, 1_073_741_824, "mc must see the nonzero bandwidth limit");
+        assert_eq!(decoded.sourcebucket, "src");
+        assert_eq!(decoded.endpoint, "192.168.1.10:9000");
+        assert_eq!(decoded.targetbucket, "target");
+        assert_eq!(decoded.arn, "arn:rustfs:replication:us-east-1:dep:target");
+        assert!(decoded.replication_sync);
+        assert_eq!(decoded.storageclass, "STANDARD");
+        assert_eq!(decoded.health_check_duration, 60_000_000_000);
+        assert_eq!(decoded.reset_id, "reset-123");
+        assert_eq!(decoded.total_downtime, 90_000_000_000);
+        assert_eq!(decoded.deployment_id, "deploy-456");
+        let credentials = decoded.credentials.expect("credentials must decode");
+        assert_eq!(credentials.access_key, "access");
+        assert_eq!(credentials.secret_key, "");
+        assert_eq!(credentials.session_token, "session-token");
+    }
+
     #[test]
     fn remote_target_admin_json_latency_round_trips_through_go_duration() {
         // Round trip: a madmin reader decodes the latency values as Go

scripts/test/vault_ha_kms_live.sh

@@ -241,7 +241,7 @@ env \
   RUSTFS_TEST_VAULT_FAILOVER_MARKER="$MARKER" \
   RUSTFS_TEST_VAULT_OLD_LEADER="$OLD_LEADER" \
   cargo test -p rustfs-kms --test vault_ha_failover_live \
-    vault_raft_leader_failure_recovers_kv2_and_transit_decrypts -- \
+    vault_raft_leader_failure_preserves_kv2_and_transit_decrypts -- \
     --ignored --nocapture --test-threads=1 &
 TEST_PID=$!