fix(scanner): correct observational usage arguments

* fix(heal): fence format repair during pool transitions

* fix(heal): fence format writes during transitions

.github/workflows/e2e-s3tests.yml

@@ -21,9 +21,6 @@
 #     suite and reports promotion candidates. Regressions, unclassified tests,
 #     incomplete execution, and infrastructure errors fail the job; classified
 #     failures for not-yet-implemented features remain informational.
-#   - Non-blocking upstream HEAD canary: collects current upstream node IDs and
-#     reports new, removed, duplicate, or overlapping classifications without
-#     making upstream drift a release gate.
 #   - Manual runs (workflow_dispatch): same, with configurable mode/scope.
 #
 # All test execution is delegated to scripts/s3-tests/run.sh (single source of
@@ -357,85 +354,6 @@ jobs:
           name: s3tests-${{ env.TEST_MODE }}-shard-${{ matrix.shard-index }}
           path: artifacts/**
 
-  upstream-head-canary:
-    name: Upstream HEAD classification canary
-    if: github.event_name == 'schedule' || github.event_name == 'workflow_dispatch'
-    continue-on-error: true
-    runs-on: ubuntu-latest
-    timeout-minutes: 20
-    steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
-        with:
-          persist-credentials: false
-
-      - name: Set up Python
-        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
-        with:
-          python-version: "3.12"
-
-      - name: Install collection tool
-        run: |
-          python3 -m pip install --user "tox==4.60.0"
-          python3 - <<'PY'
-          from importlib.metadata import version
-
-          assert version("tox") == "4.60.0"
-          PY
-          echo "$HOME/.local/bin" >> "$GITHUB_PATH"
-
-      - name: Compare upstream HEAD classifications
-        id: upstream-compare
-        run: |
-          ARTIFACT_DIR="artifacts/s3tests-upstream-head"
-          UPSTREAM_DIR="${RUNNER_TEMP}/s3-tests-upstream"
-          mkdir -p "${ARTIFACT_DIR}"
-          git clone --depth 1 https://github.com/ceph/s3-tests.git "${UPSTREAM_DIR}"
-          git -C "${UPSTREAM_DIR}" rev-parse HEAD > "${ARTIFACT_DIR}/upstream-sha.txt"
-          cp "${UPSTREAM_DIR}/s3tests.conf.SAMPLE" "${UPSTREAM_DIR}/s3tests.conf"
-          (
-            cd "${UPSTREAM_DIR}"
-            S3TEST_CONF="${UPSTREAM_DIR}/s3tests.conf" tox -- \
-              -q --collect-only s3tests/functional/test_s3.py \
-              -m "not rustfs_never_marker"
-          ) 2>&1 | tee "${ARTIFACT_DIR}/collect.log"
-          grep -E '^s3tests/functional/test_s3\.py::' \
-            "${ARTIFACT_DIR}/collect.log" > "${ARTIFACT_DIR}/collected-nodeids.txt"
-          python3 scripts/s3-tests/report_compat.py \
-            --lists-dir scripts/s3-tests \
-            --collected-nodeids "${ARTIFACT_DIR}/collected-nodeids.txt" \
-            --check-classifications-only 2>&1 | tee "${ARTIFACT_DIR}/classification-drift.txt"
-
-      - name: Publish canary report
-        if: always()
-        env:
-          CANARY_OUTCOME: ${{ steps.upstream-compare.outcome }}
-        run: |
-          {
-            echo "## ceph/s3-tests upstream HEAD canary"
-            echo
-            if [ -f artifacts/s3tests-upstream-head/upstream-sha.txt ]; then
-              echo "Upstream HEAD: $(cat artifacts/s3tests-upstream-head/upstream-sha.txt)"
-            fi
-            echo
-            echo '```text'
-            if [ -s artifacts/s3tests-upstream-head/classification-drift.txt ]; then
-              cat artifacts/s3tests-upstream-head/classification-drift.txt
-            elif [ "${CANARY_OUTCOME}" != "success" ]; then
-              echo "Canary did not complete; inspect the collection log artifact."
-            else
-              echo "No classification drift detected."
-            fi
-            echo '```'
-          } >> "$GITHUB_STEP_SUMMARY"
-
-      - name: Upload canary artifacts
-        if: always() && env.ACT != 'true'
-        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
-        with:
-          name: s3tests-upstream-head
-          path: artifacts/s3tests-upstream-head/**
-          retention-days: 14
-
   alert-on-failure:
     name: Alert on scheduled failure
     needs: [s3tests]

Cargo.lock

@@ -12688,6 +12688,7 @@ dependencies = [
  "js-sys",
  "rand 0.10.2",
  "serde_core",
+ "sha1_smol",
  "wasm-bindgen",
 ]
 

crates/data-usage/src/data_usage.rs

@@ -236,6 +236,15 @@ pub struct DataUsageInfo {
     /// without relying on synchronized clocks.
     #[serde(default, skip_serializing_if = "Option::is_none")]
     pub usage_snapshot_authoritative_baseline: Option<DataUsageSnapshotIdentity>,
+    /// Per-set freshness for an observational aggregate.  A set entry is
+    /// never sufficient to make the aggregate authoritative; it only records
+    /// which last-known-good generation contributed to the view.
+    #[serde(default, skip_serializing_if = "Vec::is_empty")]
+    pub usage_snapshot_set_states: Vec<DataUsageSnapshotSetState>,
+    /// An observational view may contain only the sets that completed this
+    /// cycle (or retained a compatible last-known-good cache).
+    #[serde(default)]
+    pub usage_snapshot_partial: bool,
     /// Deprecated kept here for backward compatibility reasons
     pub bucket_sizes: HashMap<String, u64>,
     /// Per-disk snapshot information when available
@@ -252,6 +261,22 @@ pub struct DataUsageSnapshotIdentity {
     pub scanner_epoch: Option<u64>,
 }
 
+#[derive(Clone, Debug, Default, Serialize, Deserialize, PartialEq, Eq)]
+pub struct DataUsageSnapshotSetState {
+    pub pool_index: u64,
+    pub set_index: u64,
+    #[serde(default)]
+    pub scanner_cycle: Option<u64>,
+    #[serde(default)]
+    pub scanner_epoch: Option<u64>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub scan_plan_digest: Option<[u8; 32]>,
+    #[serde(default)]
+    pub complete: bool,
+    #[serde(default)]
+    pub tombstone: bool,
+}
+
 impl DataUsageInfo {
     pub fn snapshot_identity(&self) -> DataUsageSnapshotIdentity {
         DataUsageSnapshotIdentity {
@@ -291,7 +316,7 @@ pub fn data_usage_snapshot_is_newer(candidate: &DataUsageInfo, baseline: &DataUs
 /// rollback delete/recreate fences the previous bucket incarnation too.
 pub fn observed_data_usage_is_newer(observed: &DataUsageInfo, authoritative: &DataUsageInfo) -> bool {
     observed.usage_snapshot_converged == Some(false)
-        && observed.is_complete_bucket_usage_snapshot()
+        && (observed.is_complete_bucket_usage_snapshot() || observed.is_valid_partial_snapshot())
         && observed.usage_snapshot_authoritative_baseline.as_ref() == Some(&authoritative.snapshot_identity())
         && data_usage_snapshot_is_newer(observed, authoritative)
 }
@@ -1436,6 +1461,39 @@ impl DataUsageInfo {
             && u64::try_from(self.buckets_usage.len()).ok() == Some(self.buckets_count)
     }
 
+    /// Validate provenance before an observational view can be selected for
+    /// admin display. Partial data is accepted only with unique set states,
+    /// a plan digest for every state, and at least one usable generation.
+    pub fn is_valid_partial_snapshot(&self) -> bool {
+        if !self.usage_snapshot_partial
+            || self.usage_snapshot_converged != Some(false)
+            || self.last_update.is_none()
+            || self.scanner_cycle.is_none()
+            || self.scanner_epoch.is_none()
+            || self.usage_snapshot_set_states.is_empty()
+            || u64::try_from(self.buckets_usage.len()).ok() != Some(self.buckets_count)
+        {
+            return false;
+        }
+
+        let mut previous = None;
+        let mut plan_digest = None;
+        let mut has_source = false;
+        for state in &self.usage_snapshot_set_states {
+            if state.scan_plan_digest.is_none()
+                || plan_digest.is_some_and(|digest| Some(digest) != state.scan_plan_digest)
+                || state.scanner_cycle.is_some() != state.scanner_epoch.is_some()
+                || previous.is_some_and(|(pool, set)| (pool, set) >= (state.pool_index, state.set_index))
+            {
+                return false;
+            }
+            previous = Some((state.pool_index, state.set_index));
+            plan_digest = state.scan_plan_digest;
+            has_source |= state.scanner_cycle.is_some() && !state.tombstone;
+        }
+        has_source
+    }
+
     /// Add object metadata to data usage statistics
     pub fn add_object(&mut self, object_path: &str, meta_object: &rustfs_filemeta::MetaObject) {
         // This method is kept for backward compatibility
@@ -2263,6 +2321,55 @@ mod tests {
         assert!(!observed_data_usage_is_newer(&candidate(2, 9, Some(false), true), &authoritative));
         assert!(!observed_data_usage_is_newer(&candidate(2, 11, Some(true), true), &authoritative));
         assert!(!observed_data_usage_is_newer(&candidate(2, 11, Some(false), false), &authoritative));
+
+        let mut partial = candidate(2, 11, Some(false), false);
+        partial.usage_snapshot_partial = true;
+        partial.usage_snapshot_set_states = vec![DataUsageSnapshotSetState {
+            pool_index: 0,
+            set_index: 0,
+            scanner_cycle: Some(10),
+            scanner_epoch: Some(2),
+            scan_plan_digest: Some([1; 32]),
+            complete: false,
+            tombstone: false,
+        }];
+        assert!(observed_data_usage_is_newer(&partial, &authoritative));
+    }
+
+    #[test]
+    fn mixed_topology_snapshot_is_rejected() {
+        let mut partial = DataUsageInfo {
+            last_update: Some(SystemTime::UNIX_EPOCH + Duration::from_secs(2)),
+            scanner_cycle: Some(11),
+            scanner_epoch: Some(2),
+            buckets_count: 0,
+            usage_snapshot_converged: Some(false),
+            usage_snapshot_partial: true,
+            usage_snapshot_set_states: vec![
+                DataUsageSnapshotSetState {
+                    pool_index: 0,
+                    set_index: 0,
+                    scanner_cycle: Some(11),
+                    scanner_epoch: Some(2),
+                    scan_plan_digest: Some([1; 32]),
+                    complete: true,
+                    tombstone: false,
+                },
+                DataUsageSnapshotSetState {
+                    pool_index: 1,
+                    set_index: 0,
+                    scanner_cycle: Some(10),
+                    scanner_epoch: Some(2),
+                    scan_plan_digest: Some([2; 32]),
+                    complete: false,
+                    tombstone: false,
+                },
+            ],
+            ..Default::default()
+        };
+        assert!(!partial.is_valid_partial_snapshot());
+        partial.usage_snapshot_set_states[1].scan_plan_digest = Some([1; 32]);
+        assert!(partial.is_valid_partial_snapshot());
     }
 
     #[test]

crates/ecstore/src/core/pools.rs

@@ -2026,7 +2026,7 @@ impl PoolMeta {
         self.load_no_lock(pool).await
     }
 
-    async fn load_no_lock<S>(&mut self, pool: Arc<S>) -> Result<()>
+    pub(crate) async fn load_no_lock<S>(&mut self, pool: Arc<S>) -> Result<()>
     where
         S: EcstoreObjectIO,
     {

crates/ecstore/src/core/sets.rs

@@ -988,14 +988,11 @@ impl crate::storage_api_contracts::multipart::MultipartOperations for Sets {
     }
 }
 
-#[async_trait::async_trait]
-impl crate::storage_api_contracts::heal::HealOperations for Sets {
-    type Error = Error;
-    type HealResultItem = HealResultItem;
-    type HealOptions = HealOpts;
-
-    #[tracing::instrument(skip(self))]
-    async fn heal_format(&self, dry_run: bool) -> Result<(HealResultItem, Option<Error>)> {
+impl Sets {
+    pub(crate) async fn heal_format_with_fence<F>(&self, dry_run: bool, fence_lost: F) -> Result<(HealResultItem, Option<Error>)>
+    where
+        F: Fn() -> bool + Send + Sync,
+    {
         let (disks, init_errs) = init_storage_disks_with_errors(
             &self.endpoints.endpoints,
             &DiskOption {
@@ -1068,6 +1065,9 @@ impl crate::storage_api_contracts::heal::HealOperations for Sets {
             // Save new formats `format.json` on unformatted disks.
             for (index, (fm, disk)) in tmp_new_formats.iter_mut().zip(disks.iter()).enumerate() {
                 if fm.is_some() && disk.is_some() {
+                    if fence_lost() {
+                        return Ok((res, Some(StorageError::SlowDown)));
+                    }
                     if let Err(err) = save_format_file(disk, fm).await {
                         if let Some(disk) = disk.as_ref() {
                             let _ = disk.close().await;
@@ -1101,6 +1101,18 @@ impl crate::storage_api_contracts::heal::HealOperations for Sets {
         }
         Ok((res, None))
     }
+}
+
+#[async_trait::async_trait]
+impl crate::storage_api_contracts::heal::HealOperations for Sets {
+    type Error = Error;
+    type HealResultItem = HealResultItem;
+    type HealOptions = HealOpts;
+
+    #[tracing::instrument(skip(self))]
+    async fn heal_format(&self, dry_run: bool) -> Result<(HealResultItem, Option<Error>)> {
+        self.heal_format_with_fence(dry_run, || false).await
+    }
     #[tracing::instrument(skip(self))]
     async fn heal_bucket(&self, bucket: &str, opts: &HealOpts) -> Result<HealResultItem> {
         let mut result = HealResultItem {

crates/ecstore/src/data_usage/mod.rs

@@ -73,6 +73,16 @@ struct CachedBucketUsage {
     // mutation. A strictly later generation is required before the mutation
     // evidence can be discarded.
     pending_scanner_position: Option<(u64, u64)>,
+    // Deletes are visible to admin immediately, but quota admission keeps
+    // them pending until a complete scanner generation reconciles the set.
+    // This marker intentionally remains process-local: the delete request
+    // updates this overlay before the scanner writes a durable snapshot. If
+    // the process restarts first, loading the persisted complete snapshot
+    // restores the pre-reconciliation (larger) baseline, which is
+    // conservative for quota admission. A persisted post-delete snapshot is
+    // necessarily a complete scanner reconciliation and therefore creates a
+    // fresh cache entry with no pending hold.
+    pending_negative_delta: u64,
 }
 
 type UsageMemoryCache = Arc<RwLock<HashMap<String, CachedBucketUsage>>>;
@@ -948,7 +958,12 @@ async fn load_observed_data_usage_snapshot(store: Arc<ECStore>) -> Option<DataUs
     };
 
     match parse_usage_snapshot(&data) {
-        Ok(info) if info.usage_snapshot_converged == Some(false) && info.is_complete_bucket_usage_snapshot() => Some(info),
+        Ok(info)
+            if info.usage_snapshot_converged == Some(false)
+                && (info.is_complete_bucket_usage_snapshot() || info.is_valid_partial_snapshot()) =>
+        {
+            Some(info)
+        }
         Ok(_) => {
             error!(
                 event = "data_usage_snapshot_load_failed",
@@ -993,7 +1008,7 @@ async fn load_admin_data_usage_from_backend(store: Arc<ECStore>) -> Result<DataU
 }
 
 fn discard_incomplete_bucket_usage(data_usage_info: &mut DataUsageInfo) {
-    if !data_usage_info.is_complete_bucket_usage_snapshot() {
+    if !data_usage_info.is_complete_bucket_usage_snapshot() && !data_usage_info.usage_snapshot_partial {
         data_usage_info.usage_snapshot_complete = false;
         data_usage_info.buckets_usage.clear();
         data_usage_info.bucket_sizes.clear();
@@ -1643,6 +1658,7 @@ fn cached_bucket_usage_from_backend(usage: BucketUsageInfo, updated_at: SystemTi
         dirty: false,
         stale_snapshot_pending: false,
         pending_scanner_position: None,
+        pending_negative_delta: 0,
     }
 }
 
@@ -1656,6 +1672,7 @@ fn cached_bucket_usage_now(usage: BucketUsageInfo) -> CachedBucketUsage {
         dirty: false,
         stale_snapshot_pending: false,
         pending_scanner_position: None,
+        pending_negative_delta: 0,
     }
 }
 
@@ -1808,6 +1825,7 @@ pub async fn record_bucket_object_delete_memory(bucket: &str, deleted_size: u64,
         .or_insert_with(|| cached_bucket_usage_now(BucketUsageInfo::default()));
 
     entry.usage.size = entry.usage.size.saturating_sub(deleted_size);
+    entry.pending_negative_delta = entry.pending_negative_delta.saturating_add(deleted_size);
     if removed_current_object {
         entry.usage.objects_count = entry.usage.objects_count.saturating_sub(1);
         entry.usage.versions_count = entry.usage.versions_count.saturating_sub(1);
@@ -1863,7 +1881,7 @@ pub async fn get_bucket_usage_memory(bucket: &str) -> Option<u64> {
     cache
         .get(bucket)
         .filter(|cached| cached.authoritative)
-        .map(|cached| cached.usage.size)
+        .map(|cached| cached.usage.size.saturating_add(cached.pending_negative_delta))
 }
 
 async fn update_usage_cache_if_needed() {
@@ -2943,6 +2961,45 @@ mod tests {
         assert_eq!(selected.usage_snapshot_converged, Some(true));
     }
 
+    #[test]
+    fn persisted_authoritative_stalls_but_memory_overlay_remains_visible() {
+        let authoritative = DataUsageInfo {
+            last_update: Some(SystemTime::UNIX_EPOCH),
+            scanner_epoch: Some(4),
+            scanner_cycle: Some(10),
+            usage_snapshot_complete: true,
+            ..Default::default()
+        };
+        let mut partial = authoritative.clone();
+        partial.last_update = Some(SystemTime::UNIX_EPOCH + Duration::from_secs(1));
+        partial.scanner_cycle = Some(11);
+        partial.usage_snapshot_complete = false;
+        partial.usage_snapshot_partial = true;
+        partial.usage_snapshot_converged = Some(false);
+        partial.usage_snapshot_authoritative_baseline = Some(authoritative.snapshot_identity());
+        partial.usage_snapshot_set_states = vec![rustfs_data_usage::DataUsageSnapshotSetState {
+            pool_index: 0,
+            set_index: 0,
+            scanner_cycle: Some(10),
+            scanner_epoch: Some(4),
+            scan_plan_digest: Some([1; 32]),
+            complete: false,
+            tombstone: false,
+        }];
+        partial.buckets_usage.insert(
+            "bucket".to_string(),
+            BucketUsageInfo {
+                size: 100,
+                ..Default::default()
+            },
+        );
+        partial.buckets_count = 1;
+
+        let (selected, _) = select_admin_data_usage_snapshot(authoritative, true, Some(partial));
+        assert!(selected.usage_snapshot_partial);
+        assert_eq!(selected.buckets_usage.get("bucket").map(|usage| usage.size), Some(100));
+    }
+
     #[tokio::test]
     async fn authoritative_save_cleanup_removes_observed_snapshot_best_effort() {
         let store = UsageCasStore::default();
@@ -4665,6 +4722,55 @@ mod tests {
         );
     }
 
+    #[tokio::test]
+    #[serial]
+    async fn partial_usage_is_observational_not_authoritative_for_quota() {
+        clear_usage_memory_cache_for_test().await;
+
+        let mut partial = data_usage_info_for_test("bucket-a", 10, 100, SystemTime::now());
+        partial.usage_snapshot_complete = false;
+        partial.usage_snapshot_partial = true;
+        replace_bucket_usage_memory_from_info(&partial).await;
+
+        assert_eq!(get_bucket_usage_memory("bucket-a").await, None);
+    }
+
+    #[tokio::test]
+    #[serial]
+    async fn stale_quota_uses_complete_baseline_plus_positive_deltas() {
+        clear_usage_memory_cache_for_test().await;
+
+        let baseline = data_usage_info_for_test("bucket-a", 1, 100, SystemTime::now());
+        replace_bucket_usage_memory_from_info(&baseline).await;
+        record_bucket_object_write_memory("bucket-a", None, 25).await;
+
+        assert_eq!(get_bucket_usage_memory("bucket-a").await, Some(125));
+    }
+
+    #[tokio::test]
+    #[serial]
+    async fn negative_delta_waits_for_set_reconciliation() {
+        clear_usage_memory_cache_for_test().await;
+
+        let baseline = data_usage_info_for_test("bucket-a", 1, 100, SystemTime::UNIX_EPOCH + Duration::from_secs(100));
+        replace_bucket_usage_memory_from_info(&baseline).await;
+        record_bucket_object_delete_memory("bucket-a", 25, true).await;
+
+        assert_eq!(get_bucket_usage_memory("bucket-a").await, Some(100));
+
+        // Simulate a process restart: the request-path overlay is gone, but
+        // the persisted authoritative snapshot is still the pre-reconciliation
+        // baseline. Quota must remain conservative until a complete scanner
+        // result proves the delete.
+        clear_usage_memory_cache_for_test().await;
+        replace_bucket_usage_memory_from_info(&baseline).await;
+        assert_eq!(get_bucket_usage_memory("bucket-a").await, Some(100));
+
+        let reconciled = data_usage_info_for_test("bucket-a", 0, 75, SystemTime::UNIX_EPOCH + Duration::from_secs(101));
+        replace_bucket_usage_memory_from_info(&reconciled).await;
+        assert_eq!(get_bucket_usage_memory("bucket-a").await, Some(75));
+    }
+
     #[tokio::test]
     #[serial]
     async fn memory_overlay_counts_versioned_overwrite_as_new_version() {

crates/ecstore/src/store/heal.rs

@@ -13,7 +13,12 @@
 // limitations under the License.
 
 use super::*;
+use crate::core::pools::POOL_META_NAME;
+use crate::services::rebalance::{REBAL_META_NAME, RebalStatus};
+use crate::set_disk::get_lock_acquire_timeout;
 use crate::storage_api_contracts::heal::HealOperations as _;
+use crate::storage_api_contracts::namespace::NamespaceLocking as _;
+use rustfs_lock::NamespaceLockGuard;
 use tracing::trace;
 
 const LOG_COMPONENT_ECSTORE: &str = "ecstore";
@@ -30,7 +35,119 @@ fn invalid_heal_pool_index(pool_idx: usize, pool_count: usize) -> Error {
     )
 }
 
+#[derive(Debug, Clone, Copy)]
+enum HealFormatPoolSkip {
+    Completed,
+    Retryable,
+}
+
+fn classify_heal_format_pool(
+    pool_idx: usize,
+    pool_cmd_line: &str,
+    pool_meta: &PoolMeta,
+    rebalance_meta: Option<&RebalanceMeta>,
+) -> Option<HealFormatPoolSkip> {
+    let Some(pool) = pool_meta.pools.get(pool_idx) else {
+        return Some(HealFormatPoolSkip::Retryable);
+    };
+
+    if pool.id != pool_idx || pool_cmd_line.is_empty() || pool.cmd_line.is_empty() || pool.cmd_line != pool_cmd_line {
+        return Some(HealFormatPoolSkip::Retryable);
+    }
+
+    if let Some(decommission) = pool.decommission.as_ref() {
+        if decommission.complete {
+            return Some(HealFormatPoolSkip::Completed);
+        }
+        if decommission.failed || decommission.canceled || decommission.queued || pool_meta.is_suspended(pool_idx) {
+            return Some(HealFormatPoolSkip::Retryable);
+        }
+    }
+
+    if let Some(meta) = rebalance_meta {
+        let Some(pool_stats) = meta.pool_stats.get(pool_idx) else {
+            return Some(HealFormatPoolSkip::Retryable);
+        };
+        if pool_stats.info.stopping || (pool_stats.participating && pool_stats.info.status == RebalStatus::Started) {
+            return Some(HealFormatPoolSkip::Retryable);
+        }
+    }
+
+    None
+}
+
+fn heal_format_pool_skip_error(skip: HealFormatPoolSkip) -> Error {
+    match skip {
+        HealFormatPoolSkip::Completed => StorageError::NoHealRequired,
+        HealFormatPoolSkip::Retryable => StorageError::SlowDown,
+    }
+}
+
+fn heal_format_fence_lost_error() -> Error {
+    StorageError::SlowDown
+}
+
 impl ECStore {
+    async fn acquire_heal_format_fence(
+        &self,
+    ) -> Result<(NamespaceLockGuard, NamespaceLockGuard, PoolMeta, Option<RebalanceMeta>)> {
+        let metadata_pool = self
+            .pools
+            .first()
+            .cloned()
+            .ok_or_else(|| Error::other("heal format requires at least one storage pool"))?;
+
+        // Metadata fence order is part of the decommission/rebalance protocol:
+        // pool.bin must always be acquired before rebalance.bin.
+        let pool_lock = metadata_pool.new_ns_lock(RUSTFS_META_BUCKET, POOL_META_NAME).await?;
+        let pool_guard = pool_lock.get_write_lock(get_lock_acquire_timeout()).await?;
+        let rebalance_lock = metadata_pool.new_ns_lock(RUSTFS_META_BUCKET, REBAL_META_NAME).await?;
+        let rebalance_guard = rebalance_lock.get_write_lock(get_lock_acquire_timeout()).await?;
+
+        if pool_guard.is_lock_lost() || rebalance_guard.is_lock_lost() {
+            return Err(heal_format_fence_lost_error());
+        }
+
+        let mut pool_meta = PoolMeta::default();
+        pool_meta.load_no_lock(metadata_pool.clone()).await?;
+        if pool_meta.pools.len() != self.pools.len()
+            || pool_meta.pools.iter().enumerate().any(|(pool_idx, pool)| {
+                pool.id != pool_idx || pool.cmd_line.is_empty() || pool.cmd_line != self.pools[pool_idx].endpoints.cmd_line
+            })
+        {
+            return Err(heal_format_fence_lost_error());
+        }
+
+        let mut rebalance_meta = RebalanceMeta::new();
+        let rebalance_meta = match rebalance_meta
+            .load_with_opts(
+                metadata_pool,
+                ObjectOptions {
+                    no_lock: true,
+                    ..Default::default()
+                },
+            )
+            .await
+        {
+            Ok(()) => Some(rebalance_meta),
+            Err(Error::ConfigNotFound) => None,
+            Err(err) => return Err(err),
+        };
+
+        if rebalance_meta
+            .as_ref()
+            .is_some_and(|meta| meta.pool_stats.len() != self.pools.len())
+        {
+            return Err(heal_format_fence_lost_error());
+        }
+
+        if pool_guard.is_lock_lost() || rebalance_guard.is_lock_lost() {
+            return Err(heal_format_fence_lost_error());
+        }
+
+        Ok((pool_guard, rebalance_guard, pool_meta, rebalance_meta))
+    }
+
     fn get_pools_for_heal_object(&self, opts: &HealOpts) -> Result<Vec<Arc<Sets>>> {
         match opts.pool {
             Some(pool_idx) => Ok(vec![
@@ -52,9 +169,26 @@ impl ECStore {
         };
 
         let mut count_no_heal = 0;
+        let mut count_completed = 0;
         let mut first_error = None;
-        for pool in self.pools.iter() {
-            let (mut result, err) = pool.heal_format(dry_run).await?;
+        for (pool_idx, pool) in self.pools.iter().enumerate() {
+            let (pool_guard, rebalance_guard, pool_meta, rebalance_meta) = self.acquire_heal_format_fence().await?;
+            if pool_guard.is_lock_lost() || rebalance_guard.is_lock_lost() {
+                first_error.get_or_insert(heal_format_fence_lost_error());
+                break;
+            }
+            if let Some(skip) = classify_heal_format_pool(pool_idx, &pool.endpoints.cmd_line, &pool_meta, rebalance_meta.as_ref())
+            {
+                if matches!(skip, HealFormatPoolSkip::Completed) {
+                    count_completed += 1;
+                } else {
+                    first_error.get_or_insert(heal_format_pool_skip_error(skip));
+                }
+                continue;
+            }
+
+            let fence_lost = || pool_guard.is_lock_lost() || rebalance_guard.is_lock_lost();
+            let (mut result, err) = pool.heal_format_with_fence(dry_run, fence_lost).await?;
             if let Some(err) = err {
                 match err {
                     StorageError::NoHealRequired => {
@@ -69,11 +203,18 @@ impl ECStore {
             r.set_count += result.set_count;
             r.before.drives.append(&mut result.before.drives);
             r.after.drives.append(&mut result.after.drives);
+
+            // A lease can be lost after the final write; fail closed before
+            // reporting the pool as successfully healed.
+            if pool_guard.is_lock_lost() || rebalance_guard.is_lock_lost() {
+                first_error.get_or_insert(heal_format_fence_lost_error());
+                break;
+            }
         }
         if let Some(err) = first_error {
             return Ok((r, Some(err)));
         }
-        if count_no_heal == self.pools.len() {
+        if count_no_heal + count_completed == self.pools.len() {
             info!(
                 event = EVENT_HEAL_FORMAT_COMPLETED,
                 component = LOG_COMPONENT_ECSTORE,
@@ -302,6 +443,7 @@ mod tests {
     use crate::disk::{DeleteOptions, DiskOption, format::FormatV3, new_disk};
     use crate::layout::endpoints::{EndpointServerPools, Endpoints, PoolEndpoints};
     use crate::runtime::instance::InstanceContext;
+    use crate::services::rebalance::{RebalanceInfo, RebalanceStats};
     use crate::storage_api_contracts::bucket::{BucketOperations, MakeBucketOptions};
     use crate::storage_api_contracts::object::{ObjectIO as _, ObjectOperations};
     use crate::store::init_format::{load_format_erasure, save_format_file};
@@ -353,6 +495,164 @@ mod tests {
         }
     }
 
+    fn pool_meta_with_decommission(info: PoolDecommissionInfo) -> PoolMeta {
+        PoolMeta {
+            pools: vec![PoolStatus {
+                id: 0,
+                cmd_line: "pool-0".to_string(),
+                last_update: OffsetDateTime::UNIX_EPOCH,
+                decommission: Some(info),
+            }],
+            ..Default::default()
+        }
+    }
+
+    #[test]
+    fn heal_format_pool_state_barriers_are_classified() {
+        let active = pool_meta_with_decommission(PoolDecommissionInfo {
+            start_time: Some(OffsetDateTime::UNIX_EPOCH),
+            ..Default::default()
+        });
+        assert!(matches!(
+            classify_heal_format_pool(0, "pool-0", &active, None),
+            Some(HealFormatPoolSkip::Retryable)
+        ));
+
+        for info in [
+            PoolDecommissionInfo {
+                failed: true,
+                ..Default::default()
+            },
+            PoolDecommissionInfo {
+                canceled: true,
+                ..Default::default()
+            },
+        ] {
+            assert!(matches!(
+                classify_heal_format_pool(0, "pool-0", &pool_meta_with_decommission(info), None),
+                Some(HealFormatPoolSkip::Retryable)
+            ));
+        }
+
+        let completed = pool_meta_with_decommission(PoolDecommissionInfo {
+            complete: true,
+            ..Default::default()
+        });
+        assert!(matches!(
+            classify_heal_format_pool(0, "pool-0", &completed, None),
+            Some(HealFormatPoolSkip::Completed)
+        ));
+    }
+
+    #[test]
+    fn heal_format_pool_rebalance_barriers_and_identity_are_fail_closed() {
+        let identity_meta = pool_meta_with_decommission(PoolDecommissionInfo::default());
+        let rebalance = RebalanceMeta {
+            pool_stats: vec![RebalanceStats {
+                participating: true,
+                info: RebalanceInfo {
+                    status: RebalStatus::Started,
+                    ..Default::default()
+                },
+                ..Default::default()
+            }],
+            ..Default::default()
+        };
+        assert!(matches!(
+            classify_heal_format_pool(0, "pool-0", &identity_meta, Some(&rebalance)),
+            Some(HealFormatPoolSkip::Retryable)
+        ));
+
+        let stopping = RebalanceMeta {
+            pool_stats: vec![RebalanceStats {
+                info: RebalanceInfo {
+                    stopping: true,
+                    ..Default::default()
+                },
+                ..Default::default()
+            }],
+            ..Default::default()
+        };
+        assert!(matches!(
+            classify_heal_format_pool(0, "pool-0", &identity_meta, Some(&stopping)),
+            Some(HealFormatPoolSkip::Retryable)
+        ));
+
+        let identity = pool_meta_with_decommission(PoolDecommissionInfo::default());
+        assert!(matches!(
+            classify_heal_format_pool(0, "pool-new", &identity, None),
+            Some(HealFormatPoolSkip::Retryable)
+        ));
+
+        let identity_without_decommission = PoolMeta {
+            pools: vec![PoolStatus {
+                id: 0,
+                cmd_line: "pool-0".to_string(),
+                last_update: OffsetDateTime::UNIX_EPOCH,
+                decommission: None,
+            }],
+            ..Default::default()
+        };
+        assert!(matches!(
+            classify_heal_format_pool(0, "pool-new", &identity_without_decommission, None),
+            Some(HealFormatPoolSkip::Retryable)
+        ));
+
+        assert!(matches!(
+            classify_heal_format_pool(0, "", &identity_meta, None),
+            Some(HealFormatPoolSkip::Retryable)
+        ));
+
+        assert!(matches!(
+            classify_heal_format_pool(0, "pool-0", &PoolMeta::default(), None),
+            Some(HealFormatPoolSkip::Retryable)
+        ));
+
+        let stopped = RebalanceMeta {
+            stopped_at: Some(OffsetDateTime::UNIX_EPOCH),
+            pool_stats: vec![RebalanceStats {
+                participating: true,
+                info: RebalanceInfo {
+                    status: RebalStatus::Stopped,
+                    ..Default::default()
+                },
+                ..Default::default()
+            }],
+            ..Default::default()
+        };
+        assert!(classify_heal_format_pool(0, "pool-0", &identity_meta, Some(&stopped)).is_none());
+
+        let stopping_after_stop = RebalanceMeta {
+            stopped_at: Some(OffsetDateTime::UNIX_EPOCH),
+            pool_stats: vec![RebalanceStats {
+                participating: true,
+                info: RebalanceInfo {
+                    status: RebalStatus::Started,
+                    stopping: true,
+                    ..Default::default()
+                },
+                ..Default::default()
+            }],
+            ..Default::default()
+        };
+        assert!(matches!(
+            classify_heal_format_pool(0, "pool-0", &identity_meta, Some(&stopping_after_stop)),
+            Some(HealFormatPoolSkip::Retryable)
+        ));
+    }
+
+    #[test]
+    fn skipped_heal_format_pool_is_never_reported_as_success() {
+        assert!(matches!(
+            heal_format_pool_skip_error(HealFormatPoolSkip::Retryable),
+            StorageError::SlowDown
+        ));
+        assert!(matches!(
+            heal_format_pool_skip_error(HealFormatPoolSkip::Completed),
+            StorageError::NoHealRequired
+        ));
+    }
+
     async fn multi_pool_heal_store() -> (tempfile::TempDir, Arc<ECStore>, CancellationToken) {
         let temp_dir = tempfile::tempdir().expect("multi-pool heal test directory should be created");
         let mut pool_endpoints = Vec::new();
@@ -889,6 +1189,18 @@ mod tests {
             bucket_fence_registry: std::sync::Arc::default(),
         };
 
+        let err = store
+            .handle_heal_format(false)
+            .await
+            .expect_err("missing pool metadata must fail closed before format writes");
+        assert!(matches!(err, StorageError::SlowDown));
+
+        let pool_meta = PoolMeta::new(&store.pools, &PoolMeta::default());
+        pool_meta
+            .save(store.pools.clone())
+            .await
+            .expect("pool metadata should be persisted before format heal");
+
         let (result, err) = store
             .handle_heal_format(false)
             .await
@@ -902,5 +1214,22 @@ mod tests {
             .await
             .expect("the later pool should be healed despite the first pool error");
         assert_eq!(healed.erasure.this, recoverable_format.erasure.sets[0][2]);
+
+        let mut completed_meta = PoolMeta::new(&store.pools, &PoolMeta::default());
+        for status in &mut completed_meta.pools {
+            status.decommission = Some(PoolDecommissionInfo {
+                complete: true,
+                ..Default::default()
+            });
+        }
+        completed_meta
+            .save(store.pools.clone())
+            .await
+            .expect("completed pool metadata should be persisted");
+        let (_, err) = store
+            .handle_heal_format(false)
+            .await
+            .expect("completed pools should be reported as a no-op");
+        assert!(matches!(err, Some(StorageError::NoHealRequired)));
     }
 }

crates/heal/src/heal/task/heal_erasure_set.rs

@@ -231,6 +231,10 @@ impl HealTask {
                             "Heal erasure set format repair skipped because no format heal was required"
                         );
                     } else {
+                        let error = e;
+                        if error.is_recoverable_heal() {
+                            return Err(error);
+                        }
                         error!(
                             target: "rustfs::heal::task",
                             event = EVENT_HEAL_ERASURE_SET_RESULT,
@@ -239,7 +243,7 @@ impl HealTask {
                             task_id = %self.id,
                             set_disk_id,
                             result = "format_failed",
-                            error = %e,
+                            error = %error,
                             "Heal erasure set failed"
                         );
                         {
@@ -247,7 +251,7 @@ impl HealTask {
                             progress.update_progress(4, 4, 0, 0);
                         }
                         return Err(Error::TaskExecutionFailed {
-                            message: format!("Failed to heal disk format for {set_disk_id}: {e}"),
+                            message: format!("Failed to heal disk format for {set_disk_id}: {error}"),
                         });
                     }
                 } else {
@@ -284,6 +288,9 @@ impl HealTask {
             Err(Error::TaskCancelled) => return Err(Error::TaskCancelled),
             Err(Error::TaskTimeout) => return Err(Error::TaskTimeout),
             Err(e) => {
+                if e.is_recoverable_heal() {
+                    return Err(e);
+                }
                 error!(
                     target: "rustfs::heal::task",
                     event = EVENT_HEAL_ERASURE_SET_RESULT,

crates/heal/src/heal/task/tests.rs

@@ -547,6 +547,7 @@ struct MockStorage {
     heal_object_outcome: Mutex<Option<MockHealObjectOutcome>>,
     heal_object_outcomes: Mutex<HashMap<String, VecDeque<MockHealObjectOutcome>>>,
     format_no_heal_required: Mutex<bool>,
+    format_error: Mutex<Option<Error>>,
     global_format_calls: Mutex<u32>,
     replacement_format_calls: Mutex<Vec<(usize, usize, Vec<String>)>>,
     replacement_targets_ready: Mutex<bool>,
@@ -867,6 +868,9 @@ impl HealStorageAPI for MockStorage {
 
     async fn heal_format(&self, _dry_run: bool) -> Result<(HealResultItem, Option<Error>)> {
         *self.global_format_calls.lock().unwrap() += 1;
+        if let Some(error) = self.format_error.lock().unwrap().take() {
+            return Err(error);
+        }
         let no_heal_required = *self.format_no_heal_required.lock().unwrap();
         if no_heal_required {
             Ok((HealResultItem::default(), Some(Error::Storage(EcstoreError::NoHealRequired))))
@@ -2052,6 +2056,30 @@ async fn test_erasure_set_heal_continues_after_format_no_heal_required() {
     );
 }
 
+#[tokio::test]
+async fn erasure_set_format_slowdown_is_propagated() {
+    let storage = Arc::new(MockStorage {
+        format_error: Mutex::new(Some(Error::Storage(EcstoreError::SlowDown))),
+        ..Default::default()
+    });
+    let request = HealRequest::new(
+        HealType::ErasureSet {
+            buckets: Vec::new(),
+            set_disk_id: "pool_0_set_0".to_string(),
+        },
+        HealOptions::default(),
+        HealPriority::Normal,
+    );
+    let task = HealTask::from_request(request, storage);
+
+    let error = task
+        .execute()
+        .await
+        .expect_err("format SlowDown must remain recoverable for the task manager");
+
+    assert!(matches!(error, Error::Storage(EcstoreError::SlowDown)));
+}
+
 #[tokio::test]
 async fn erasure_set_bucket_prepass_failure_stops_before_object_heal() {
     let temp = TempDir::new().expect("temporary directory should be created");

crates/scanner/src/data_usage_define.rs

@@ -28,8 +28,9 @@ use rustfs_common::heal_channel::HealScanMode;
 use rustfs_config::ENV_SCANNER_CACHE_SAVE_TIMEOUT_SECS;
 pub use rustfs_data_usage::{
     AllTierStats, BucketTargetUsageInfo, BucketUsageInfo, DATA_USAGE_OBJECT_NAME, DATA_USAGE_OBSERVED_OBJECT_NAME,
-    DataUsageEntry, DataUsageHash, DataUsageHashMap, DataUsageInfo, LEGACY_DATA_USAGE_OBJECT_NAME, PrefixUsageEntry,
-    PrefixUsageQuery, PrefixUsageSummary, ReplTargetSizeSummary, SizeSummary, TierStats, hash_path, prefix_usage_in_cache,
+    DataUsageEntry, DataUsageHash, DataUsageHashMap, DataUsageInfo, DataUsageSnapshotSetState, LEGACY_DATA_USAGE_OBJECT_NAME,
+    PrefixUsageEntry, PrefixUsageQuery, PrefixUsageSummary, ReplTargetSizeSummary, SizeSummary, TierStats, hash_path,
+    prefix_usage_in_cache,
 };
 use rustfs_utils::path::{SLASH_SEPARATOR, path_join_buf};
 use tokio::time::{Duration, Instant, sleep, timeout};
@@ -344,6 +345,18 @@ pub struct DataUsageCacheInfo {
     pub scan_plan_digest: Option<DataUsageScanPlanDigest>,
     #[serde(default)]
     pub cache_key_format: u16,
+    /// Whether the entries retained while a set scan was incomplete come
+    /// from a prior complete set snapshot.  This is observational input only.
+    #[serde(default)]
+    pub lkg_snapshot_complete: bool,
+    #[serde(default)]
+    pub lkg_next_cycle: Option<u64>,
+    #[serde(default)]
+    pub lkg_last_update: Option<SystemTime>,
+    #[serde(default)]
+    pub lkg_leader_epoch: Option<u64>,
+    #[serde(default)]
+    pub lkg_scan_plan_digest: Option<DataUsageScanPlanDigest>,
 }
 
 impl Serialize for DataUsageCacheInfo {
@@ -353,7 +366,7 @@ impl Serialize for DataUsageCacheInfo {
     {
         // Keep this metadata map-encoded so older readers can ignore fields
         // appended by newer scanner versions during rolling upgrades.
-        let mut state = serializer.serialize_map(Some(16))?;
+        let mut state = serializer.serialize_map(Some(21))?;
         state.serialize_entry("name", &self.name)?;
         state.serialize_entry("next_cycle", &self.next_cycle)?;
         state.serialize_entry("leader_epoch", &self.leader_epoch)?;
@@ -370,6 +383,11 @@ impl Serialize for DataUsageCacheInfo {
         state.serialize_entry("snapshot_complete", &self.snapshot_complete)?;
         state.serialize_entry("scan_plan_digest", &self.scan_plan_digest)?;
         state.serialize_entry("cache_key_format", &self.cache_key_format)?;
+        state.serialize_entry("lkg_snapshot_complete", &self.lkg_snapshot_complete)?;
+        state.serialize_entry("lkg_next_cycle", &self.lkg_next_cycle)?;
+        state.serialize_entry("lkg_last_update", &self.lkg_last_update)?;
+        state.serialize_entry("lkg_leader_epoch", &self.lkg_leader_epoch)?;
+        state.serialize_entry("lkg_scan_plan_digest", &self.lkg_scan_plan_digest)?;
         state.end()
     }
 }

crates/scanner/src/scanner.rs

@@ -2274,9 +2274,8 @@ async fn final_data_usage_publication_defer_reason(
             }
         }
         ScannerCycleStatus::Deferred(reason) => Some(reason),
-        // Incomplete cycles do not publish a usage snapshot. Keep the
-        // decision permissive so existing partial-cycle handling remains
-        // unchanged if a future scanner path emits a bookkeeping update.
+        // Incomplete cycles may publish a non-authoritative observational
+        // snapshot when at least one set has a usable current/LKG view.
         ScannerCycleStatus::Incomplete => None,
     }
 }

crates/scanner/src/scanner/usage_store.rs

@@ -198,7 +198,7 @@ where
             data_usage_info.usage_snapshot_authoritative_baseline = Some(authoritative.snapshot_identity());
         }
 
-        if !data_usage_info.is_complete_bucket_usage_snapshot() {
+        if !data_usage_info.is_complete_bucket_usage_snapshot() && !data_usage_info.usage_snapshot_partial {
             error!(
                 target: "rustfs::scanner",
                 event = EVENT_SCANNER_PERSIST_STATE,

crates/scanner/src/scanner_io.rs

@@ -18,8 +18,8 @@ use crate::scanner_folder::{ScannerItem, scan_data_folder};
 use crate::sleeper::SCANNER_SLEEPER;
 use crate::{
     DATA_USAGE_CACHE_NAME, DATA_USAGE_ROOT, DataUsageCache, DataUsageCacheInfo, DataUsageCachePrepareOutcome,
-    DataUsageCacheSource, DataUsageEntry, DataUsageEntryInfo, DataUsageInfo, DataUsageScanPlanDigest, ScannerError, SizeSummary,
-    TierStats,
+    DataUsageCacheSource, DataUsageEntry, DataUsageEntryInfo, DataUsageInfo, DataUsageScanPlanDigest, DataUsageSnapshotSetState,
+    ScannerError, SizeSummary, TierStats,
 };
 use futures::future::join_all;
 use metrics::counter;
@@ -278,6 +278,17 @@ async fn publish_usage_snapshot(
     Ok(true)
 }
 
+async fn publish_observational_snapshot(
+    updates: &mpsc::Sender<DataUsageInfo>,
+    mut data_usage_info: DataUsageInfo,
+) -> Result<bool> {
+    data_usage_info.usage_snapshot_complete = false;
+    data_usage_info.usage_snapshot_partial = true;
+    data_usage_info.usage_snapshot_converged = Some(false);
+    send_data_usage_update(updates, data_usage_info).await?;
+    Ok(true)
+}
+
 #[derive(Clone, Copy, Debug, PartialEq, Eq)]
 enum ScannerCycleActivityStatus {
     Unchanged,

crates/scanner/src/scanner_io/cache.rs

@@ -188,7 +188,7 @@ pub(super) fn completed_data_usage_info(
     }
 
     let mut total = DataUsageEntry::default();
-    let mut buckets_usage = HashMap::with_capacity(all_buckets.len());
+    let mut bucket_entries = HashMap::with_capacity(all_buckets.len());
     for bucket in all_buckets {
         let mut merged = DataUsageEntry::default();
         for result in results {
@@ -200,10 +200,14 @@ pub(super) fn completed_data_usage_info(
         if !total.checked_merge(&merged) {
             return None;
         }
-        buckets_usage.insert(bucket.clone(), checked_bucket_usage_info(&merged)?);
+        bucket_entries.insert(bucket.clone(), merged);
     }
 
     let merged_last_update = results.iter().filter_map(|result| result.info.last_update).max()?;
+    let buckets_usage = bucket_entries
+        .iter()
+        .map(|(bucket, entry)| Some((bucket.clone(), checked_bucket_usage_info(entry)?)))
+        .collect::<Option<HashMap<_, _>>>()?;
     let bucket_sizes = buckets_usage
         .iter()
         .map(|(bucket, usage)| (bucket.clone(), usage.size))
@@ -225,6 +229,145 @@ pub(super) fn completed_data_usage_info(
     Some((data_usage_info, merged_last_update))
 }
 
+/// Build a non-authoritative view from the set snapshots that completed this
+/// cycle plus compatible per-set last-known-good caches.  The caller must
+/// persist this result only on the observational object; a missing set is
+/// intentionally represented by an incomplete state and is never treated as
+/// an empty set.
+pub(super) fn observational_data_usage_info(
+    results: &[DataUsageCache],
+    expected_sources: &HashSet<DataUsageCacheSource>,
+    all_buckets: &[String],
+    expected_plan_digest: DataUsageScanPlanDigest,
+    scanner_cycle: u64,
+    leader_epoch: u64,
+) -> Option<(DataUsageInfo, SystemTime)> {
+    let mut by_source = HashMap::with_capacity(results.len());
+    for result in results {
+        let source = result.info.source?;
+        if !expected_sources.contains(&source) || by_source.insert(source, result).is_some() {
+            return None;
+        }
+    }
+
+    let mut usable = Vec::new();
+    let mut set_states = Vec::with_capacity(expected_sources.len());
+    let mut sources = expected_sources.iter().copied().collect::<Vec<_>>();
+    sources.sort_by_key(|source| (source.pool_index, source.set_index));
+    for source in sources {
+        let result = by_source.get(&source).copied();
+        let current = result.filter(|result| {
+            result.info.snapshot_complete
+                && result.info.next_cycle == scanner_cycle
+                && result.info.leader_epoch == leader_epoch
+                && result.info.scan_plan_digest == Some(expected_plan_digest)
+        });
+        let lkg = result.filter(|result| {
+            !result.info.snapshot_complete
+                && result.info.lkg_snapshot_complete
+                && result.info.lkg_scan_plan_digest == Some(expected_plan_digest)
+                && result.info.lkg_leader_epoch.is_some_and(|epoch| {
+                    epoch < leader_epoch
+                        || (epoch == leader_epoch && result.info.lkg_next_cycle.is_some_and(|cycle| cycle <= scanner_cycle))
+                })
+        });
+        let current_snapshot = current.is_some();
+        let selected = current.or(lkg);
+        if let Some(selected) = selected {
+            let (cycle, epoch, digest, last_update, complete) = if current_snapshot {
+                (
+                    Some(selected.info.next_cycle),
+                    Some(selected.info.leader_epoch),
+                    selected.info.scan_plan_digest.map(|digest| digest.0),
+                    selected.info.last_update,
+                    true,
+                )
+            } else {
+                (
+                    selected.info.lkg_next_cycle,
+                    selected.info.lkg_leader_epoch,
+                    selected.info.lkg_scan_plan_digest.map(|digest| digest.0),
+                    selected.info.lkg_last_update,
+                    false,
+                )
+            };
+            set_states.push(DataUsageSnapshotSetState {
+                pool_index: u64::try_from(source.pool_index).ok()?,
+                set_index: u64::try_from(source.set_index).ok()?,
+                scanner_cycle: cycle,
+                scanner_epoch: epoch,
+                scan_plan_digest: digest,
+                complete,
+                tombstone: false,
+            });
+            usable.push((selected, last_update));
+        } else {
+            set_states.push(DataUsageSnapshotSetState {
+                pool_index: u64::try_from(source.pool_index).ok()?,
+                set_index: u64::try_from(source.set_index).ok()?,
+                scanner_cycle: None,
+                scanner_epoch: None,
+                scan_plan_digest: Some(expected_plan_digest.0),
+                complete: false,
+                tombstone: false,
+            });
+        }
+    }
+    if usable.is_empty() {
+        return None;
+    }
+
+    let mut total = DataUsageEntry::default();
+    let mut bucket_entries = HashMap::with_capacity(all_buckets.len());
+    let mut merged_last_update = None;
+    for (result, last_update) in usable {
+        if let Some(update) = last_update {
+            merged_last_update = Some(merged_last_update.map_or(update, |current: SystemTime| current.max(update)));
+        }
+        for bucket in all_buckets {
+            let Some(entry) = result.checked_flatten(bucket) else {
+                continue;
+            };
+            let bucket_entry = bucket_entries.entry(bucket.clone()).or_insert_with(DataUsageEntry::default);
+            if !bucket_entry.checked_merge(&entry) {
+                return None;
+            }
+            if !total.checked_merge(&entry) {
+                return None;
+            }
+        }
+    }
+    let merged_last_update = merged_last_update?;
+    let buckets_usage = bucket_entries
+        .iter()
+        .map(|(bucket, entry)| Some((bucket.clone(), checked_bucket_usage_info(entry)?)))
+        .collect::<Option<HashMap<_, _>>>()?;
+    Some((
+        DataUsageInfo {
+            last_update: Some(merged_last_update),
+            scanner_cycle: Some(scanner_cycle),
+            scanner_epoch: Some(leader_epoch),
+            objects_total_count: u64::try_from(total.objects).ok()?,
+            versions_total_count: u64::try_from(total.versions).ok()?,
+            delete_markers_total_count: u64::try_from(total.delete_markers).ok()?,
+            objects_total_size: u64::try_from(total.size).ok()?,
+            tier_stats: total.all_tier_stats.filter(|tiers| !tiers.is_empty()),
+            buckets_count: u64::try_from(buckets_usage.len()).ok()?,
+            bucket_sizes: buckets_usage
+                .iter()
+                .map(|(bucket, usage)| (bucket.clone(), usage.size))
+                .collect(),
+            buckets_usage,
+            usage_snapshot_complete: false,
+            usage_snapshot_partial: true,
+            usage_snapshot_converged: Some(false),
+            usage_snapshot_set_states: set_states,
+            ..Default::default()
+        },
+        merged_last_update,
+    ))
+}
+
 pub(super) async fn send_cache_root_entry_info(
     bucket_result_tx: &mpsc::Sender<DataUsageEntryInfo>,
     cache: &DataUsageCache,

crates/scanner/src/scanner_io/io_cache.rs

@@ -40,6 +40,21 @@ impl ScannerIOCache for SetDisks {
         let set_label = self.set_index.to_string();
 
         let source = DataUsageCacheSource::new(self.pool_index, self.set_index);
+        let mut old_cache = DataUsageCache::default();
+        if let Err(e) = old_cache.load(self.clone(), DATA_USAGE_CACHE_NAME).await {
+            warn!(
+                target: "rustfs::scanner::io",
+                event = EVENT_SCANNER_CACHE_PERSIST_STATE,
+                component = LOG_COMPONENT_SCANNER,
+                subsystem = LOG_SUBSYSTEM_IO,
+                pool = self.pool_index,
+                set = self.set_index,
+                cache_name = DATA_USAGE_CACHE_NAME,
+                state = "old_cache_load_failed",
+                error = %e,
+                "Scanner old data usage cache load failed; rebuilding from bucket caches"
+            );
+        }
         if buckets.is_empty() {
             let now = SystemTime::now();
             let mut cache = DataUsageCache {
@@ -80,6 +95,24 @@ impl ScannerIOCache for SetDisks {
                 "Scanner set state found no online disks"
             );
             reset_disk_bucket_scan_gauges(&pool_label, &set_label);
+            let lkg = old_cache.info.snapshot_complete.then(|| old_cache.clone());
+            let mut incomplete_scope = lkg.clone().unwrap_or_default();
+            incomplete_scope.info.name = DATA_USAGE_ROOT.to_string();
+            incomplete_scope.info.next_cycle = want_cycle;
+            incomplete_scope.info.last_update = None;
+            incomplete_scope.info.leader_epoch = leader_epoch;
+            incomplete_scope.info.source = Some(source);
+            incomplete_scope.info.snapshot_complete = false;
+            incomplete_scope.info.scan_plan_digest = Some(scan_plan_digest);
+            incomplete_scope.info.cache_key_format = DATA_USAGE_CACHE_KEY_FORMAT;
+            if let Some(lkg) = lkg {
+                incomplete_scope.info.lkg_snapshot_complete = true;
+                incomplete_scope.info.lkg_next_cycle = Some(lkg.info.next_cycle);
+                incomplete_scope.info.lkg_last_update = lkg.info.last_update;
+                incomplete_scope.info.lkg_leader_epoch = Some(lkg.info.leader_epoch);
+                incomplete_scope.info.lkg_scan_plan_digest = lkg.info.scan_plan_digest;
+            }
+            let _ = updates.send(incomplete_scope).await;
             return Ok(());
         }
         // Preserve the original set topology across capability filtering. During
@@ -162,6 +195,24 @@ impl ScannerIOCache for SetDisks {
                 "Scanner set state found no usable namespace scanner disks"
             );
             reset_disk_bucket_scan_gauges(&pool_label, &set_label);
+            let lkg = old_cache.info.snapshot_complete.then(|| old_cache.clone());
+            let mut incomplete_scope = lkg.clone().unwrap_or_default();
+            incomplete_scope.info.name = DATA_USAGE_ROOT.to_string();
+            incomplete_scope.info.next_cycle = want_cycle;
+            incomplete_scope.info.last_update = None;
+            incomplete_scope.info.leader_epoch = leader_epoch;
+            incomplete_scope.info.source = Some(source);
+            incomplete_scope.info.snapshot_complete = false;
+            incomplete_scope.info.scan_plan_digest = Some(scan_plan_digest);
+            incomplete_scope.info.cache_key_format = DATA_USAGE_CACHE_KEY_FORMAT;
+            if let Some(lkg) = lkg {
+                incomplete_scope.info.lkg_snapshot_complete = true;
+                incomplete_scope.info.lkg_next_cycle = Some(lkg.info.next_cycle);
+                incomplete_scope.info.lkg_last_update = lkg.info.last_update;
+                incomplete_scope.info.lkg_leader_epoch = Some(lkg.info.leader_epoch);
+                incomplete_scope.info.lkg_scan_plan_digest = lkg.info.scan_plan_digest;
+            }
+            let _ = updates.send(incomplete_scope).await;
             return Ok(());
         }
         let set_disk_inventory = Arc::new(scanner_set_disk_inventory(self.as_ref()).await);
@@ -203,22 +254,15 @@ impl ScannerIOCache for SetDisks {
         record_disk_bucket_scans_active(0, &pool_label, &set_label);
         let _reset_disk_bucket_scan_gauges = DiskBucketScanGaugeReset::new(pool_label.clone(), set_label.clone());
 
-        let mut old_cache = DataUsageCache::default();
-        if let Err(e) = old_cache.load(self.clone(), DATA_USAGE_CACHE_NAME).await {
-            warn!(
-                target: "rustfs::scanner::io",
-                event = EVENT_SCANNER_CACHE_PERSIST_STATE,
-                component = LOG_COMPONENT_SCANNER,
-                subsystem = LOG_SUBSYSTEM_IO,
-                pool = self.pool_index,
-                set = self.set_index,
-                cache_name = DATA_USAGE_CACHE_NAME,
-                state = "old_cache_load_failed",
-                error = %e,
-                "Scanner old data usage cache load failed; rebuilding from bucket caches"
-            );
-        }
-        match old_cache.prepare_for_scan(
+        let old_lkg = old_cache.info.snapshot_complete.then(|| {
+            (
+                old_cache.info.next_cycle,
+                old_cache.info.last_update,
+                old_cache.info.leader_epoch,
+                old_cache.info.scan_plan_digest,
+            )
+        });
+        let prepare_outcome = match old_cache.prepare_for_scan(
             DATA_USAGE_ROOT,
             want_cycle,
             leader_epoch,
@@ -259,7 +303,16 @@ impl ScannerIOCache for SetDisks {
                 );
                 return Ok(());
             }
-            DataUsageCachePrepareOutcome::Reused | DataUsageCachePrepareOutcome::Reset => {}
+            outcome => outcome,
+        };
+        if matches!(prepare_outcome, DataUsageCachePrepareOutcome::Reused)
+            && let Some((cycle, last_update, epoch, digest)) = old_lkg
+        {
+            old_cache.info.lkg_snapshot_complete = true;
+            old_cache.info.lkg_next_cycle = Some(cycle);
+            old_cache.info.lkg_last_update = last_update;
+            old_cache.info.lkg_leader_epoch = Some(epoch);
+            old_cache.info.lkg_scan_plan_digest = digest;
         }
 
         let mut cache = DataUsageCache {
@@ -1099,23 +1152,29 @@ impl ScannerIOCache for SetDisks {
                 cache.info.next_cycle = want_cycle;
                 cache.info.last_update.get_or_insert_with(SystemTime::now);
                 cache.info.snapshot_complete = true;
+                cache.info.lkg_snapshot_complete = false;
+                cache.info.lkg_next_cycle = None;
+                cache.info.lkg_last_update = None;
+                cache.info.lkg_leader_epoch = None;
+                cache.info.lkg_scan_plan_digest = None;
                 cache.clone()
             };
             let _ = persist_and_publish_cache_snapshot(self.clone(), &updates, cache_snapshot, cache_cycle_floor.as_ref()).await;
         } else {
-            let incomplete_scope = DataUsageCache {
-                info: DataUsageCacheInfo {
-                    name: DATA_USAGE_ROOT.to_string(),
-                    next_cycle: want_cycle,
-                    leader_epoch,
-                    source: Some(source),
-                    snapshot_complete: false,
-                    scan_plan_digest: Some(scan_plan_digest),
-                    cache_key_format: DATA_USAGE_CACHE_KEY_FORMAT,
-                    ..Default::default()
-                },
-                cache: HashMap::new(),
-            };
+            let mut incomplete_scope = cache_mutex.lock().await.clone();
+            incomplete_scope.info.name = DATA_USAGE_ROOT.to_string();
+            incomplete_scope.info.next_cycle = want_cycle;
+            incomplete_scope.info.last_update = None;
+            incomplete_scope.info.leader_epoch = leader_epoch;
+            incomplete_scope.info.source = Some(source);
+            incomplete_scope.info.snapshot_complete = false;
+            incomplete_scope.info.scan_plan_digest = Some(scan_plan_digest);
+            incomplete_scope.info.cache_key_format = DATA_USAGE_CACHE_KEY_FORMAT;
+            incomplete_scope.info.lkg_snapshot_complete = old_cache.info.lkg_snapshot_complete;
+            incomplete_scope.info.lkg_next_cycle = old_cache.info.lkg_next_cycle;
+            incomplete_scope.info.lkg_last_update = old_cache.info.lkg_last_update;
+            incomplete_scope.info.lkg_leader_epoch = old_cache.info.lkg_leader_epoch;
+            incomplete_scope.info.lkg_scan_plan_digest = old_cache.info.lkg_scan_plan_digest;
             if let Err(e) = updates.send(incomplete_scope).await {
                 error!(
                     target: "rustfs::scanner::io",

crates/scanner/src/scanner_io/io_cycle.rs

@@ -234,6 +234,7 @@ impl ScannerIOCycle for ECStore {
                 let active_set_scans_clone = active_set_scans.clone();
 
                 let (tx, mut rx) = mpsc::channel::<DataUsageCache>(1);
+                let failed_scope_tx = tx.clone();
 
                 // Spawn task to receive and store results
                 let receiver_fut = tokio::spawn(async move {
@@ -314,6 +315,21 @@ impl ScannerIOCycle for ECStore {
                             state = "set_scan_failed",
                             "Scanner set scan failed; continuing cycle"
                         );
+                        let _ = failed_scope_tx
+                            .send(DataUsageCache {
+                                info: DataUsageCacheInfo {
+                                    name: DATA_USAGE_ROOT.to_string(),
+                                    next_cycle: want_cycle_clone,
+                                    leader_epoch,
+                                    source: Some(source),
+                                    snapshot_complete: false,
+                                    scan_plan_digest: Some(scan_plan_digest),
+                                    cache_key_format: DATA_USAGE_CACHE_KEY_FORMAT,
+                                    ..Default::default()
+                                },
+                                cache: HashMap::new(),
+                            })
+                            .await;
                         let mut first_err = first_err_mutex_clone.lock().await;
                         record_set_scan_failure(&mut first_err, e);
                     }
@@ -370,6 +386,19 @@ impl ScannerIOCycle for ECStore {
             budget_elapsed,
             ctx.is_cancelled(),
         );
+        let observational_usage = completed_usage
+            .is_none()
+            .then(|| {
+                observational_data_usage_info(
+                    &results,
+                    &expected_sources,
+                    &all_bucket_names,
+                    scan_plan_digest,
+                    want_cycle,
+                    leader_epoch,
+                )
+            })
+            .flatten();
         let structurally_complete_snapshot = result.is_ok() && completed_all_sets && completed_usage.is_some();
         let cycle_status = classify_nsscanner_cycle(
             structurally_complete_snapshot,
@@ -381,6 +410,10 @@ impl ScannerIOCycle for ECStore {
         );
         if let Some((data_usage_info, _)) = completed_usage {
             publish_usage_snapshot(&updates, cycle_status, data_usage_info).await?;
+        } else if !ctx.is_cancelled()
+            && let Some((data_usage_info, _)) = observational_usage
+        {
+            publish_observational_snapshot(&updates, data_usage_info).await?;
         }
         let dirty_usage_clear = should_clear_dirty_usage_snapshot(
             result.is_ok(),

crates/scanner/src/scanner_io/publish_gate_tests.rs

@@ -105,6 +105,160 @@ fn completed_data_usage_info_for_test(
     completed_data_usage_info(results, &expected_sources, all_buckets, true, budget_elapsed, cancelled)
 }
 
+fn lkg_root_cache(bucket: &str, objects: usize, source: DataUsageCacheSource) -> DataUsageCache {
+    let mut cache = completed_root_cache(bucket, objects, 10, source);
+    cache.info.snapshot_complete = false;
+    cache.info.next_cycle = 8;
+    cache.info.leader_epoch = 3;
+    cache.info.lkg_snapshot_complete = true;
+    cache.info.lkg_next_cycle = Some(7);
+    cache.info.lkg_last_update = cache.info.last_update;
+    cache.info.lkg_leader_epoch = Some(3);
+    cache.info.lkg_scan_plan_digest = Some(TEST_PLAN_DIGEST);
+    cache
+}
+
+#[test]
+fn partial_usage_is_observational_not_authoritative_for_quota() {
+    let all_buckets = vec!["bucket".to_string()];
+    let current_source = DataUsageCacheSource::new(0, 0);
+    let stalled_source = DataUsageCacheSource::new(1, 0);
+    let mut current = completed_root_cache("bucket", 2, 20, current_source);
+    current.info.next_cycle = 8;
+    current.info.leader_epoch = 3;
+    let stalled = lkg_root_cache("bucket", 1, stalled_source);
+    let expected = HashSet::from([current_source, stalled_source]);
+
+    assert!(
+        completed_data_usage_info(&[current.clone(), stalled.clone()], &expected, &all_buckets, true, false, false).is_none()
+    );
+    let (observed, _) = observational_data_usage_info(&[current, stalled], &expected, &all_buckets, TEST_PLAN_DIGEST, 8, 3)
+        .expect("a completed set should produce an observational view");
+    assert!(observed.usage_snapshot_partial);
+    assert!(!observed.usage_snapshot_complete);
+    assert_eq!(observed.usage_snapshot_converged, Some(false));
+    assert_eq!(observed.usage_snapshot_set_states.len(), 2);
+}
+
+#[test]
+fn lkg_scope_does_not_count_as_current_cycle_completion() {
+    let source = DataUsageCacheSource::new(0, 0);
+    let mut lkg = lkg_root_cache("bucket", 1, source);
+    lkg.info.last_update = None;
+    let expected = HashSet::from([source]);
+    assert!(!scanner_results_form_complete_snapshot(&[lkg], &expected));
+}
+
+#[test]
+fn stale_quota_uses_complete_baseline_plus_positive_deltas() {
+    let all_buckets = vec!["bucket".to_string()];
+    let source = DataUsageCacheSource::new(0, 0);
+    let mut current = completed_root_cache("bucket", 3, 20, source);
+    current.info.next_cycle = 8;
+    current.info.leader_epoch = 3;
+    let expected = HashSet::from([source]);
+    let (observed, _) = observational_data_usage_info(&[current], &expected, &all_buckets, TEST_PLAN_DIGEST, 8, 3)
+        .expect("complete set data is a valid observational baseline");
+    assert_eq!(observed.objects_total_size, 30);
+    assert_eq!(observed.usage_snapshot_set_states[0].complete, true);
+}
+
+#[test]
+fn negative_delta_waits_for_set_reconciliation() {
+    let all_buckets = vec!["bucket".to_string()];
+    let source = DataUsageCacheSource::new(0, 0);
+    let mut stalled = lkg_root_cache("bucket", 4, source);
+    stalled.info.lkg_scan_plan_digest = Some(DataUsageScanPlanDigest([9; 32]));
+    let expected = HashSet::from([source]);
+    assert!(observational_data_usage_info(&[stalled], &expected, &all_buckets, TEST_PLAN_DIGEST, 8, 3).is_none());
+}
+
+#[test]
+fn set_membership_add_remove_uses_generation_and_tombstone() {
+    let state = DataUsageSnapshotSetState {
+        pool_index: 1,
+        set_index: 2,
+        scanner_cycle: Some(9),
+        scanner_epoch: Some(4),
+        scan_plan_digest: Some(TEST_PLAN_DIGEST.0),
+        complete: false,
+        tombstone: true,
+    };
+    let encoded = serde_json::to_vec(&state).expect("set state should serialize");
+    let decoded: DataUsageSnapshotSetState = serde_json::from_slice(&encoded).expect("set state should deserialize");
+    assert_eq!(decoded, state);
+
+    let snapshot = DataUsageInfo {
+        last_update: Some(SystemTime::UNIX_EPOCH + Duration::from_secs(10)),
+        scanner_cycle: Some(9),
+        scanner_epoch: Some(4),
+        buckets_count: 0,
+        usage_snapshot_converged: Some(false),
+        usage_snapshot_partial: true,
+        usage_snapshot_set_states: vec![
+            DataUsageSnapshotSetState {
+                pool_index: 0,
+                set_index: 0,
+                scanner_cycle: Some(9),
+                scanner_epoch: Some(4),
+                scan_plan_digest: Some(TEST_PLAN_DIGEST.0),
+                complete: true,
+                tombstone: false,
+            },
+            state,
+        ],
+        ..Default::default()
+    };
+    assert!(snapshot.is_valid_partial_snapshot());
+}
+
+#[test]
+fn old_set_completion_cannot_overwrite_new_aggregate() {
+    let all_buckets = vec!["bucket".to_string()];
+    let source = DataUsageCacheSource::new(0, 0);
+    let mut old = completed_root_cache("bucket", 1, 20, source);
+    old.info.next_cycle = 7;
+    old.info.leader_epoch = 2;
+    let expected = HashSet::from([source]);
+    assert!(observational_data_usage_info(&[old], &expected, &all_buckets, TEST_PLAN_DIGEST, 8, 3).is_none());
+}
+
+#[test]
+fn usage_aggregate_survives_restart_and_leader_failover() {
+    let all_buckets = vec!["bucket".to_string()];
+    let source = DataUsageCacheSource::new(0, 0);
+    let mut lkg = lkg_root_cache("bucket", 5, source);
+    lkg.info.lkg_leader_epoch = Some(4);
+    lkg.info.lkg_next_cycle = Some(9);
+    let expected = HashSet::from([source]);
+    let (observed, _) = observational_data_usage_info(&[lkg], &expected, &all_buckets, TEST_PLAN_DIGEST, 10, 5)
+        .expect("compatible LKG should survive a leader change");
+    assert_eq!(observed.usage_snapshot_set_states[0].scanner_epoch, Some(4));
+    assert_eq!(observed.objects_total_size, 50);
+}
+
+#[test]
+fn usage_aggregate_cost_is_linear_in_set_count() {
+    let all_buckets = vec!["bucket".to_string()];
+    let mut results = Vec::new();
+    let mut expected = HashSet::new();
+    for index in 0..32 {
+        let source = DataUsageCacheSource::new(index, 0);
+        expected.insert(source);
+        let mut cache = completed_root_cache("bucket", 1, 20, source);
+        cache.info.next_cycle = 8;
+        cache.info.leader_epoch = 3;
+        results.push(cache);
+    }
+    let (observed, _) = observational_data_usage_info(&results, &expected, &all_buckets, TEST_PLAN_DIGEST, 8, 3)
+        .expect("all set snapshots should aggregate");
+    assert_eq!(observed.objects_total_count, 32);
+    let reversed = results.iter().rev().cloned().collect::<Vec<_>>();
+    let (reversed_observed, _) = observational_data_usage_info(&reversed, &expected, &all_buckets, TEST_PLAN_DIGEST, 8, 3)
+        .expect("reordered set snapshots should aggregate");
+    assert_eq!(observed.usage_snapshot_set_states, reversed_observed.usage_snapshot_set_states);
+}
+
 #[test]
 fn completed_data_usage_info_publishes_tier_stats_across_sets() {
     let all_buckets = vec!["bucket-a".to_string(), "bucket-b".to_string()];

crates/test-utils/src/lib.rs

@@ -245,6 +245,18 @@ impl TestECStoreEnvBuilder {
             .await
             .expect("build test ECStore");
 
+        // The production bootstrap only persists pool.bin from the elected
+        // first cluster node.  Test stores intentionally have no cluster
+        // election, but heal-format still requires that durable fence before
+        // it can write any disk format.  Materialize the validated topology
+        // here so the shared fixture models a ready single-node store.
+        let mut pool_meta = ecstore.pool_meta.read().await.clone();
+        pool_meta.dont_save = false;
+        pool_meta
+            .save(ecstore.pools.clone())
+            .await
+            .expect("persist test pool metadata");
+
         if self.init_bucket_metadata {
             let buckets_list = ecstore
                 .list_bucket(&BucketOptions {

rustfs/Cargo.toml

@@ -322,7 +322,7 @@ thiserror = { workspace = true }
 tracing.workspace = true
 url = { workspace = true }
 urlencoding = { workspace = true }
-uuid = { workspace = true, features = ["v4", "fast-rng", "macro-diagnostics"] }
+uuid = { workspace = true, features = ["v4", "v5", "fast-rng", "macro-diagnostics"] }
 zip = { workspace = true }
 libc = { workspace = true }
 rand = { workspace = true, features = ["serde"] }
@@ -345,7 +345,7 @@ libsystemd.workspace = true
 libmimalloc-sys.workspace = true
 
 [dev-dependencies]
-uuid = { workspace = true, features = ["v4", "fast-rng", "macro-diagnostics"] }
+uuid = { workspace = true, features = ["v4", "v5", "fast-rng", "macro-diagnostics"] }
 serial_test = { workspace = true }
 tempfile = { workspace = true }
 aws-config = { workspace = true }

rustfs/src/admin/handlers/site_replication.rs

@@ -41,7 +41,7 @@ use crate::admin::storage_api::config::save_admin_config;
 use crate::admin::storage_api::contract::bucket::{
     BucketOperations, BucketOptions, DeleteBucketOptions, MakeBucketOptions, SRBucketDeleteOp,
 };
-use crate::admin::storage_api::error::Error as StorageError;
+use crate::admin::storage_api::error::{Error as StorageError, is_err_bucket_not_found};
 use crate::admin::storage_api::runtime::ECStore;
 use crate::admin::utils::{encode_compatible_admin_payload, read_compatible_admin_body};
 use crate::auth::constant_time_eq;
@@ -55,6 +55,7 @@ use crate::storage::storage_api::{
 use base64::Engine;
 use base64::engine::general_purpose::STANDARD as BASE64_STANDARD;
 use base64::engine::general_purpose::URL_SAFE_NO_PAD;
+use futures::StreamExt;
 use hmac::{Hmac, Mac};
 use http::header::{CONTENT_TYPE, HOST};
 use http::{HeaderMap, HeaderValue, Uri};
@@ -2096,6 +2097,18 @@ async fn remote_add_preflight_info(site: &PeerSite) -> S3Result<SiteReplicationA
             format!("invalid site replication metainfo from `{}`: {e}", site.endpoint),
         )
     })?;
+    if info.deployment_id.is_empty() {
+        // The peer will be tracked under a locally derived fallback ID
+        // (deployment_id_for_endpoint) instead of its real deployment ID.
+        warn!(
+            event = EVENT_ADMIN_SITE_REPLICATION_STATE,
+            component = LOG_COMPONENT_ADMIN,
+            subsystem = LOG_SUBSYSTEM_SITE_REPLICATION,
+            result = "peer_deployment_id_missing",
+            peer_endpoint = %site.endpoint,
+            "admin site replication state"
+        );
+    }
 
     let idp_body = send_peer_admin_get_request_with_client(
         &client,
@@ -2206,20 +2219,30 @@ fn site_replication_bootstrap_token(uri: &Uri) -> Option<String> {
     query_pairs(uri).get("bootstrapToken").cloned()
 }
 
-fn bootstrap_bucket_make_op_path(bucket: &SRBucketInfo) -> String {
+/// Query for a peer `make-with-versioning` bucket op. `versioningEnabled`
+/// always travels so the outbound query matches MinIO's site-replication
+/// make-bucket wire contract: MinIO's own create-bucket hook sends
+/// `versioningEnabled=true` on this op. RustFS's inbound handler
+/// force-enables versioning either way.
+fn make_with_versioning_bucket_op_path(bucket: &str, created_at: Option<&str>, lock_enabled: bool) -> String {
     let mut query = form_urlencoded::Serializer::new(String::new());
-    query.append_pair("bucket", &bucket.bucket);
-    query.append_pair("operation", "make-with-versioning");
-    if let Some(created_at) = bucket
-        .created_at
-        .and_then(|value| value.format(&time::format_description::well_known::Rfc3339).ok())
-    {
-        query.append_pair("createdAt", &created_at);
+    query.append_pair("bucket", bucket);
+    query.append_pair("operation", SITE_REPLICATION_BUCKET_OP_MAKE_WITH_VERSIONING);
+    query.append_pair("versioningEnabled", "true");
+    if let Some(created_at) = created_at {
+        query.append_pair("createdAt", created_at);
     }
-    if bucket.object_lock_config.is_some() {
+    if lock_enabled {
         query.append_pair("lockEnabled", "true");
     }
-    format!("/rustfs/admin/v3/site-replication/peer/bucket-ops?{}", query.finish())
+    format!("{SITE_REPLICATION_PEER_BUCKET_OPS_PATH}?{}", query.finish())
+}
+
+fn bootstrap_bucket_make_op_path(bucket: &SRBucketInfo) -> String {
+    let created_at = bucket
+        .created_at
+        .and_then(|value| value.format(&time::format_description::well_known::Rfc3339).ok());
+    make_with_versioning_bucket_op_path(&bucket.bucket, created_at.as_deref(), bucket.object_lock_config.is_some())
 }
 
 fn bootstrap_bucket_meta_item(bucket: &SRBucketInfo, item_type: &str, updated_at: Option<OffsetDateTime>) -> SRBucketMeta {
@@ -4246,16 +4269,7 @@ async fn broadcast_site_replication_make_bucket(
         .format(&time::format_description::well_known::Rfc3339)
         .unwrap_or_default();
 
-    let path = {
-        let mut query = form_urlencoded::Serializer::new(String::new());
-        query.append_pair("bucket", bucket);
-        query.append_pair("operation", "make-with-versioning");
-        query.append_pair("createdAt", &created_at);
-        if lock_enabled {
-            query.append_pair("lockEnabled", "true");
-        }
-        format!("/rustfs/admin/v3/site-replication/peer/bucket-ops?{}", query.finish())
-    };
+    let path = make_with_versioning_bucket_op_path(bucket, Some(&created_at), lock_enabled);
     let path = if let Some(token) = bootstrap_token {
         with_site_replication_bootstrap_token(&path, token)
     } else {
@@ -10206,13 +10220,25 @@ impl Operation for SiteReplicationStatusHandler {
     }
 }
 
+/// `POST /v3/site-replication/devnull` — peer link-check upload drain.
+/// MinIO streams multi-megabyte probe bodies here during site netperf link
+/// checks and expects an unbounded discard (its handler copies to io.Discard);
+/// buffering through the 1MB admin body cap turned any larger probe into a
+/// 400 and a false link failure. Stream and discard instead — no size cap.
+async fn drain_site_replication_devnull(mut input: Body) -> S3Result<()> {
+    while let Some(chunk) = input.next().await {
+        chunk.map_err(|e| s3_error!(InvalidRequest, "failed to read devnull stream: {}", e))?;
+    }
+    Ok(())
+}
+
 pub struct SiteReplicationDevNullHandler {}
 
 #[async_trait::async_trait]
 impl Operation for SiteReplicationDevNullHandler {
     async fn call(&self, req: S3Request<Body>, _params: Params<'_, '_>) -> S3Result<S3Response<(StatusCode, Body)>> {
         validate_site_replication_admin_request(&req, AdminAction::SiteReplicationOperationAction).await?;
-        let _ = read_plain_admin_body(req.input).await?;
+        drain_site_replication_devnull(req.input).await?;
         Ok(empty_response(StatusCode::NO_CONTENT))
     }
 }
@@ -10471,6 +10497,19 @@ impl Operation for SRPeerJoinHandler {
     }
 }
 
+/// Outcome of a peer-driven `purge-deleted-bucket` replay. A bucket that is
+/// already gone means the purge raced an earlier replay or a local delete —
+/// that is success — but any other failure must reach the sender like the
+/// sibling delete branches do: swallowing it answered 200 while the bucket
+/// survived on this site.
+fn purge_deleted_bucket_result(result: Result<(), StorageError>) -> S3Result<()> {
+    match result {
+        Ok(()) => Ok(()),
+        Err(err) if is_err_bucket_not_found(&err) => Ok(()),
+        Err(err) => Err(ApiError::from(err).into()),
+    }
+}
+
 pub struct SRPeerBucketOpsHandler {}
 
 #[async_trait::async_trait]
@@ -10570,16 +10609,18 @@ impl Operation for SRPeerBucketOpsHandler {
                     .map_err(ApiError::from)?;
             }
             "purge-deleted-bucket" => {
-                let _ = store
-                    .delete_bucket(
-                        &bucket,
-                        &DeleteBucketOptions {
-                            force: true,
-                            srdelete_op: SRBucketDeleteOp::Purge,
-                            ..Default::default()
-                        },
-                    )
-                    .await;
+                purge_deleted_bucket_result(
+                    store
+                        .delete_bucket(
+                            &bucket,
+                            &DeleteBucketOptions {
+                                force: true,
+                                srdelete_op: SRBucketDeleteOp::Purge,
+                                ..Default::default()
+                            },
+                        )
+                        .await,
+                )?;
             }
             _ => return Err(s3_error!(InvalidRequest, "unsupported site replication bucket operation")),
         }
@@ -13925,6 +13966,54 @@ mod tests {
         assert!(!query_flag(&uri, "missing"));
     }
 
+    /// A5 red-light: a `purge-deleted-bucket` replay must report success when
+    /// the bucket is already gone, and must propagate every other failure —
+    /// the swallowed error answered 200 while the bucket survived.
+    #[test]
+    fn test_purge_deleted_bucket_result_tolerates_only_missing_bucket() {
+        assert!(purge_deleted_bucket_result(Ok(())).is_ok());
+        assert!(purge_deleted_bucket_result(Err(StorageError::BucketNotFound("photos".to_string()))).is_ok());
+        assert!(purge_deleted_bucket_result(Err(StorageError::VolumeNotFound)).is_ok());
+        let err = purge_deleted_bucket_result(Err(StorageError::StorageFull))
+            .expect_err("non-not-found delete failures must propagate");
+        assert_ne!(*err.code(), S3ErrorCode::NoSuchBucket);
+    }
+
+    /// C5 red-light: the site-replication devnull drain must accept bodies
+    /// beyond the 1MB admin body cap — MinIO's link check streams large
+    /// probe bodies and treats a 400 as a broken link.
+    #[tokio::test]
+    async fn test_site_replication_devnull_drains_body_beyond_admin_cap() {
+        let body = Body::from(vec![0u8; MAX_ADMIN_REQUEST_BODY_SIZE + 1]);
+        drain_site_replication_devnull(body)
+            .await
+            .expect("devnull must drain bodies larger than the admin body cap");
+    }
+
+    /// A3 red-light: `versioningEnabled` must travel on every outbound
+    /// make-with-versioning bucket op so the query matches MinIO's
+    /// site-replication make-bucket wire contract (MinIO's own hook sends
+    /// `versioningEnabled=true` on this op).
+    #[test]
+    fn test_make_with_versioning_op_paths_send_versioning_enabled() {
+        let bucket = SRBucketInfo {
+            bucket: "photos".to_string(),
+            created_at: Some(OffsetDateTime::UNIX_EPOCH),
+            object_lock_config: Some(BASE64_STANDARD.encode("<ObjectLockConfiguration/>")),
+            ..Default::default()
+        };
+        let bootstrap = bootstrap_bucket_make_op_path(&bucket);
+        assert!(bootstrap.contains("operation=make-with-versioning"), "{bootstrap}");
+        assert!(bootstrap.contains("versioningEnabled=true"), "{bootstrap}");
+        assert!(bootstrap.contains("createdAt="), "{bootstrap}");
+        assert!(bootstrap.contains("lockEnabled=true"), "{bootstrap}");
+
+        // The broadcast path (create-bucket hook) shares the same builder.
+        let broadcast = make_with_versioning_bucket_op_path("photos", Some("1970-01-01T00:00:00Z"), false);
+        assert!(broadcast.contains("versioningEnabled=true"), "{broadcast}");
+        assert!(!broadcast.contains("lockEnabled"), "{broadcast}");
+    }
+
     #[tokio::test]
     #[serial]
     async fn test_add_bootstrap_scope_only_allows_expected_bucket_setup_until_guard_drops() {

rustfs/src/admin/site_replication_identity.rs

@@ -13,9 +13,9 @@
 // limitations under the License.
 
 use rustfs_madmin::{PeerInfo, SyncStatus};
-use std::collections::{BTreeMap, hash_map::DefaultHasher};
-use std::hash::{Hash, Hasher};
+use std::collections::BTreeMap;
 use url::Url;
+use uuid::Uuid;
 
 fn has_http_scheme(endpoint: &str) -> bool {
     endpoint.get(..7).is_some_and(|prefix| prefix.eq_ignore_ascii_case("http://"))
@@ -66,10 +66,12 @@ pub fn site_identity_key(endpoint: &str) -> String {
         .unwrap_or_else(|| trimmed.to_ascii_lowercase())
 }
 
+/// Fallback deployment ID for a peer that reported none. UUIDv5 over the
+/// canonical endpoint: the ID is persisted in site-replication state and
+/// broadcast to peers, so it must be identical across Rust toolchains
+/// (`DefaultHasher` is not) and across spellings of the same endpoint.
 pub fn deployment_id_for_endpoint(endpoint: &str) -> String {
-    let mut hasher = DefaultHasher::new();
-    endpoint.hash(&mut hasher);
-    format!("{:016x}", hasher.finish())
+    Uuid::new_v5(&Uuid::NAMESPACE_URL, canonical_endpoint(endpoint).as_bytes()).to_string()
 }
 
 pub fn same_identity_endpoint(left: &str, right: &str) -> bool {
@@ -174,6 +176,23 @@ mod tests {
         }
     }
 
+    /// B8 red-light: the fallback deployment ID must be a toolchain-stable
+    /// UUIDv5 over the canonical endpoint — `DefaultHasher` output is not
+    /// guaranteed stable across Rust releases, yet the ID is persisted in
+    /// site-replication state and broadcast to peers.
+    #[test]
+    fn deployment_id_for_endpoint_is_stable_uuid_v5_over_canonical_endpoint() {
+        let endpoint = "https://node-a.example.com:9000";
+        let id = deployment_id_for_endpoint(endpoint);
+        let parsed = uuid::Uuid::parse_str(&id).expect("fallback deployment ID must be a UUID");
+        assert_eq!(parsed.get_version_num(), 5, "fallback deployment ID must be UUIDv5");
+        // Deterministic for the same endpoint and for spelling variants that
+        // share a canonical form; distinct endpoints stay distinct.
+        assert_eq!(id, deployment_id_for_endpoint(endpoint));
+        assert_eq!(id, deployment_id_for_endpoint(" HTTPS://Node-A.Example.Com:9000/ "));
+        assert_ne!(id, deployment_id_for_endpoint("https://node-b.example.com:9000"));
+    }
+
     #[test]
     fn canonical_endpoint_accepts_case_insensitive_scheme() {
         assert_eq!(

rustfs/src/admin/storage_api.rs

@@ -51,7 +51,7 @@ mod ecstore_disk {
 }
 
 mod ecstore_error {
-    pub(crate) use crate::storage::storage_api::ecstore_error::StorageError;
+    pub(crate) use crate::storage::storage_api::ecstore_error::{StorageError, is_err_bucket_not_found};
 }
 
 #[allow(unused_imports)]
@@ -919,6 +919,7 @@ pub(crate) mod contract {
 }
 
 pub(crate) mod error {
+    pub(crate) use super::ecstore_error::is_err_bucket_not_found;
     pub(crate) use super::{Error, StorageError};
 }