fix(sse): read MinIO single-part encrypted objects

Two independent defects kept them unreadable, both reached only once the fixture harness could load an inlined object at all. The stream was keyed as if the object were multipart. is_multipart_encrypted_object falls back to an ETag length test when there is a single part, and MinIO stores an *encrypted* ETag for SSE objects — 96 characters for a single-part upload, not the 32 of a plain MD5 — so every such object read as multipart and had a per-part key derived for a stream sealed with the object key itself. MinIO records the answer outright in X-Minio-Internal-Encrypted-Multipart, so that marker is now consulted first, and on a MinIO-written object its absence is treated as just as informative as its presence. The size was then reported as the ciphertext's. MinIO writes an explicit plaintext size only for multipart uploads, deriving it from the DARE stream otherwise, so both the read plan and ObjectInfo::decrypted_size fell back to the physical size — the reader waited for the encoding overhead as if it were payload, and a client would have seen a Content-Length overstated by exactly that much. dare_v2_decrypted_size inverts the package layout the way MinIO's sio.DecryptedSize does. It lives in rustfs-utils so the read plan and the size accessor cannot drift apart, and it returns None for a length no DARE stream can have rather than assigning a malformed object a plausible one. The interop suite is 9/9 with the two single-part cases added, and reverting the classification to the ETag heuristic turns both red. rustfs-ecstore's object_api tests and rustfs-utils are unaffected. Refs rustfs/backlog#1638.
test(interop): pair each disk with the metadata that disk stored
2026-08-21 20:06:37 +00:00 · 2026-08-19 22:57:24 +08:00 · 2026-08-19 20:47:30 +08:00 · 2026-08-19 09:25:10 +08:00 · 2026-08-19 09:24:30 +08:00 · 2026-08-19 08:36:18 +08:00
394 changed files with 38798 additions and 62499 deletions
@@ -70,11 +70,6 @@ fips-wording-check: ## Check docs and crates/kms do not over-claim crypto capabi
 	@echo "📣 Checking cryptographic capability wording guard..."
 	./scripts/check_fips_wording.sh

-.PHONY: embedded-secrets-check
-embedded-secrets-check: ## Check no private key material or credential literal is committed
-	@echo "🔑 Checking embedded secret material guard..."
-	./scripts/check_embedded_secrets.sh
-
 .PHONY: log-analyzer-rules-check
 log-analyzer-rules-check: core-deps ## Check log-analyzer rule anchors still exist verbatim in source
 	@echo "🩺 Checking log-analyzer rule anchors..."
@@ -19,13 +19,13 @@ planning-docs-check: ## Check that no planning-type documents are committed
 	./scripts/check_no_planning_docs.sh

 .PHONY: pre-commit
-pre-commit: fmt-check unsafe-code-check architecture-migration-check logging-guardrails-check tokio-io-uring-check extension-schema-check body-cache-whitelist-check s3s-footprint-check fips-wording-check embedded-secrets-check doc-paths-check planning-docs-check quick-check ## Run fast pre-commit checks without clippy/full tests
+pre-commit: fmt-check unsafe-code-check architecture-migration-check logging-guardrails-check tokio-io-uring-check extension-schema-check body-cache-whitelist-check s3s-footprint-check fips-wording-check doc-paths-check planning-docs-check quick-check ## Run fast pre-commit checks without clippy/full tests
 	@echo "✅ All pre-commit checks passed!"

 .PHONY: pre-pr
-pre-pr: fmt-check unsafe-code-check architecture-migration-check logging-guardrails-check tokio-io-uring-check extension-schema-check body-cache-whitelist-check s3s-footprint-check fips-wording-check embedded-secrets-check doc-paths-check planning-docs-check log-analyzer-rules-check clippy-check test ## Run full pre-PR checks with clippy and tests
+pre-pr: fmt-check unsafe-code-check architecture-migration-check logging-guardrails-check tokio-io-uring-check extension-schema-check body-cache-whitelist-check s3s-footprint-check fips-wording-check doc-paths-check planning-docs-check log-analyzer-rules-check clippy-check test ## Run full pre-PR checks with clippy and tests
 	@echo "✅ All pre-PR checks passed!"

 .PHONY: dev-check
-dev-check: fmt-check unsafe-code-check architecture-migration-check logging-guardrails-check tokio-io-uring-check extension-schema-check body-cache-whitelist-check s3s-footprint-check fips-wording-check embedded-secrets-check doc-paths-check planning-docs-check quick-check ## Run fast local development checks
+dev-check: fmt-check unsafe-code-check architecture-migration-check logging-guardrails-check tokio-io-uring-check extension-schema-check body-cache-whitelist-check s3s-footprint-check fips-wording-check doc-paths-check planning-docs-check quick-check ## Run fast local development checks
 	@echo "✅ Fast development checks passed!"
@@ -34,7 +34,6 @@ script-tests: ## Run shell script tests
 	./scripts/test_exact_1mib_handoff_abba.sh
 	./scripts/test_pinned_paired_abba_bench.sh
 	./scripts/test_manual_transition_runbooks.sh
-	./scripts/check_embedded_secrets.sh --self-test
 	bash -n ./scripts/validate_object_data_cache_cold_stampede.sh
 	python3 ./scripts/check_object_data_cache_follower_samples.py --self-test
 	./scripts/validate_object_data_cache_cold_stampede.sh --self-test
@@ -53,9 +53,9 @@ jobs:
          persist-credentials: false

      - name: Install ripgrep
-        uses: taiki-e/install-action@bffeee26d4db9be238a4ea78d8826604ebcb594d # v2
-        with:
-          tool: ripgrep@15.2.0
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y ripgrep

      - name: Check architecture migration rules
        run: ./scripts/check_architecture_migration_rules.sh
@@ -83,9 +83,7 @@ jobs:
          persist-credentials: false

      - name: Install ripgrep
-        uses: taiki-e/install-action@bffeee26d4db9be238a4ea78d8826604ebcb594d # v2
-        with:
-          tool: ripgrep@15.2.0
+        run: sudo apt-get update && sudo apt-get install -y ripgrep

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
@@ -122,9 +120,6 @@ jobs:
      - name: Check cryptographic capability wording
        run: ./scripts/check_fips_wording.sh

-      - name: Check no embedded secret material
-        run: ./scripts/check_embedded_secrets.sh
-
      - name: Check no planning docs committed
        run: ./scripts/check_no_planning_docs.sh

@@ -118,9 +118,7 @@ jobs:
          persist-credentials: false

      - name: Install ripgrep
-        uses: taiki-e/install-action@bffeee26d4db9be238a4ea78d8826604ebcb594d # v2
-        with:
-          tool: ripgrep@15.2.0
+        run: sudo apt-get update && sudo apt-get install -y ripgrep

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
@@ -157,9 +155,6 @@ jobs:
      - name: Check cryptographic capability wording
        run: ./scripts/check_fips_wording.sh

-      - name: Check no embedded secret material
-        run: ./scripts/check_embedded_secrets.sh
-
      - name: Check no planning docs committed
        run: ./scripts/check_no_planning_docs.sh

@@ -189,7 +189,6 @@ jobs:
    timeout-minutes: 30
    strategy:
      fail-fast: false
-      max-parallel: 1
      matrix:
        include:
          - arch: x86_64
@@ -511,27 +510,22 @@ jobs:

          CHECKSUM_DIR="$(mktemp -d)"
          gh release download "$TAG" -p 'SHA256SUMS' -p 'SHA512SUMS' \
-            -D "$CHECKSUM_DIR" --clobber
+            -D "$CHECKSUM_DIR" --clobber 2>/dev/null || true

          for spec in "SHA256SUMS:sha256sum" "SHA512SUMS:sha512sum"; do
            asset="${spec%%:*}"
            checksum_cmd="${spec##*:}"
            checksum_file="${CHECKSUM_DIR}/${asset}"

+            touch "$checksum_file"
+
            for f in "$DEB_FILE" "$RPM_FILE"; do
              if [[ -n "$f" && -f "$f" ]]; then
                base="$(basename "$f")"
-                # GitHub stores release asset names with '~' normalized to '.'
-                # (e.g. rustfs_1.0.0~rc.2_amd64.deb is stored as
-                # rustfs_1.0.0.rc.2_amd64.deb), so checksum entries must
-                # reference the name as stored on the release.
-                github_base="${base//\~/.}"
-                # Remove any stale entry (both naming variants), then append
+                # Remove any stale entry, then append the fresh digest
                grep -Fv -- "$base" "$checksum_file" > "${checksum_file}.tmp" || true
-                grep -Fv -- "$github_base" "${checksum_file}.tmp" > "${checksum_file}.tmp2" || true
-                mv "${checksum_file}.tmp2" "$checksum_file"
-                digest=$("$checksum_cmd" -- "$f" | awk '{print $1}')
-                printf '%s  %s\n' "$digest" "$github_base" >> "$checksum_file"
+                mv "${checksum_file}.tmp" "$checksum_file"
+                (cd "$(dirname "$f")" && "$checksum_cmd" -- "$base") >> "$checksum_file"
              fi
            done

@@ -127,9 +127,8 @@ the broadest gate. Inspect only the final task-owned diff, classify it by
 behavioral impact rather than line count or path alone, and run the smallest
 set of checks that provides meaningful coverage. Do not let unrelated
 worktree changes or a generic contributor checklist expand the scope.
-For non-exempt changes, complete the applicable multi-role adversarial review
-before running `make pre-pr` (or an equivalent full gate). Resolve or rebut
-every finding first, then run the gate against the reviewed final diff.
+Non-exempt changes must also pass Adversarial Validation (next section) before
+the checks below count as completion.

 ### Validation floor

@@ -167,9 +166,8 @@ every finding first, then run the gate against the reviewed final diff.
   dependency set is identifiable, validate those packages and known
   dependents instead of the whole workspace. Use `make pre-commit` only when
   a repository-wide fast gate adds useful confidence beyond those checks.
-4. **Broad or high-risk change:** After the applicable adversarial review has
-   completed, run `make pre-pr` only when targeted coverage cannot bound the
-   impact, including:
+4. **Broad or high-risk change:** Run `make pre-pr` only when targeted coverage
+   cannot bound the impact, including:
   - dependency, feature, build-script, procedural-macro, code-generation,
     toolchain, or CI changes that alter compilation or the test matrix;
   - cross-crate public APIs, shared foundational code, or broad refactors with
@@ -289,9 +287,8 @@ High risk: all seven roles.
 - Every testable behavior change has a focused regression check. Exceptions
  follow the validation floor and state why a check is impractical and what
  risk remains.
- After the applicable adversarial review has completed, the Verification
-  Before PR gates pass; adversarial review supplements those gates, never
-  replaces them.
+- The Verification Before PR gates pass — adversarial review supplements
+  those gates, never replaces them.
 - High risk only: record a one-line verdict per role in the PR description.

 ## Git and PR Baseline
@@ -91,9 +91,8 @@ A green `make pre-commit` is not enough to open a pull request.
 `make pre-pr` is the **full** gate: it runs all of the guard checks above,
 then `clippy-check` (`cargo clippy --all-targets --all-features -- -D warnings`)
 and `test` (shell script tests, workspace tests excluding `e2e_test`, and doc
-tests). Complete the applicable multi-role adversarial review described in
-`AGENTS.md` before running `make pre-pr`; then run the gate before opening or
-updating a pull request. This is what CI enforces.
+tests). Run `make pre-pr` before opening or updating a pull request — this is
+what CI enforces.

 ### 🔒 Git Pre-commit Hooks (optional)

@@ -151,9 +150,8 @@ Example output when formatting fails:
 2. **Format your code**: `make fmt` or `cargo fmt --all`
 3. **Run the fast gate**: `make pre-commit` (no clippy, no tests)
 4. **Commit your changes**: `git commit -m "your message"`
-5. **Complete the applicable multi-role adversarial review** for non-exempt changes (see `AGENTS.md`)
-6. **Run the full gate before opening/updating a PR**: `make pre-pr` (clippy + tests)
-7. **Push to your branch**: `git push`
+5. **Run the full gate before opening/updating a PR**: `make pre-pr` (clippy + tests)
+6. **Push to your branch**: `git push`

 ### 🛠️ IDE Integration

@@ -1198,9 +1198,9 @@ dependencies = [

 [[package]]
 name = "aws-smithy-http-client"
-version = "1.4.0"
+version = "1.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ebfd138fac0337cee7516c352757ea73b9f2266e57d0bcb5bc70e9547e45aef1"
+checksum = "3c1c8a04cb31ba74d0115af5a890bb8c0d48fba64b52812fa13929a6ef0cc83c"
 dependencies = [
 "aws-smithy-async",
 "aws-smithy-protocol-test",
@@ -1280,9 +1280,9 @@ dependencies = [

 [[package]]
 name = "aws-smithy-runtime"
-version = "1.14.0"
+version = "1.13.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b82e438d30e02a825d363bd639a9efaed68a8089d86101054b0081e7e0d3e606"
+checksum = "483b858ff67522011c4786310c5cd8fd88d0be7ea3d5f1a48328446300c4269e"
 dependencies = [
 "aws-smithy-async",
 "aws-smithy-http",
@@ -1306,9 +1306,9 @@ dependencies = [

 [[package]]
 name = "aws-smithy-runtime-api"
-version = "1.15.0"
+version = "1.14.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "954c563ce84507722d2679f07a35d21b9c6466b3872d513020d0281fc8112ac9"
+checksum = "3b98f2e1fd67ec06618f9c291e5e495a468e60519e44c9c1979cd0521f3affdb"
 dependencies = [
 "aws-smithy-async",
 "aws-smithy-runtime-api-macros",
@@ -1598,7 +1598,7 @@ version = "0.10.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "3078c7629b62d3f0439517fa394996acacc5cbc91c5a20d8c658e77abd503a71"
 dependencies = [
- "generic-array 0.14.9",
+ "generic-array 0.14.7",
 ]

 [[package]]
@@ -1617,7 +1617,7 @@ version = "0.3.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a8894febbff9f758034a5b8e12d87918f56dfc64a8e1fe757d65e29041538d93"
 dependencies = [
- "generic-array 0.14.9",
+ "generic-array 0.14.7",
 ]

 [[package]]
@@ -1968,7 +1968,7 @@ version = "0.4.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "773f3b9af64447d2ce9850330c473515014aa235e6a783b02db81ff39e4a3dad"
 dependencies = [
- "crypto-common 0.1.6",
+ "crypto-common 0.1.7",
 "inout 0.1.4",
 ]

@@ -2428,7 +2428,7 @@ version = "0.5.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0dc92fb57ca44df6db8059111ab3af99a63d5d0f8375d9972e319a379c6bab76"
 dependencies = [
- "generic-array 0.14.9",
+ "generic-array 0.14.7",
 "rand_core 0.6.4",
 "subtle",
 "zeroize",
@@ -2453,11 +2453,11 @@ dependencies = [

 [[package]]
 name = "crypto-common"
-version = "0.1.6"
+version = "0.1.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1bfb12502f3fc46cca1bb51ac28df9d618d813cdc3d2f25b9fe775a34af26bb3"
+checksum = "78c8292055d1c1df0cce5d180393dc8cce0abec0a7102adb6c7b1eef6016d60a"
 dependencies = [
- "generic-array 0.14.9",
+ "generic-array 0.14.7",
 "typenum",
 ]

@@ -2703,9 +2703,8 @@ checksum = "4583a4551df46e2792f82ceeac45e850d2e2d5debba0b91f102385cda5b11f06"

 [[package]]
 name = "datafusion"
-version = "55.0.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "96f76f0167ed0842b29a3d1e41be3c034c0a46409a3a703cc4cc84ee8c24abf4"
+version = "54.1.0"
+source = "git+https://github.com/apache/datafusion.git?rev=e08aed1e5de41dcf81d529140dae07723b942a5e#e08aed1e5de41dcf81d529140dae07723b942a5e"
 dependencies = [
 "arrow",
 "arrow-schema",
@@ -2752,9 +2751,8 @@ dependencies = [

 [[package]]
 name = "datafusion-catalog"
-version = "55.0.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d79ec3460f6ed5c58f9b3f2d873fbc77748b82653bff1b4cdaf06de33bb4e05f"
+version = "54.1.0"
+source = "git+https://github.com/apache/datafusion.git?rev=e08aed1e5de41dcf81d529140dae07723b942a5e#e08aed1e5de41dcf81d529140dae07723b942a5e"
 dependencies = [
 "arrow",
 "async-trait",
@@ -2777,9 +2775,8 @@ dependencies = [

 [[package]]
 name = "datafusion-catalog-listing"
-version = "55.0.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b48cef241e2efcfd496fe05ae4d0d5de20793451862faefe406c397a467e12d4"
+version = "54.1.0"
+source = "git+https://github.com/apache/datafusion.git?rev=e08aed1e5de41dcf81d529140dae07723b942a5e#e08aed1e5de41dcf81d529140dae07723b942a5e"
 dependencies = [
 "arrow",
 "async-trait",
@@ -2801,9 +2798,8 @@ dependencies = [

 [[package]]
 name = "datafusion-common"
-version = "55.0.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3f72810485975c258f1b4d00baab31728470676c60c5546f366ebd0d99f05ab6"
+version = "54.1.0"
+source = "git+https://github.com/apache/datafusion.git?rev=e08aed1e5de41dcf81d529140dae07723b942a5e#e08aed1e5de41dcf81d529140dae07723b942a5e"
 dependencies = [
 "arrow",
 "arrow-ipc",
@@ -2828,9 +2824,8 @@ dependencies = [

 [[package]]
 name = "datafusion-common-runtime"
-version = "55.0.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "533c28e75dba52f41bde187d23a1cb24ab91c7c097966824fa471e67b60320ea"
+version = "54.1.0"
+source = "git+https://github.com/apache/datafusion.git?rev=e08aed1e5de41dcf81d529140dae07723b942a5e#e08aed1e5de41dcf81d529140dae07723b942a5e"
 dependencies = [
 "futures",
 "log",
@@ -2839,9 +2834,8 @@ dependencies = [

 [[package]]
 name = "datafusion-datasource"
-version = "55.0.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5b00a1fa0da26f6087136a82fea7f13c76a672cbab452d4086952a7cf770a19b"
+version = "54.1.0"
+source = "git+https://github.com/apache/datafusion.git?rev=e08aed1e5de41dcf81d529140dae07723b942a5e#e08aed1e5de41dcf81d529140dae07723b942a5e"
 dependencies = [
 "arrow",
 "async-trait",
@@ -2869,9 +2863,8 @@ dependencies = [

 [[package]]
 name = "datafusion-datasource-arrow"
-version = "55.0.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5ad17ec881bff2ed7768b4bfe971d3efbf3473f2fd1f9d365447bccbdf908678"
+version = "54.1.0"
+source = "git+https://github.com/apache/datafusion.git?rev=e08aed1e5de41dcf81d529140dae07723b942a5e#e08aed1e5de41dcf81d529140dae07723b942a5e"
 dependencies = [
 "arrow",
 "arrow-ipc",
@@ -2893,9 +2886,8 @@ dependencies = [

 [[package]]
 name = "datafusion-datasource-csv"
-version = "55.0.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b5345285b0c3eaab412e7539b706973c083bd7e5bce575de5e0a3da488d08d1d"
+version = "54.1.0"
+source = "git+https://github.com/apache/datafusion.git?rev=e08aed1e5de41dcf81d529140dae07723b942a5e#e08aed1e5de41dcf81d529140dae07723b942a5e"
 dependencies = [
 "arrow",
 "async-trait",
@@ -2916,9 +2908,8 @@ dependencies = [

 [[package]]
 name = "datafusion-datasource-json"
-version = "55.0.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "da02fb9324f56bd8c53f1ee2e949547425cb66f76adc6832b10d44f80a1221d2"
+version = "54.1.0"
+source = "git+https://github.com/apache/datafusion.git?rev=e08aed1e5de41dcf81d529140dae07723b942a5e#e08aed1e5de41dcf81d529140dae07723b942a5e"
 dependencies = [
 "arrow",
 "async-trait",
@@ -2939,9 +2930,8 @@ dependencies = [

 [[package]]
 name = "datafusion-datasource-parquet"
-version = "55.0.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3c0b0dc1453952952fd5c69ad1c7f6042176e69ed233011d47e07cf74ed0949e"
+version = "54.1.0"
+source = "git+https://github.com/apache/datafusion.git?rev=e08aed1e5de41dcf81d529140dae07723b942a5e#e08aed1e5de41dcf81d529140dae07723b942a5e"
 dependencies = [
 "arrow",
 "arrow-schema",
@@ -2971,15 +2961,13 @@ dependencies = [

 [[package]]
 name = "datafusion-doc"
-version = "55.0.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a88fd985bc0550c36f557db69543cc9d6393b1509783520b30e902f23c555da6"
+version = "54.1.0"
+source = "git+https://github.com/apache/datafusion.git?rev=e08aed1e5de41dcf81d529140dae07723b942a5e#e08aed1e5de41dcf81d529140dae07723b942a5e"

 [[package]]
 name = "datafusion-execution"
-version = "55.0.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a98f1052f91b4991f0bf2ce1e4e36dfbdcda454a956b8c8d562c7c845e8fce1d"
+version = "54.1.0"
+source = "git+https://github.com/apache/datafusion.git?rev=e08aed1e5de41dcf81d529140dae07723b942a5e#e08aed1e5de41dcf81d529140dae07723b942a5e"
 dependencies = [
 "arrow",
 "arrow-buffer",
@@ -3003,9 +2991,8 @@ dependencies = [

 [[package]]
 name = "datafusion-expr"
-version = "55.0.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "464625a1f0e4b9df552d894fafcc8aac953ebbc8b0fa0acdaf20975fd615040e"
+version = "54.1.0"
+source = "git+https://github.com/apache/datafusion.git?rev=e08aed1e5de41dcf81d529140dae07723b942a5e#e08aed1e5de41dcf81d529140dae07723b942a5e"
 dependencies = [
 "arrow",
 "arrow-schema",
@@ -3026,9 +3013,8 @@ dependencies = [

 [[package]]
 name = "datafusion-expr-common"
-version = "55.0.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2604994999d5aeca1d1df645ffc98bc787447aaff05dde27aad0342b48fc1fe0"
+version = "54.1.0"
+source = "git+https://github.com/apache/datafusion.git?rev=e08aed1e5de41dcf81d529140dae07723b942a5e#e08aed1e5de41dcf81d529140dae07723b942a5e"
 dependencies = [
 "arrow",
 "datafusion-common",
@@ -3038,9 +3024,8 @@ dependencies = [

 [[package]]
 name = "datafusion-functions"
-version = "55.0.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "051e97533e6af53e4aa0a0667cadc886abcaf36c4a5925019c55c0aa4c218fde"
+version = "54.1.0"
+source = "git+https://github.com/apache/datafusion.git?rev=e08aed1e5de41dcf81d529140dae07723b942a5e#e08aed1e5de41dcf81d529140dae07723b942a5e"
 dependencies = [
 "arrow",
 "arrow-buffer",
@@ -3066,9 +3051,8 @@ dependencies = [

 [[package]]
 name = "datafusion-functions-aggregate"
-version = "55.0.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2d0f1bb166d3572b6ed40e1afb2faaacade962abc08c2fcf04babee74681c56b"
+version = "54.1.0"
+source = "git+https://github.com/apache/datafusion.git?rev=e08aed1e5de41dcf81d529140dae07723b942a5e#e08aed1e5de41dcf81d529140dae07723b942a5e"
 dependencies = [
 "arrow",
 "datafusion-common",
@@ -3087,9 +3071,8 @@ dependencies = [

 [[package]]
 name = "datafusion-functions-aggregate-common"
-version = "55.0.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7ed756770f5f98369e181d692fd5ee6b1127ffd7322caba92f3730f9f5c92333"
+version = "54.1.0"
+source = "git+https://github.com/apache/datafusion.git?rev=e08aed1e5de41dcf81d529140dae07723b942a5e#e08aed1e5de41dcf81d529140dae07723b942a5e"
 dependencies = [
 "arrow",
 "datafusion-common",
@@ -3099,9 +3082,8 @@ dependencies = [

 [[package]]
 name = "datafusion-functions-nested"
-version = "55.0.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "91173fdb5c0ff2a41169a8ffa1b385b8844f18728747bb0a37e35ad7d5772a4f"
+version = "54.1.0"
+source = "git+https://github.com/apache/datafusion.git?rev=e08aed1e5de41dcf81d529140dae07723b942a5e#e08aed1e5de41dcf81d529140dae07723b942a5e"
 dependencies = [
 "arrow",
 "arrow-ord",
@@ -3124,9 +3106,8 @@ dependencies = [

 [[package]]
 name = "datafusion-functions-table"
-version = "55.0.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b1bcdfb286a745461b126719c32700777e83df4f17cc44db5d71ebce5731e840"
+version = "54.1.0"
+source = "git+https://github.com/apache/datafusion.git?rev=e08aed1e5de41dcf81d529140dae07723b942a5e#e08aed1e5de41dcf81d529140dae07723b942a5e"
 dependencies = [
 "arrow",
 "async-trait",
@@ -3140,9 +3121,8 @@ dependencies = [

 [[package]]
 name = "datafusion-functions-window"
-version = "55.0.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9ec4b508f1f93f00038ba3e737e894ec6c775528b4369413386655ae6125f0fc"
+version = "54.1.0"
+source = "git+https://github.com/apache/datafusion.git?rev=e08aed1e5de41dcf81d529140dae07723b942a5e#e08aed1e5de41dcf81d529140dae07723b942a5e"
 dependencies = [
 "arrow",
 "datafusion-common",
@@ -3157,9 +3137,8 @@ dependencies = [

 [[package]]
 name = "datafusion-functions-window-common"
-version = "55.0.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0b352020834140073fbf5b46ee0ceb926e5074a9d0bcae1dbd91d0586d999cde"
+version = "54.1.0"
+source = "git+https://github.com/apache/datafusion.git?rev=e08aed1e5de41dcf81d529140dae07723b942a5e#e08aed1e5de41dcf81d529140dae07723b942a5e"
 dependencies = [
 "datafusion-common",
 "datafusion-physical-expr-common",
@@ -3167,9 +3146,8 @@ dependencies = [

 [[package]]
 name = "datafusion-macros"
-version = "55.0.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "15192effab05d38cce10e92a6fb48c967b5f166b27b7195a165a72b232569c58"
+version = "54.1.0"
+source = "git+https://github.com/apache/datafusion.git?rev=e08aed1e5de41dcf81d529140dae07723b942a5e#e08aed1e5de41dcf81d529140dae07723b942a5e"
 dependencies = [
 "datafusion-doc",
 "quote",
@@ -3178,9 +3156,8 @@ dependencies = [

 [[package]]
 name = "datafusion-optimizer"
-version = "55.0.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "854445d9f7847e1e46089cf61b8d341a64382f14484e912c83a0f23b31216896"
+version = "54.1.0"
+source = "git+https://github.com/apache/datafusion.git?rev=e08aed1e5de41dcf81d529140dae07723b942a5e#e08aed1e5de41dcf81d529140dae07723b942a5e"
 dependencies = [
 "arrow",
 "chrono",
@@ -3198,9 +3175,8 @@ dependencies = [

 [[package]]
 name = "datafusion-physical-expr"
-version = "55.0.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "671558dad1d2aa253c39c0a4c52515958b99eb91abf649f4b88d5e69cc55282f"
+version = "54.1.0"
+source = "git+https://github.com/apache/datafusion.git?rev=e08aed1e5de41dcf81d529140dae07723b942a5e#e08aed1e5de41dcf81d529140dae07723b942a5e"
 dependencies = [
 "arrow",
 "datafusion-common",
@@ -3220,9 +3196,8 @@ dependencies = [

 [[package]]
 name = "datafusion-physical-expr-adapter"
-version = "55.0.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ffae3d78c2da80ecc829cb58536cc5aca2e99cf1365eda694fc75bfe288861e0"
+version = "54.1.0"
+source = "git+https://github.com/apache/datafusion.git?rev=e08aed1e5de41dcf81d529140dae07723b942a5e#e08aed1e5de41dcf81d529140dae07723b942a5e"
 dependencies = [
 "arrow",
 "datafusion-common",
@@ -3235,9 +3210,8 @@ dependencies = [

 [[package]]
 name = "datafusion-physical-expr-common"
-version = "55.0.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3d9092ed15e7203fbd0903215172f7c9d18f10d94cba35137f3b3836f7c46f16"
+version = "54.1.0"
+source = "git+https://github.com/apache/datafusion.git?rev=e08aed1e5de41dcf81d529140dae07723b942a5e#e08aed1e5de41dcf81d529140dae07723b942a5e"
 dependencies = [
 "arrow",
 "chrono",
@@ -3252,9 +3226,8 @@ dependencies = [

 [[package]]
 name = "datafusion-physical-optimizer"
-version = "55.0.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9005b6cf50b57b72d476c6ed4662b04be7ca6be5320ba9127c6d0b7e4218095b"
+version = "54.1.0"
+source = "git+https://github.com/apache/datafusion.git?rev=e08aed1e5de41dcf81d529140dae07723b942a5e#e08aed1e5de41dcf81d529140dae07723b942a5e"
 dependencies = [
 "arrow",
 "datafusion-common",
@@ -3272,9 +3245,8 @@ dependencies = [

 [[package]]
 name = "datafusion-physical-plan"
-version = "55.0.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5787e4fcff4adc4fce8948441103a99705018b49c8dff0720b650bd7a15da112"
+version = "54.1.0"
+source = "git+https://github.com/apache/datafusion.git?rev=e08aed1e5de41dcf81d529140dae07723b942a5e#e08aed1e5de41dcf81d529140dae07723b942a5e"
 dependencies = [
 "arrow",
 "arrow-data",
@@ -3307,9 +3279,8 @@ dependencies = [

 [[package]]
 name = "datafusion-pruning"
-version = "55.0.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9e651c8df0b90daed6a7be5921ec0ee379e6909705f063eeff70fd4e35010e4c"
+version = "54.1.0"
+source = "git+https://github.com/apache/datafusion.git?rev=e08aed1e5de41dcf81d529140dae07723b942a5e#e08aed1e5de41dcf81d529140dae07723b942a5e"
 dependencies = [
 "arrow",
 "datafusion-common",
@@ -3323,9 +3294,8 @@ dependencies = [

 [[package]]
 name = "datafusion-session"
-version = "55.0.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fb56667ee38217efab19b895d9a936052cfb47ed438a19663351bdc42a6214a1"
+version = "54.1.0"
+source = "git+https://github.com/apache/datafusion.git?rev=e08aed1e5de41dcf81d529140dae07723b942a5e#e08aed1e5de41dcf81d529140dae07723b942a5e"
 dependencies = [
 "arrow-schema",
 "async-trait",
@@ -3338,9 +3308,8 @@ dependencies = [

 [[package]]
 name = "datafusion-sql"
-version = "55.0.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9c29067cb9d32f8e603c45e15d61ea18f1069f96ceafeceb4e18466b8e5b31d9"
+version = "54.1.0"
+source = "git+https://github.com/apache/datafusion.git?rev=e08aed1e5de41dcf81d529140dae07723b942a5e#e08aed1e5de41dcf81d529140dae07723b942a5e"
 dependencies = [
 "arrow",
 "bigdecimal",
@@ -3695,7 +3664,7 @@ checksum = "9ed9a281f7bc9b7576e61468ba615a66a5c8cfdff42420a70aa82701a3b1e292"
 dependencies = [
 "block-buffer 0.10.4",
 "const-oid 0.9.6",
- "crypto-common 0.1.6",
+ "crypto-common 0.1.7",
 "subtle",
 ]

@@ -3795,7 +3764,7 @@ checksum = "d0881ea181b1df73ff77ffaaf9c7544ecc11e82fba9b5f27b262a3c73a332555"

 [[package]]
 name = "e2e_test"
-version = "1.0.0-rc.3"
+version = "1.0.0-rc.2"
 dependencies = [
 "anyhow",
 "astral-tokio-tar",
@@ -3955,7 +3924,7 @@ dependencies = [
 "crypto-bigint 0.5.5",
 "digest 0.10.7",
 "ff 0.13.1",
- "generic-array 0.14.9",
+ "generic-array 0.14.7",
 "group 0.13.0",
 "hkdf 0.12.4",
 "pem-rfc7468 0.7.0",
@@ -4400,9 +4369,9 @@ dependencies = [

 [[package]]
 name = "generic-array"
-version = "0.14.9"
+version = "0.14.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4bb6743198531e02858aeaea5398fcc883e71851fcbcb5a2f773e2fb6cb1edf2"
+checksum = "85649ca51fd72272d7821adaf274ad91c288277713d9c18820d8499a7ff69e9a"
 dependencies = [
 "typenum",
 "version_check",
@@ -4415,7 +4384,7 @@ version = "1.4.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "337d46834ee672ab3e48caca2cb0c78cc174fb12b3a68d0d88f99a0519a5e36e"
 dependencies = [
- "generic-array 0.14.9",
+ "generic-array 0.14.7",
 "rustversion",
 "typenum",
 ]
@@ -4757,9 +4726,9 @@ dependencies = [

 [[package]]
 name = "h2"
-version = "0.4.18"
+version = "0.4.16"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "839c0e8a181239723652be9062bb56ca5bf5f64011f73b623f6f4fc59086a228"
+checksum = "a9f37a958b41b3b19ee2707c06439c0e9e547e847223eb791ecb0cb821c65e27"
 dependencies = [
 "atomic-waker",
 "bytes",
@@ -5449,7 +5418,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "879f10e63c20629ecabbb64a8010319738c66a5cd0c29b02d63d272b03751d01"
 dependencies = [
 "block-padding 0.3.3",
- "generic-array 0.14.9",
+ "generic-array 0.14.7",
 ]

 [[package]]
@@ -8659,18 +8628,18 @@ dependencies = [

 [[package]]
 name = "ref-cast"
-version = "1.0.27"
+version = "1.0.26"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7e440fb4e4b4147295338efb76001ab9e4efc0e5839df2c47fc5ac2381d365c3"
+checksum = "216e8f773d7923bcba9ceb86a86c93cabb3903a11872fc3f138c49630e50b96d"
 dependencies = [
 "ref-cast-impl",
 ]

 [[package]]
 name = "ref-cast-impl"
-version = "1.0.27"
+version = "1.0.26"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "92ecd8964f8453721699a1ed72037b0db49ce2f5a5138486ee89bed6f67cdf3a"
+checksum = "2c9283685feec7d69af75fb0e858d5e7378f33fe4fc699383b2916ab9273e03c"
 dependencies = [
 "proc-macro2",
 "quote",
@@ -9125,7 +9094,7 @@ dependencies = [

 [[package]]
 name = "rustfs"
-version = "1.0.0-rc.3"
+version = "1.0.0-rc.2"
 dependencies = [
 "aes-gcm",
 "anyhow",
@@ -9173,7 +9142,6 @@ dependencies = [
 "mime_guess",
 "opentelemetry",
 "opentelemetry_sdk",
- "p256 0.13.2",
 "parking_lot",
 "percent-encoding",
 "pin-project-lite",
@@ -9264,7 +9232,7 @@ dependencies = [

 [[package]]
 name = "rustfs-audit"
-version = "1.0.0-rc.3"
+version = "1.0.0-rc.2"
 dependencies = [
 "async-trait",
 "const-str",
@@ -9287,7 +9255,7 @@ dependencies = [

 [[package]]
 name = "rustfs-checksums"
-version = "1.0.0-rc.3"
+version = "1.0.0-rc.2"
 dependencies = [
 "base64-simd",
 "bytes",
@@ -9303,13 +9271,14 @@ dependencies = [

 [[package]]
 name = "rustfs-common"
-version = "1.0.0-rc.3"
+version = "1.0.0-rc.2"
 dependencies = [
 "chrono",
 "hotpath",
 "jiff",
 "metrics",
 "rmp-serde",
+ "s3s",
 "serde",
 "serde_json",
 "smallvec",
@@ -9321,7 +9290,7 @@ dependencies = [

 [[package]]
 name = "rustfs-concurrency"
-version = "1.0.0-rc.3"
+version = "1.0.0-rc.2"
 dependencies = [
 "hotpath",
 "insta",
@@ -9334,7 +9303,7 @@ dependencies = [

 [[package]]
 name = "rustfs-config"
-version = "1.0.0-rc.3"
+version = "1.0.0-rc.2"
 dependencies = [
 "const-str",
 "hotpath",
@@ -9344,7 +9313,7 @@ dependencies = [

 [[package]]
 name = "rustfs-credentials"
-version = "1.0.0-rc.3"
+version = "1.0.0-rc.2"
 dependencies = [
 "base64-simd",
 "hmac 0.13.0",
@@ -9358,7 +9327,7 @@ dependencies = [

 [[package]]
 name = "rustfs-crypto"
-version = "1.0.0-rc.3"
+version = "1.0.0-rc.2"
 dependencies = [
 "aes-gcm",
 "argon2",
@@ -9379,7 +9348,7 @@ dependencies = [

 [[package]]
 name = "rustfs-data-usage"
-version = "1.0.0-rc.3"
+version = "1.0.0-rc.2"
 dependencies = [
 "hotpath",
 "rmp-serde",
@@ -9389,12 +9358,13 @@ dependencies = [

 [[package]]
 name = "rustfs-ecstore"
-version = "1.0.0-rc.3"
+version = "1.0.0-rc.2"
 dependencies = [
 "arc-swap",
 "async-channel",
 "async-recursion",
 "async-trait",
+ "aws-config",
 "aws-credential-types",
 "aws-sdk-s3",
 "aws-smithy-http-client",
@@ -9432,7 +9402,6 @@ dependencies = [
 "md-5 0.11.0",
 "memmap2",
 "metrics",
- "metrics-util",
 "moka",
 "num_cpus",
 "opentelemetry",
@@ -9529,7 +9498,7 @@ dependencies = [

 [[package]]
 name = "rustfs-extension-schema"
-version = "1.0.0-rc.3"
+version = "1.0.0-rc.2"
 dependencies = [
 "hotpath",
 "serde",
@@ -9539,7 +9508,7 @@ dependencies = [

 [[package]]
 name = "rustfs-filemeta"
-version = "1.0.0-rc.3"
+version = "1.0.0-rc.2"
 dependencies = [
 "arc-swap",
 "byteorder",
@@ -9566,7 +9535,7 @@ dependencies = [

 [[package]]
 name = "rustfs-heal"
-version = "1.0.0-rc.3"
+version = "1.0.0-rc.2"
 dependencies = [
 "async-trait",
 "base64 0.23.1",
@@ -9599,7 +9568,7 @@ dependencies = [

 [[package]]
 name = "rustfs-iam"
-version = "1.0.0-rc.3"
+version = "1.0.0-rc.2"
 dependencies = [
 "arc-swap",
 "async-trait",
@@ -9640,7 +9609,7 @@ dependencies = [

 [[package]]
 name = "rustfs-io-core"
-version = "1.0.0-rc.3"
+version = "1.0.0-rc.2"
 dependencies = [
 "bytes",
 "hotpath",
@@ -9652,7 +9621,7 @@ dependencies = [

 [[package]]
 name = "rustfs-io-metrics"
-version = "1.0.0-rc.3"
+version = "1.0.0-rc.2"
 dependencies = [
 "criterion",
 "hotpath",
@@ -9716,7 +9685,7 @@ dependencies = [

 [[package]]
 name = "rustfs-keystone"
-version = "1.0.0-rc.3"
+version = "1.0.0-rc.2"
 dependencies = [
 "bytes",
 "futures",
@@ -9743,7 +9712,7 @@ dependencies = [

 [[package]]
 name = "rustfs-kms"
-version = "1.0.0-rc.3"
+version = "1.0.0-rc.2"
 dependencies = [
 "aes-gcm",
 "anyhow",
@@ -9792,7 +9761,7 @@ dependencies = [

 [[package]]
 name = "rustfs-lifecycle"
-version = "1.0.0-rc.3"
+version = "1.0.0-rc.2"
 dependencies = [
 "async-trait",
 "hotpath",
@@ -9815,7 +9784,7 @@ dependencies = [

 [[package]]
 name = "rustfs-lock"
-version = "1.0.0-rc.3"
+version = "1.0.0-rc.2"
 dependencies = [
 "async-trait",
 "compact_str",
@@ -9838,7 +9807,7 @@ dependencies = [

 [[package]]
 name = "rustfs-log-analyzer"
-version = "1.0.0-rc.3"
+version = "1.0.0-rc.2"
 dependencies = [
 "chrono",
 "flate2",
@@ -9857,7 +9826,7 @@ dependencies = [

 [[package]]
 name = "rustfs-madmin"
-version = "1.0.0-rc.3"
+version = "1.0.0-rc.2"
 dependencies = [
 "hotpath",
 "http 1.5.0",
@@ -9877,7 +9846,7 @@ dependencies = [

 [[package]]
 name = "rustfs-notify"
-version = "1.0.0-rc.3"
+version = "1.0.0-rc.2"
 dependencies = [
 "arc-swap",
 "async-trait",
@@ -9912,7 +9881,7 @@ dependencies = [

 [[package]]
 name = "rustfs-object-capacity"
-version = "1.0.0-rc.3"
+version = "1.0.0-rc.2"
 dependencies = [
 "criterion",
 "futures",
@@ -9932,7 +9901,7 @@ dependencies = [

 [[package]]
 name = "rustfs-object-data-cache"
-version = "1.0.0-rc.3"
+version = "1.0.0-rc.2"
 dependencies = [
 "bytes",
 "criterion",
@@ -9949,7 +9918,7 @@ dependencies = [

 [[package]]
 name = "rustfs-obs"
-version = "1.0.0-rc.3"
+version = "1.0.0-rc.2"
 dependencies = [
 "chrono",
 "crossbeam-channel",
@@ -9964,7 +9933,6 @@ dependencies = [
 "libc",
 "log",
 "metrics",
- "metrics-util",
 "num_cpus",
 "nvml-wrapper",
 "opentelemetry",
@@ -10005,7 +9973,7 @@ dependencies = [

 [[package]]
 name = "rustfs-policy"
-version = "1.0.0-rc.3"
+version = "1.0.0-rc.2"
 dependencies = [
 "async-trait",
 "base64-simd",
@@ -10036,7 +10004,7 @@ dependencies = [

 [[package]]
 name = "rustfs-protocols"
-version = "1.0.0-rc.3"
+version = "1.0.0-rc.2"
 dependencies = [
 "astral-tokio-tar",
 "async-compression",
@@ -10098,7 +10066,7 @@ dependencies = [

 [[package]]
 name = "rustfs-protos"
-version = "1.0.0-rc.3"
+version = "1.0.0-rc.2"
 dependencies = [
 "flatbuffers",
 "hotpath",
@@ -10122,7 +10090,7 @@ dependencies = [

 [[package]]
 name = "rustfs-replication"
-version = "1.0.0-rc.3"
+version = "1.0.0-rc.2"
 dependencies = [
 "byteorder",
 "bytes",
@@ -10140,7 +10108,7 @@ dependencies = [

 [[package]]
 name = "rustfs-rio"
-version = "1.0.0-rc.3"
+version = "1.0.0-rc.2"
 dependencies = [
 "aes-gcm",
 "arc-swap",
@@ -10178,7 +10146,7 @@ dependencies = [

 [[package]]
 name = "rustfs-rio-v2"
-version = "1.0.0-rc.3"
+version = "1.0.0-rc.2"
 dependencies = [
 "aes-gcm",
 "bytes",
@@ -10201,7 +10169,7 @@ dependencies = [

 [[package]]
 name = "rustfs-s3-ops"
-version = "1.0.0-rc.3"
+version = "1.0.0-rc.2"
 dependencies = [
 "hotpath",
 "rustfs-s3-types",
@@ -10209,7 +10177,7 @@ dependencies = [

 [[package]]
 name = "rustfs-s3-types"
-version = "1.0.0-rc.3"
+version = "1.0.0-rc.2"
 dependencies = [
 "hotpath",
 "serde",
@@ -10218,7 +10186,7 @@ dependencies = [

 [[package]]
 name = "rustfs-s3select-api"
-version = "1.0.0-rc.3"
+version = "1.0.0-rc.2"
 dependencies = [
 "async-trait",
 "bytes",
@@ -10248,7 +10216,7 @@ dependencies = [

 [[package]]
 name = "rustfs-s3select-query"
-version = "1.0.0-rc.3"
+version = "1.0.0-rc.2"
 dependencies = [
 "async-recursion",
 "async-trait",
@@ -10267,7 +10235,7 @@ dependencies = [

 [[package]]
 name = "rustfs-scanner"
-version = "1.0.0-rc.3"
+version = "1.0.0-rc.2"
 dependencies = [
 "async-trait",
 "bytes",
@@ -10308,7 +10276,7 @@ dependencies = [

 [[package]]
 name = "rustfs-security-governance"
-version = "1.0.0-rc.3"
+version = "1.0.0-rc.2"
 dependencies = [
 "hotpath",
 "thiserror 2.0.20",
@@ -10316,7 +10284,7 @@ dependencies = [

 [[package]]
 name = "rustfs-signer"
-version = "1.0.0-rc.3"
+version = "1.0.0-rc.2"
 dependencies = [
 "base64-simd",
 "bytes",
@@ -10334,7 +10302,7 @@ dependencies = [

 [[package]]
 name = "rustfs-storage-api"
-version = "1.0.0-rc.3"
+version = "1.0.0-rc.2"
 dependencies = [
 "async-trait",
 "hotpath",
@@ -10349,7 +10317,7 @@ dependencies = [

 [[package]]
 name = "rustfs-targets"
-version = "1.0.0-rc.3"
+version = "1.0.0-rc.2"
 dependencies = [
 "arc-swap",
 "async-nats",
@@ -10403,7 +10371,7 @@ dependencies = [

 [[package]]
 name = "rustfs-test-utils"
-version = "1.0.0-rc.3"
+version = "1.0.0-rc.2"
 dependencies = [
 "hotpath",
 "rustfs-data-usage",
@@ -10419,7 +10387,7 @@ dependencies = [

 [[package]]
 name = "rustfs-tls-runtime"
-version = "1.0.0-rc.3"
+version = "1.0.0-rc.2"
 dependencies = [
 "arc-swap",
 "hotpath",
@@ -10440,7 +10408,7 @@ dependencies = [

 [[package]]
 name = "rustfs-trusted-proxies"
-version = "1.0.0-rc.3"
+version = "1.0.0-rc.2"
 dependencies = [
 "async-trait",
 "axum",
@@ -10477,7 +10445,7 @@ dependencies = [

 [[package]]
 name = "rustfs-utils"
-version = "1.0.0-rc.3"
+version = "1.0.0-rc.2"
 dependencies = [
 "base64-simd",
 "blake2",
@@ -10519,7 +10487,7 @@ dependencies = [

 [[package]]
 name = "rustfs-zip"
-version = "1.0.0-rc.3"
+version = "1.0.0-rc.2"
 dependencies = [
 "async-compression",
 "hotpath",
@@ -10709,8 +10677,8 @@ checksum = "9774ba4a74de5f7b1c1451ed6cd5285a32eddb5cccb8cc655a4e50009e06477f"

 [[package]]
 name = "s3s"
-version = "0.15.0-alpha.1"
-source = "git+https://github.com/rustfs/s3s.git?rev=ed70cb048cc4be168419d461cb9ac3c2c7fa6d5a#ed70cb048cc4be168419d461cb9ac3c2c7fa6d5a"
+version = "0.14.1"
+source = "git+https://github.com/rustfs/s3s.git?rev=d358a68783096df1db0c3e314127f2704603b29e#d358a68783096df1db0c3e314127f2704603b29e"
 dependencies = [
 "arc-swap",
 "arrayvec",
@@ -10864,7 +10832,7 @@ checksum = "d3e97a565f76233a6003f9f5c54be1d9c5bdfa3eccfb189469f11ec4901c47dc"
 dependencies = [
 "base16ct 0.2.0",
 "der 0.7.10",
- "generic-array 0.14.9",
+ "generic-array 0.14.7",
 "pkcs8 0.10.2",
 "subtle",
 "zeroize",
@@ -11649,9 +11617,9 @@ checksum = "13c2bddecc57b384dee18652358fb23172facb8a2c51ccc10d74c157bdea3292"

 [[package]]
 name = "suppaftp"
-version = "10.0.2"
+version = "10.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "821001051ea3d12a60fb790b8c7cb9a6f5f8698dcfdca4cd533a025fefb0b5b8"
+checksum = "9c890e698eaf58526b6e7105d74c5d91ebe76a4da1faac2e20ff10e8e5c8bcff"
 dependencies = [
 "async-trait",
 "chrono",
@@ -11842,7 +11810,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "32497e9a4c7b38532efcdebeef879707aa9f794296a4f0244f6f69e9bc8574bd"
 dependencies = [
 "fastrand",
- "getrandom 0.4.3",
+ "getrandom 0.3.4",
 "once_cell",
 "rustix",
 "windows-sys 0.61.2",
@@ -13392,9 +13360,9 @@ dependencies = [

 [[package]]
 name = "zerovec"
-version = "0.11.8"
+version = "0.11.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bb0464e17806c1d976d5cba29399c7f08e516e279e2ba493f63123b5fca67dd8"
+checksum = "94b5c6b5976d66c1d703c4fd17d3f5e43c8cedaacf604961b171adc7130896d8"
 dependencies = [
 "yoke",
 "zerofrom",
@@ -69,7 +69,7 @@ edition = "2024"
 license = "Apache-2.0"
 repository = "https://github.com/rustfs/rustfs"
 rust-version = "1.97.1"
-version = "1.0.0-rc.3"
+version = "1.0.0-rc.2"
 homepage = "https://rustfs.com"
 description = "RustFS is a high-performance distributed object storage software built using Rust, one of the most popular languages worldwide. "
 keywords = ["RustFS", "Minio", "object-storage", "filesystem", "s3"]
@@ -86,52 +86,52 @@ redundant_clone = "warn"

 [workspace.dependencies]
 # RustFS Internal Crates
-rustfs = { path = "./rustfs", version = "1.0.0-rc.3" }
-rustfs-heal = { path = "crates/heal", version = "1.0.0-rc.3" }
-rustfs-audit = { path = "crates/audit", version = "1.0.0-rc.3" }
-rustfs-checksums = { path = "crates/checksums", version = "1.0.0-rc.3" }
-rustfs-common = { path = "crates/common", version = "1.0.0-rc.3" }
-rustfs-data-usage = { path = "crates/data-usage", version = "1.0.0-rc.3" }
-rustfs-config = { path = "./crates/config", version = "1.0.0-rc.3" }
-rustfs-concurrency = { path = "./crates/concurrency", version = "1.0.0-rc.3" }
-rustfs-credentials = { path = "crates/credentials", version = "1.0.0-rc.3" }
-rustfs-crypto = { path = "crates/crypto", version = "1.0.0-rc.3" }
-rustfs-ecstore = { path = "crates/ecstore", version = "1.0.0-rc.3" }
-rustfs-filemeta = { path = "crates/filemeta", version = "1.0.0-rc.3" }
-rustfs-iam = { path = "crates/iam", version = "1.0.0-rc.3" }
-rustfs-keystone = { path = "crates/keystone", version = "1.0.0-rc.3" }
-rustfs-lifecycle = { path = "crates/lifecycle", version = "1.0.0-rc.3" }
-rustfs-kms = { path = "crates/kms", version = "1.0.0-rc.3" }
-rustfs-lock = { path = "crates/lock", version = "1.0.0-rc.3" }
-rustfs-madmin = { path = "crates/madmin", version = "1.0.0-rc.3" }
-rustfs-notify = { path = "crates/notify", version = "1.0.0-rc.3" }
-rustfs-io-metrics = { path = "crates/io-metrics", version = "1.0.0-rc.3" }
-rustfs-io-core = { path = "crates/io-core", version = "1.0.0-rc.3" }
-rustfs-object-capacity = { path = "crates/object-capacity", version = "1.0.0-rc.3" }
-rustfs-object-data-cache = { path = "crates/object-data-cache", version = "1.0.0-rc.3", default-features = false }
-rustfs-log-analyzer = { path = "crates/log-analyzer", version = "1.0.0-rc.3" }
-rustfs-obs = { path = "crates/obs", version = "1.0.0-rc.3" }
-rustfs-policy = { path = "crates/policy", version = "1.0.0-rc.3" }
-rustfs-protos = { path = "crates/protos", version = "1.0.0-rc.3" }
-rustfs-protocols = { path = "crates/protocols", version = "1.0.0-rc.3" }
-rustfs-replication = { path = "crates/replication", version = "1.0.0-rc.3" }
-rustfs-rio = { path = "crates/rio", version = "1.0.0-rc.3" }
-rustfs-rio-v2 = { path = "crates/rio-v2", version = "1.0.0-rc.3" }
-rustfs-s3-types = { path = "crates/s3-types", version = "1.0.0-rc.3" }
-rustfs-s3-ops = { path = "crates/s3-ops", version = "1.0.0-rc.3" }
-rustfs-s3select-api = { path = "crates/s3select-api", version = "1.0.0-rc.3" }
-rustfs-s3select-query = { path = "crates/s3select-query", version = "1.0.0-rc.3" }
-rustfs-scanner = { path = "crates/scanner", version = "1.0.0-rc.3" }
-rustfs-security-governance = { path = "crates/security-governance", version = "1.0.0-rc.3" }
-rustfs-extension-schema = { path = "crates/extension-schema", version = "1.0.0-rc.3" }
-rustfs-signer = { path = "crates/signer", version = "1.0.0-rc.3" }
-rustfs-storage-api = { path = "crates/storage-api", version = "1.0.0-rc.3" }
-rustfs-trusted-proxies = { path = "crates/trusted-proxies", version = "1.0.0-rc.3" }
-rustfs-targets = { path = "crates/targets", version = "1.0.0-rc.3" }
-rustfs-test-utils = { path = "crates/test-utils", version = "1.0.0-rc.3" }
-rustfs-tls-runtime = { path = "crates/tls-runtime", version = "1.0.0-rc.3" }
-rustfs-utils = { path = "crates/utils", version = "1.0.0-rc.3" }
-rustfs-zip = { path = "./crates/zip", version = "1.0.0-rc.3" }
+rustfs = { path = "./rustfs", version = "1.0.0-rc.2" }
+rustfs-heal = { path = "crates/heal", version = "1.0.0-rc.2" }
+rustfs-audit = { path = "crates/audit", version = "1.0.0-rc.2" }
+rustfs-checksums = { path = "crates/checksums", version = "1.0.0-rc.2" }
+rustfs-common = { path = "crates/common", version = "1.0.0-rc.2" }
+rustfs-data-usage = { path = "crates/data-usage", version = "1.0.0-rc.2" }
+rustfs-config = { path = "./crates/config", version = "1.0.0-rc.2" }
+rustfs-concurrency = { path = "./crates/concurrency", version = "1.0.0-rc.2" }
+rustfs-credentials = { path = "crates/credentials", version = "1.0.0-rc.2" }
+rustfs-crypto = { path = "crates/crypto", version = "1.0.0-rc.2" }
+rustfs-ecstore = { path = "crates/ecstore", version = "1.0.0-rc.2" }
+rustfs-filemeta = { path = "crates/filemeta", version = "1.0.0-rc.2" }
+rustfs-iam = { path = "crates/iam", version = "1.0.0-rc.2" }
+rustfs-keystone = { path = "crates/keystone", version = "1.0.0-rc.2" }
+rustfs-lifecycle = { path = "crates/lifecycle", version = "1.0.0-rc.2" }
+rustfs-kms = { path = "crates/kms", version = "1.0.0-rc.2" }
+rustfs-lock = { path = "crates/lock", version = "1.0.0-rc.2" }
+rustfs-madmin = { path = "crates/madmin", version = "1.0.0-rc.2" }
+rustfs-notify = { path = "crates/notify", version = "1.0.0-rc.2" }
+rustfs-io-metrics = { path = "crates/io-metrics", version = "1.0.0-rc.2" }
+rustfs-io-core = { path = "crates/io-core", version = "1.0.0-rc.2" }
+rustfs-object-capacity = { path = "crates/object-capacity", version = "1.0.0-rc.2" }
+rustfs-object-data-cache = { path = "crates/object-data-cache", version = "1.0.0-rc.2", default-features = false }
+rustfs-log-analyzer = { path = "crates/log-analyzer", version = "1.0.0-rc.2" }
+rustfs-obs = { path = "crates/obs", version = "1.0.0-rc.2" }
+rustfs-policy = { path = "crates/policy", version = "1.0.0-rc.2" }
+rustfs-protos = { path = "crates/protos", version = "1.0.0-rc.2" }
+rustfs-protocols = { path = "crates/protocols", version = "1.0.0-rc.2" }
+rustfs-replication = { path = "crates/replication", version = "1.0.0-rc.2" }
+rustfs-rio = { path = "crates/rio", version = "1.0.0-rc.2" }
+rustfs-rio-v2 = { path = "crates/rio-v2", version = "1.0.0-rc.2" }
+rustfs-s3-types = { path = "crates/s3-types", version = "1.0.0-rc.2" }
+rustfs-s3-ops = { path = "crates/s3-ops", version = "1.0.0-rc.2" }
+rustfs-s3select-api = { path = "crates/s3select-api", version = "1.0.0-rc.2" }
+rustfs-s3select-query = { path = "crates/s3select-query", version = "1.0.0-rc.2" }
+rustfs-scanner = { path = "crates/scanner", version = "1.0.0-rc.2" }
+rustfs-security-governance = { path = "crates/security-governance", version = "1.0.0-rc.2" }
+rustfs-extension-schema = { path = "crates/extension-schema", version = "1.0.0-rc.2" }
+rustfs-signer = { path = "crates/signer", version = "1.0.0-rc.2" }
+rustfs-storage-api = { path = "crates/storage-api", version = "1.0.0-rc.2" }
+rustfs-trusted-proxies = { path = "crates/trusted-proxies", version = "1.0.0-rc.2" }
+rustfs-targets = { path = "crates/targets", version = "1.0.0-rc.2" }
+rustfs-test-utils = { path = "crates/test-utils", version = "1.0.0-rc.2" }
+rustfs-tls-runtime = { path = "crates/tls-runtime", version = "1.0.0-rc.2" }
+rustfs-utils = { path = "crates/utils", version = "1.0.0-rc.2" }
+rustfs-zip = { path = "./crates/zip", version = "1.0.0-rc.2" }

 # Async Runtime and Networking
 async-channel = "2.5.0"
@@ -231,8 +231,8 @@ aws-credential-types = { version = "1.3.0" }
 aws-sdk-kms = { default-features = false, version = "1.115.0" }
 aws-sdk-s3 = { default-features = false, version = "1.142.0" }
 aws-sdk-sts = { default-features = false, version = "1.111.0" }
-aws-smithy-http-client = { default-features = false, version = "1.4.0" }
-aws-smithy-runtime-api = { version = "1.15.0" }
+aws-smithy-http-client = { default-features = false, version = "1.3.0" }
+aws-smithy-runtime-api = { version = "1.14.0" }
 aws-smithy-types = { version = "1.6.2" }
 base64 = "0.23.1"
 base64-simd = "0.8.0"
@@ -245,7 +245,8 @@ crossbeam-queue = "0.3.13"
 crossbeam-channel = "0.5.16"
 crossbeam-deque = "0.8.7"
 crossbeam-utils = "0.8.22"
-datafusion = { default-features = false, version = "55.0.0" }
+datafusion = { default-features = false, git = "https://github.com/apache/datafusion.git", rev = "e08aed1e5de41dcf81d529140dae07723b942a5e" }
+#datafusion = { default-features = false, version = "54.1.0" }
 derive_builder = "0.20.2"
 enumset = "1.1.14"
 faster-hex = "0.10.0"
@@ -263,7 +264,6 @@ lazy_static = "1.5.0"
 libc = "0.2.189"
 libsystemd = "0.7.2"
 local-ip-address = "0.6.13"
-log = "0.4"
 memmap2 = "0.9.11"
 lz4 = "1.28.1"
 matchit = "0.9.2"
@@ -290,7 +290,7 @@ rustify = { version = "0.7", default-features = false }
 rustix = { version = "1.1.4" }
 rust-embed = { version = "8.12.0" }
 rustc-hash = { version = "2.1.3" }
-s3s = { git = "https://github.com/rustfs/s3s.git", rev = "ed70cb048cc4be168419d461cb9ac3c2c7fa6d5a" }
+s3s = { git = "https://github.com/rustfs/s3s.git", rev = "d358a68783096df1db0c3e314127f2704603b29e" }
 serial_test = "4.0.1"
 shadow-rs = { default-features = false, version = "2.0.0" }
 siphasher = "1.0.3"
@@ -326,7 +326,6 @@ zstd = "0.13.3"

 # Observability and Metrics
 metrics = "0.24.6"
-metrics-util = "0.20"
 dial9-tokio-telemetry = "0.3"
 opentelemetry = { version = "0.32.0" }
 opentelemetry-appender-tracing = { version = "0.32.0" }
@@ -340,7 +339,7 @@ pyroscope = { version = "2.1.1" }
 # FTP and SFTP
 libunftp = { version = "0.23.0" }
 unftp-core = "0.1.0"
-suppaftp = { version = "10.0.2" }
+suppaftp = { version = "10.0.1" }
 rcgen = { version = "0.14.9", default-features = false, features = ["aws_lc_rs", "crypto", "pem"] }
 russh = { version = "0.62.7" }
 russh-sftp = "2.4.0"
@@ -116,7 +116,7 @@ chown -R 10001:10001 data logs
 docker run -d -p 9000:9000 -p 9001:9001 -v $(pwd)/data:/data -v $(pwd)/logs:/logs rustfs/rustfs:latest

 # Using specific version
-docker run -d -p 9000:9000 -p 9001:9001 -v $(pwd)/data:/data -v $(pwd)/logs:/logs rustfs/rustfs:1.0.0-rc.3
+docker run -d -p 9000:9000 -p 9001:9001 -v $(pwd)/data:/data -v $(pwd)/logs:/logs rustfs/rustfs:1.0.0-rc.2
 ```

 If you use [podman](https://github.com/containers/podman) instead of docker, you can install the RustFS with the below command
@@ -113,7 +113,7 @@ chown -R 10001:10001 data logs
 docker run -d -p 9000:9000 -p 9001:9001 -v $(pwd)/data:/data -v $(pwd)/logs:/logs rustfs/rustfs:latest

 # 使用指定版本运行
-docker run -d -p 9000:9000 -p 9001:9001 -v $(pwd)/data:/data -v $(pwd)/logs:/logs rustfs/rustfs:1.0.0-rc.3
+docker run -d -p 9000:9000 -p 9001:9001 -v $(pwd)/data:/data -v $(pwd)/logs:/logs rustfs/rustfs:1.0.0-rc.2
 ```

 如果您通过绑定挂载启用 TLS 证书目录，也请用同样方式准备该目录：
@@ -236,19 +236,12 @@ async fn audit_pipeline_reports_empty_runtime_snapshots() {
 }

 #[tokio::test]
-async fn stopping_audit_replay_workers_is_a_no_op_when_there_are_none() {
+async fn audit_runtime_facade_stops_empty_replay_workers() {
    let registry = Arc::new(Mutex::new(AuditRegistry::new()));
    let replay_workers = Arc::new(RwLock::new(rustfs_targets::ReplayWorkerManager::new()));
-    let facade = AuditRuntimeFacade::new(registry, Arc::clone(&replay_workers));
+    let facade = AuditRuntimeFacade::new(registry, replay_workers);

    facade.stop_replay_workers().await;
-
-    // The stop path takes the manager's workers and hands them to the adapter,
-    // so an empty facade must leave it empty rather than wedge it, and a second
-    // call — which shutdown paths make — must stay harmless (rustfs/backlog#1836).
-    assert!(replay_workers.read().await.is_empty());
-    facade.stop_replay_workers().await;
-    assert!(replay_workers.read().await.is_empty());
 }

 #[tokio::test]
@@ -44,6 +44,7 @@ metrics = { workspace = true }
 serde = { workspace = true, features = ["derive"] }
 smallvec = { workspace = true }
 rmp-serde = { workspace = true }
+s3s = { workspace = true, features = ["minio"] }
 tracing = { workspace = true }

 [dev-dependencies]
@@ -12,6 +12,7 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.

+use s3s::dto::{BucketLifecycleConfiguration, ExpirationStatus, LifecycleRule, ReplicationConfiguration, ReplicationRuleStatus};
 use serde::{Deserialize, Serialize};
 use std::{
    fmt::{self, Display},
@@ -632,6 +633,104 @@ pub fn create_heal_response(
    }
 }

+fn lc_get_prefix(rule: &LifecycleRule) -> String {
+    if let Some(p) = &rule.prefix {
+        return p.to_string();
+    } else if let Some(filter) = &rule.filter {
+        if let Some(p) = &filter.prefix {
+            return p.to_string();
+        } else if let Some(and) = &filter.and
+            && let Some(p) = &and.prefix
+        {
+            return p.to_string();
+        }
+    }
+
+    "".into()
+}
+
+pub fn lc_has_active_rules(config: &BucketLifecycleConfiguration, prefix: &str) -> bool {
+    if config.rules.is_empty() {
+        return false;
+    }
+
+    for rule in config.rules.iter() {
+        if rule.status == ExpirationStatus::from_static(ExpirationStatus::DISABLED) {
+            continue;
+        }
+        let rule_prefix = lc_get_prefix(rule);
+        if !prefix.is_empty() && !rule_prefix.is_empty() && !prefix.starts_with(&rule_prefix) && !rule_prefix.starts_with(prefix)
+        {
+            continue;
+        }
+
+        if let Some(e) = &rule.noncurrent_version_expiration {
+            if e.noncurrent_days.is_some() {
+                return true;
+            }
+            if let Some(true) = e.newer_noncurrent_versions.map(|d| d > 0) {
+                return true;
+            }
+        }
+
+        if rule.noncurrent_version_transitions.is_some() {
+            return true;
+        }
+        if let Some(true) = rule.expiration.as_ref().map(|e| e.date.is_some()) {
+            return true;
+        }
+
+        if let Some(true) = rule.expiration.as_ref().map(|e| e.days.is_some()) {
+            return true;
+        }
+
+        if let Some(Some(true)) = rule.expiration.as_ref().map(|e| e.expired_object_delete_marker) {
+            return true;
+        }
+
+        if let Some(true) = rule.transitions.as_ref().map(|t| !t.is_empty()) {
+            return true;
+        }
+
+        if rule.transitions.is_some() {
+            return true;
+        }
+    }
+    false
+}
+
+pub fn rep_has_active_rules(config: &ReplicationConfiguration, prefix: &str, recursive: bool) -> bool {
+    if config.rules.is_empty() {
+        return false;
+    }
+
+    for rule in config.rules.iter() {
+        if rule
+            .status
+            .eq(&ReplicationRuleStatus::from_static(ReplicationRuleStatus::DISABLED))
+        {
+            continue;
+        }
+        if !prefix.is_empty()
+            && let Some(filter) = &rule.filter
+            && let Some(r_prefix) = &filter.prefix
+            && !r_prefix.is_empty()
+        {
+            // incoming prefix must be in rule prefix
+            if !recursive && !prefix.starts_with(r_prefix) {
+                continue;
+            }
+            // If recursive, we can skip this rule if it doesn't match the tested prefix or level below prefix
+            // does not match
+            if recursive && !r_prefix.starts_with(prefix) && !prefix.starts_with(r_prefix) {
+                continue;
+            }
+        }
+        return true;
+    }
+    false
+}
+
 pub async fn send_heal_disk(set_disk_id: String, priority: Option<HealChannelPriority>) -> Result<(), String> {
    let req = HealChannelRequest {
        id: Uuid::new_v4().to_string(),
@@ -13,6 +13,82 @@
 // limitations under the License.

 use std::time::{Duration, SystemTime, UNIX_EPOCH};
+
+#[allow(dead_code)]
+#[derive(Debug, Default)]
+struct TimedAction {
+    count: u64,
+    acc_time: u64,
+    min_time: Option<u64>,
+    max_time: Option<u64>,
+    bytes: u64,
+}
+
+#[allow(dead_code)]
+impl TimedAction {
+    // Avg returns the average time spent on the action.
+    pub fn avg(&self) -> Option<Duration> {
+        if self.count == 0 {
+            return None;
+        }
+        Some(Duration::from_nanos(self.acc_time / self.count))
+    }
+
+    // AvgBytes returns the average bytes processed.
+    pub fn avg_bytes(&self) -> u64 {
+        if self.count == 0 {
+            return 0;
+        }
+        self.bytes / self.count
+    }
+
+    // Merge other into t.
+    pub fn merge(&mut self, other: TimedAction) {
+        self.count += other.count;
+        self.acc_time += other.acc_time;
+        self.bytes += other.bytes;
+
+        if self.count == 0 {
+            self.min_time = other.min_time;
+        }
+        if let Some(other_min) = other.min_time {
+            self.min_time = self.min_time.map_or(Some(other_min), |min| Some(min.min(other_min)));
+        }
+
+        self.max_time = self
+            .max_time
+            .map_or(other.max_time, |max| Some(max.max(other.max_time.unwrap_or(0))));
+    }
+}
+
+#[allow(dead_code)]
+#[derive(Debug)]
+enum SizeCategory {
+    SizeLessThan1KiB = 0,
+    SizeLessThan1MiB,
+    SizeLessThan10MiB,
+    SizeLessThan100MiB,
+    SizeLessThan1GiB,
+    SizeGreaterThan1GiB,
+    // Add new entries here
+    SizeLastElemMarker,
+}
+
+impl std::fmt::Display for SizeCategory {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        let s = match *self {
+            SizeCategory::SizeLessThan1KiB => "SizeLessThan1KiB",
+            SizeCategory::SizeLessThan1MiB => "SizeLessThan1MiB",
+            SizeCategory::SizeLessThan10MiB => "SizeLessThan10MiB",
+            SizeCategory::SizeLessThan100MiB => "SizeLessThan100MiB",
+            SizeCategory::SizeLessThan1GiB => "SizeLessThan1GiB",
+            SizeCategory::SizeGreaterThan1GiB => "SizeGreaterThan1GiB",
+            SizeCategory::SizeLastElemMarker => "SizeLastElemMarker",
+        };
+        write!(f, "{s}")
+    }
+}
+
 #[derive(Clone, Debug, Default, Copy)]
 pub struct AccElem {
    pub total: u64,
@@ -729,7 +729,7 @@ fn timestamp_elapsed_seconds_since(now: Timestamp, earlier: Timestamp) -> u64 {
        return 0;
    }

-    u64::try_from(duration.as_secs()).unwrap_or(u64::MAX)
+    u64::try_from(duration.as_secs()).map_or(u64::MAX, |seconds| seconds)
 }

 #[derive(Clone, Copy, Debug, Default)]
@@ -781,19 +781,6 @@ struct ScannerBucketDriveResultValue {
    last_seen: u64,
 }

-#[derive(Clone, Debug, Eq, Hash, PartialEq)]
-struct ScannerActiveBucketDriveKey {
-    source: String,
-    bucket: String,
-    drive: String,
-}
-
-#[derive(Clone, Copy, Debug)]
-struct ScannerActiveBucketDriveValue {
-    count: u64,
-    started_at: Timestamp,
-}
-
 // ---------------------------------------------------------------------------
 // Metrics
 // ---------------------------------------------------------------------------
@@ -826,7 +813,6 @@ pub struct Metrics {
    scanner_set_scans_active: AtomicU64,
    scanner_disk_bucket_scan_states: Mutex<HashMap<ScannerDiskBucketScanKey, ScannerDiskBucketScanState>>,
    scanner_bucket_drive_results: Mutex<ScannerBucketDriveResults>,
-    scanner_active_bucket_drive_scans: Mutex<HashMap<ScannerActiveBucketDriveKey, ScannerActiveBucketDriveValue>>,
    scanner_bucket_drive_result_clock: AtomicU64,
    current_scan_cycle_bucket_drive_results_start: Mutex<HashMap<ScannerBucketDriveResultKey, u64>>,
    last_scan_cycle_bucket_drive_results: Mutex<Vec<ScannerBucketDriveResultSnapshot>>,
@@ -1059,15 +1045,6 @@ pub struct ScannerBucketDriveResultSnapshot {
    pub count: u64,
 }

-#[derive(Clone, Debug, Default, Serialize, Deserialize, PartialEq, Eq)]
-pub struct ScannerActiveBucketDriveSnapshot {
-    pub source: String,
-    pub bucket: String,
-    pub drive: String,
-    pub count: u64,
-    pub age_seconds: u64,
-}
-
 #[derive(Clone, Debug, Default, Serialize, Deserialize, PartialEq, Eq)]
 pub struct ScannerReplicationRepairSnapshot {
    pub source: String,
@@ -1410,8 +1387,6 @@ pub struct ScannerRuntimeDetailsReport {
    pub current_cycle_bucket_drive_results: Vec<ScannerBucketDriveResultSnapshot>,
    #[serde(default)]
    pub last_cycle_bucket_drive_results: Vec<ScannerBucketDriveResultSnapshot>,
-    #[serde(default)]
-    pub active_bucket_drive_scans: Vec<ScannerActiveBucketDriveSnapshot>,
 }

 impl CurrentCycle {
@@ -1426,11 +1401,25 @@ impl CurrentCycle {
 }

 /// OTEL metric name constants for scanner metrics
+const OTEL_SCANNER_OBJECTS_SCANNED: &str = "rustfs_scanner_objects_scanned_total";
+const OTEL_SCANNER_DIRECTORIES_SCANNED: &str = "rustfs_scanner_directories_scanned_total";
 const OTEL_SCANNER_BUCKETS_SCANNED: &str = "rustfs_scanner_buckets_scanned_total";
 const OTEL_SCANNER_CYCLES: &str = "rustfs_scanner_cycles_total";
 const OTEL_SCANNER_CYCLE_DURATION_SECONDS: &str = "rustfs_scanner_cycle_duration_seconds";
 const OTEL_SCANNER_BUCKET_DRIVE_DURATION_SECONDS: &str = "rustfs_scanner_bucket_drive_duration_seconds";

+fn emit_otel_counter(metric: usize, count: u64) {
+    match Metric::from_index(metric) {
+        Some(Metric::ScanObject) => {
+            metrics::counter!(OTEL_SCANNER_OBJECTS_SCANNED).increment(count);
+        }
+        Some(Metric::ScanFolder) => {
+            metrics::counter!(OTEL_SCANNER_DIRECTORIES_SCANNED).increment(count);
+        }
+        _ => {}
+    }
+}
+
 fn scan_cycle_result_label(result: u8) -> &'static str {
    match result {
        SCAN_CYCLE_RESULT_SUCCESS => SCAN_CYCLE_RESULT_SUCCESS_LABEL,
@@ -1771,7 +1760,7 @@ pub fn emit_scan_cycle_deferred(duration: Duration) {
    metrics::counter!(OTEL_SCANNER_CYCLES, "result" => SCAN_CYCLE_RESULT_DEFERRED_LABEL).increment(1);
 }

-pub fn emit_scan_bucket_drive_complete(_source: ScannerWorkSource, success: bool, bucket: &str, disk: &str, duration: Duration) {
+pub fn emit_scan_bucket_drive_complete(success: bool, bucket: &str, disk: &str, duration: Duration) {
    let result = if success { "success" } else { "error" };
    global_metrics().record_scanner_bucket_drive_result(bucket, disk, result);
    metrics::counter!(
@@ -1789,7 +1778,7 @@ pub fn emit_scan_bucket_drive_complete(_source: ScannerWorkSource, success: bool
    .record(duration.as_secs_f64());
 }

-pub fn emit_scan_bucket_drive_partial(_source: ScannerWorkSource, bucket: &str, disk: &str, duration: Duration) {
+pub fn emit_scan_bucket_drive_partial(bucket: &str, disk: &str, duration: Duration) {
    global_metrics().record_scanner_bucket_drive_result(bucket, disk, SCAN_CYCLE_RESULT_PARTIAL_LABEL);
    metrics::counter!(
        OTEL_SCANNER_BUCKETS_SCANNED,
@@ -1842,7 +1831,6 @@ impl Metrics {
            scanner_set_scans_active: AtomicU64::new(0),
            scanner_disk_bucket_scan_states: Mutex::new(HashMap::new()),
            scanner_bucket_drive_results: Mutex::new(ScannerBucketDriveResults::default()),
-            scanner_active_bucket_drive_scans: Mutex::new(HashMap::new()),
            scanner_bucket_drive_result_clock: AtomicU64::new(0),
            current_scan_cycle_bucket_drive_results_start: Mutex::new(HashMap::new()),
            last_scan_cycle_bucket_drive_results: Mutex::new(Vec::new()),
@@ -1972,6 +1960,7 @@ impl Metrics {
            let duration = SystemTime::now().duration_since(start).unwrap_or_default();
            global_metrics().operations[metric_idx].fetch_add(1, Ordering::Relaxed);
            global_metrics().record_source_work_for_metric(metric, 1);
+            emit_otel_counter(metric_idx, 1);
            if metric_idx < Metric::LastRealtime as usize {
                global_metrics().latency[metric_idx].add(duration);
            }
@@ -1987,6 +1976,7 @@ impl Metrics {
            let duration = SystemTime::now().duration_since(start).unwrap_or_default();
            global_metrics().operations[metric_idx].fetch_add(1, Ordering::Relaxed);
            global_metrics().record_source_work_for_metric(metric, 1);
+            emit_otel_counter(metric_idx, 1);
            if metric_idx < Metric::LastRealtime as usize {
                global_metrics().latency[metric_idx].add_size(duration, size);
            }
@@ -2002,6 +1992,7 @@ impl Metrics {
            let duration = SystemTime::now().duration_since(start).unwrap_or_default();
            global_metrics().operations[metric_idx].fetch_add(1, Ordering::Relaxed);
            global_metrics().record_source_work_for_metric(metric, 1);
+            emit_otel_counter(metric_idx, 1);
            if metric_idx < Metric::LastRealtime as usize {
                global_metrics().latency[metric_idx].add(duration);
            }
@@ -2019,6 +2010,7 @@ impl Metrics {
                let count = usize_to_u64_saturated(count);
                global_metrics().operations[metric_idx].fetch_add(count, Ordering::Relaxed);
                global_metrics().record_source_work_for_metric(metric, count);
+                emit_otel_counter(metric_idx, count);
                if metric_idx < Metric::LastRealtime as usize {
                    global_metrics().latency[metric_idx].add(duration);
                }
@@ -2039,6 +2031,7 @@ impl Metrics {
                let duration = SystemTime::now().duration_since(start).unwrap_or_default();
                let metric_idx = Metric::Ilm as usize;
                global_metrics().operations[metric_idx].fetch_add(versions, Ordering::Relaxed);
+                emit_otel_counter(metric_idx, versions);
                global_metrics().actions[a_idx].fetch_add(versions, Ordering::Relaxed);
                global_metrics().actions_latency[a_idx].add(duration);
            })
@@ -2051,6 +2044,7 @@ impl Metrics {
        let metric_idx = metric as usize;
        global_metrics().operations[metric_idx].fetch_add(1, Ordering::Relaxed);
        global_metrics().record_source_work_for_metric(metric, 1);
+        emit_otel_counter(metric_idx, 1);
        if metric_idx < Metric::LastRealtime as usize {
            global_metrics().latency[metric_idx].add(duration);
        }
@@ -2334,45 +2328,8 @@ impl Metrics {
        }
    }

-    pub fn record_scan_bucket_drive_start(&self, source: ScannerWorkSource, bucket: &str, drive: &str) {
+    pub fn record_scan_bucket_drive_start(&self) {
        self.operations[Metric::ScanBucketDriveStart as usize].fetch_add(1, Ordering::Relaxed);
-        if bucket.is_empty() || drive.is_empty() {
-            return;
-        }
-        let key = ScannerActiveBucketDriveKey {
-            source: source.as_str().to_string(),
-            bucket: bucket.to_string(),
-            drive: drive.to_string(),
-        };
-        let mut active = self
-            .scanner_active_bucket_drive_scans
-            .lock()
-            .unwrap_or_else(|poisoned| poisoned.into_inner());
-        active
-            .entry(key)
-            .and_modify(|value| value.count = value.count.saturating_add(1))
-            .or_insert(ScannerActiveBucketDriveValue {
-                count: 1,
-                started_at: Timestamp::now(),
-            });
-    }
-
-    pub fn record_scan_bucket_drive_end(&self, source: ScannerWorkSource, bucket: &str, drive: &str) {
-        let key = ScannerActiveBucketDriveKey {
-            source: source.as_str().to_string(),
-            bucket: bucket.to_string(),
-            drive: drive.to_string(),
-        };
-        let mut active = self
-            .scanner_active_bucket_drive_scans
-            .lock()
-            .unwrap_or_else(|poisoned| poisoned.into_inner());
-        if let Some(value) = active.get_mut(&key) {
-            value.count = value.count.saturating_sub(1);
-            if value.count == 0 {
-                active.remove(&key);
-            }
-        }
    }

    pub fn record_scan_bucket_drive_failure(&self) {
@@ -2845,26 +2802,6 @@ impl Metrics {
        } else {
            Vec::new()
        };
-        let now = Timestamp::now();
-        let mut active_bucket_drive_scans = self
-            .scanner_active_bucket_drive_scans
-            .lock()
-            .unwrap_or_else(|poisoned| poisoned.into_inner())
-            .iter()
-            .map(|(key, value)| ScannerActiveBucketDriveSnapshot {
-                source: key.source.clone(),
-                bucket: key.bucket.clone(),
-                drive: key.drive.clone(),
-                count: value.count,
-                age_seconds: timestamp_elapsed_seconds_since(now, value.started_at),
-            })
-            .collect::<Vec<_>>();
-        active_bucket_drive_scans.sort_by(|left, right| {
-            left.source
-                .cmp(&right.source)
-                .then_with(|| left.bucket.cmp(&right.bucket))
-                .then_with(|| left.drive.cmp(&right.drive))
-        });
        ScannerRuntimeDetailsReport {
            disk_bucket_scan_states: self.scanner_disk_bucket_scan_state_snapshots(),
            bucket_drive_results: self.scanner_bucket_drive_result_counter_snapshots(),
@@ -2874,7 +2811,6 @@ impl Metrics {
                .lock()
                .unwrap_or_else(|poisoned| poisoned.into_inner())
                .clone(),
-            active_bucket_drive_scans,
        }
    }

@@ -4455,7 +4391,7 @@ mod tests {
    #[tokio::test]
    async fn report_includes_bucket_drive_scan_starts() {
        let metrics = Metrics::new();
-        metrics.record_scan_bucket_drive_start(ScannerWorkSource::Usage, "bucket-a", "/mnt/data/1");
+        metrics.record_scan_bucket_drive_start();
        metrics.record_scan_bucket_drive_failure();

        let report = metrics.report().await;
@@ -4464,27 +4400,6 @@ mod tests {
        assert_eq!(report.life_time_ops.get("scan_bucket_drive_failure"), Some(&1));
    }

-    #[tokio::test]
-    async fn active_bucket_drive_snapshot_is_structured_and_retired_on_end() {
-        let metrics = Metrics::new();
-        metrics.record_scan_bucket_drive_start(ScannerWorkSource::Usage, "bucket-a", "/mnt/data/1");
-        metrics.record_scan_bucket_drive_start(ScannerWorkSource::Usage, "bucket-a", "/mnt/data/1");
-        let active = metrics.scanner_runtime_details_report().active_bucket_drive_scans;
-        assert_eq!(active.len(), 1);
-        assert_eq!(active[0].source, ScannerWorkSource::Usage.as_str());
-        assert_eq!(active[0].bucket, "bucket-a");
-        assert_eq!(active[0].drive, "/mnt/data/1");
-        assert_eq!(active[0].count, 2);
-
-        metrics.record_scan_bucket_drive_end(ScannerWorkSource::Usage, "bucket-a", "/mnt/data/1");
-        assert_eq!(metrics.scanner_runtime_details_report().active_bucket_drive_scans[0].count, 1);
-        metrics.record_scan_bucket_drive_end(ScannerWorkSource::Usage, "bucket-a", "/mnt/data/1");
-        assert!(metrics.scanner_runtime_details_report().active_bucket_drive_scans.is_empty());
-
-        metrics.record_scan_bucket_drive_start(ScannerWorkSource::Usage, "", "/mnt/data/1");
-        assert!(metrics.scanner_runtime_details_report().active_bucket_drive_scans.is_empty());
-    }
-
    #[tokio::test]
    async fn report_includes_structured_bucket_drive_results() {
        let metrics = Metrics::new();
@@ -148,62 +148,6 @@ fn unix_now_ms() -> u64 {
        .unwrap_or(0)
 }

-/// A repair the MRF consumer landed, fanned out so retry ledgers can drop
-/// entries the journal no longer tracks (backlog#1894 axis B). The payload
-/// mirrors the intent identity so consumers match without re-parsing.
-#[derive(Debug, Clone, PartialEq, Eq)]
-pub struct MrfRepairedEvent {
-    pub bucket: Arc<str>,
-    pub object: Arc<str>,
-    pub version_id: Option<[u8; 16]>,
-}
-
-/// Bound on the repaired-event backlog. Notices are best-effort hints; when
-/// the ring is full the oldest are dropped and the affected ledger entries
-/// simply expire through their own attempts/age limits.
-const MRF_REPAIRED_EVENT_CAP: usize = 4096;
-
-static MRF_REPAIRED_EVENTS: OnceLock<std::sync::Mutex<std::collections::VecDeque<MrfRepairedEvent>>> = OnceLock::new();
-
-/// Record that the MRF consumer landed a repair. Never blocks: the critical
-/// section is a deque push under a std mutex.
-pub fn note_mrf_repaired(bucket: &str, object: &str, version_id: Option<[u8; 16]>) {
-    let registry = MRF_REPAIRED_EVENTS.get_or_init(|| std::sync::Mutex::new(std::collections::VecDeque::new()));
-    let Ok(mut events) = registry.lock() else {
-        return;
-    };
-    if events.len() >= MRF_REPAIRED_EVENT_CAP {
-        events.pop_front();
-    }
-    events.push_back(MrfRepairedEvent {
-        bucket: Arc::from(bucket),
-        object: Arc::from(object),
-        version_id,
-    });
-}
-
-/// Take the repair notices recorded for `bucket`, leaving other buckets'
-/// notices in place for their own scanners.
-pub fn take_mrf_repaired_events_for(bucket: &str) -> Vec<MrfRepairedEvent> {
-    let Some(registry) = MRF_REPAIRED_EVENTS.get() else {
-        return Vec::new();
-    };
-    let Ok(mut events) = registry.lock() else {
-        return Vec::new();
-    };
-    let mut taken = Vec::new();
-    let mut retained = std::collections::VecDeque::with_capacity(events.len());
-    while let Some(event) = events.pop_front() {
-        if event.bucket.as_ref() == bucket {
-            taken.push(event);
-        } else {
-            retained.push_back(event);
-        }
-    }
-    *events = retained;
-    taken
-}
-
 #[cfg(test)]
 mod tests {
    use super::*;
@@ -256,32 +200,4 @@ mod tests {
        assert!(!try_send_mrf_intent(MrfKind::MetadataCorruption, "b", "o", None));
        set_mrf_delivery_enabled(true);
    }
-
-    #[test]
-    fn repaired_events_take_is_bucket_scoped_and_cap_bounded() {
-        // Distinct buckets keep their notices until their own scanner takes
-        // them; a take for one bucket leaves the others' notices in place.
-        note_mrf_repaired("bucket-a", "object-1", None);
-        note_mrf_repaired("bucket-b", "object-2", None);
-        note_mrf_repaired("bucket-a", "object-3", None);
-
-        let taken_a = take_mrf_repaired_events_for("bucket-a");
-        assert_eq!(taken_a.len(), 2);
-        assert_eq!(taken_a[0].object.as_ref(), "object-1");
-        assert_eq!(taken_a[1].object.as_ref(), "object-3");
-        assert!(take_mrf_repaired_events_for("bucket-a").is_empty(), "take is destructive per bucket");
-
-        let taken_b = take_mrf_repaired_events_for("bucket-b");
-        assert_eq!(taken_b.len(), 1);
-        assert_eq!(taken_b[0].object.as_ref(), "object-2");
-
-        // Cap bound: flooding the ring drops the oldest notices rather than
-        // growing unbounded.
-        for i in 0..=(MRF_REPAIRED_EVENT_CAP + 8) {
-            note_mrf_repaired("flood-bucket", &format!("object-{i}"), None);
-        }
-        let flooded = take_mrf_repaired_events_for("flood-bucket");
-        assert_eq!(flooded.len(), MRF_REPAIRED_EVENT_CAP);
-        assert_eq!(flooded[0].object.as_ref(), "object-9", "the oldest notices past the cap are dropped");
-    }
 }
@@ -115,15 +115,6 @@ Current guidance:
  - enables KMS readiness enforcement for `/health/ready`.
  - default is `false`.

-## Object lock admission environment variables
-
- `RUSTFS_PUT_COMMIT_NAMESPACE_LOCK_ACQUIRE_TIMEOUT_MS`
-  - experimental same-object PUT commit namespace-lock admission budget.
-  - default is `0`, which disables this override and keeps `RUSTFS_OBJECT_LOCK_ACQUIRE_TIMEOUT` behavior.
-  - when set, only `put_object_commit` write-lock acquisition is bounded by this millisecond budget; other namespace lock users keep the global object-lock timeout.
-  - timeout returns S3 `SlowDown`, so clients should use normal SDK retry handling.
-  - this is not a fdatasync or group-commit switch. Track fdatasync batching separately with `rustfs_s3_put_object_rename_fdatasync_batch_files`.
-
 ## Drive timeout environment variables

 - `RUSTFS_DRIVE_METADATA_TIMEOUT_SECS`
@@ -427,19 +427,6 @@ pub const ENV_OBJECT_LOCK_ACQUIRE_TIMEOUT: &str = "RUSTFS_OBJECT_LOCK_ACQUIRE_TI
 /// Default lock acquisition timeout: 5 seconds.
 pub const DEFAULT_OBJECT_LOCK_ACQUIRE_TIMEOUT: u64 = 5;

-/// Environment variable for the experimental PUT commit namespace lock acquire timeout in milliseconds.
-///
-/// A value of `0` disables the experiment and keeps
-/// `RUSTFS_OBJECT_LOCK_ACQUIRE_TIMEOUT` as the timeout. This only bounds the
-/// `put_object_commit` namespace write-lock wait and is intended for #925
-/// tail-drain admission experiments.
-///
-/// Default: 0 milliseconds (disabled).
-pub const ENV_PUT_COMMIT_NAMESPACE_LOCK_ACQUIRE_TIMEOUT_MS: &str = "RUSTFS_PUT_COMMIT_NAMESPACE_LOCK_ACQUIRE_TIMEOUT_MS";
-
-/// Default: PUT commit namespace lock acquire timeout override is disabled.
-pub const DEFAULT_PUT_COMMIT_NAMESPACE_LOCK_ACQUIRE_TIMEOUT_MS: u64 = 0;
-
 /// Environment variable for remote namespace lock RPC transport timeout in milliseconds.
 ///
 /// This timeout bounds the internode RPC call itself. It is intentionally
@@ -228,6 +228,15 @@ pub const DEFAULT_SCANNER_MAX_CONCURRENT_DISK_SCANS: usize = 4;
 /// Default object interval for cooperative scanner yields.
 pub const DEFAULT_SCANNER_YIELD_EVERY_N_OBJECTS: u64 = 128;

+/// Compatibility flag kept for Patch 3 rollback windows.
+///
+/// Inline scanner heal execution has been removed in favor of heal-candidate enqueue.
+/// When this flag is enabled, RustFS logs a warning and continues to use enqueue-based heal.
+pub const ENV_SCANNER_INLINE_HEAL_ENABLE: &str = "RUSTFS_SCANNER_INLINE_HEAL_ENABLE";
+
+/// Default inline scanner heal compatibility mode.
+pub const DEFAULT_SCANNER_INLINE_HEAL_ENABLE: bool = false;
+
 /// Scanner speed preset controlling throttling behavior.
 ///
 /// Each preset defines three parameters:
@@ -92,11 +92,15 @@ pub const NOTIFY_SUB_SYSTEMS: &[&str] = &[
 pub const NOTIFY_KAFKA_SUB_SYS: &str = "notify_kafka";
 pub const NOTIFY_MQTT_SUB_SYS: &str = "notify_mqtt";
 pub const NOTIFY_MYSQL_SUB_SYS: &str = "notify_mysql";
+#[allow(dead_code)]
 pub const NOTIFY_NATS_SUB_SYS: &str = "notify_nats";
+#[allow(dead_code)]
 pub const NOTIFY_NSQ_SUB_SYS: &str = "notify_nsq";
+#[allow(dead_code)]
 pub const NOTIFY_ES_SUB_SYS: &str = "notify_elasticsearch";
 pub const NOTIFY_AMQP_SUB_SYS: &str = "notify_amqp";
 pub const NOTIFY_POSTGRES_SUB_SYS: &str = "notify_postgres";
+#[allow(dead_code)]
 pub const NOTIFY_REDIS_SUB_SYS: &str = "notify_redis";
 pub const NOTIFY_REDIS_DEFAULT_CHANNEL: &str = "rustfs_notify_channel";
 pub const NOTIFY_PULSAR_SUB_SYS: &str = "notify_pulsar";
@@ -203,6 +203,14 @@ mod tests {
        assert!(result.is_err());
    }

+    #[test]
+    fn test_source_does_not_embed_private_key() {
+        let source = include_str!("license_token.rs");
+        let forbidden = ["BEGIN", "PRIVATE KEY"].join(" ");
+
+        assert!(!source.contains(&forbidden));
+    }
+
    #[test]
    fn test_parse_signed_license_token_rejects_invalid_token() {
        let mut rng = rand::rng();
@@ -317,15 +317,15 @@ pub struct SizeSummary {
    /// Number of delete markers
    pub delete_markers: usize,
    /// Replicated size
-    pub replicated_size: i64,
+    pub replicated_size: usize,
    /// Replicated count
    pub replicated_count: usize,
    /// Pending size
-    pub pending_size: i64,
+    pub pending_size: usize,
    /// Failed size
-    pub failed_size: i64,
+    pub failed_size: usize,
    /// Replica size
-    pub replica_size: i64,
+    pub replica_size: usize,
    /// Replica count
    pub replica_count: usize,
    /// Pending count
@@ -334,21 +334,19 @@ pub struct SizeSummary {
    pub failed_count: usize,
    /// Replication target stats
    pub repl_target_stats: HashMap<String, ReplTargetSizeSummary>,
-    /// Per-tier accounting, keyed by storage class or remote tier name
-    pub tier_stats: HashMap<String, TierStats>,
 }

 /// Replication target size summary
 #[derive(Debug, Default, Clone)]
 pub struct ReplTargetSizeSummary {
    /// Replicated size
-    pub replicated_size: i64,
+    pub replicated_size: usize,
    /// Replicated count
    pub replicated_count: usize,
    /// Pending size
-    pub pending_size: i64,
+    pub pending_size: usize,
    /// Failed size
-    pub failed_size: i64,
+    pub failed_size: usize,
    /// Pending count
    pub pending_count: usize,
    /// Failed count
@@ -585,12 +583,9 @@ impl VersionsHistogram {
    }
 }

-/// Replication statistics for a single target.
-///
-/// Renamed from `ReplicationStats`; serde field names are preserved
-/// byte-identically to maintain wire compatibility with existing snapshots.
-#[derive(Debug, Default, Clone, Serialize, Deserialize, PartialEq, Eq)]
-pub struct ReplicationTargetUsage {
+/// Replication statistics for a single target
+#[derive(Debug, Default, Clone, Serialize, Deserialize)]
+pub struct ReplicationStats {
    pub pending_size: u64,
    pub replicated_size: u64,
    pub failed_size: u64,
@@ -603,7 +598,7 @@ pub struct ReplicationTargetUsage {
    pub replicated_count: u64,
 }

-impl ReplicationTargetUsage {
+impl ReplicationStats {
    pub fn is_empty(&self) -> bool {
        let Self {
            pending_size,
@@ -639,7 +634,7 @@ impl ReplicationTargetUsage {
 /// Replication statistics for all targets
 #[derive(Debug, Default, Clone, Serialize, Deserialize)]
 pub struct ReplicationAllStats {
-    pub targets: HashMap<String, ReplicationTargetUsage>,
+    pub targets: HashMap<String, ReplicationStats>,
    pub replica_size: u64,
    pub replica_count: u64,
 }
@@ -652,7 +647,7 @@ impl ReplicationAllStats {
            targets,
        } = self;

-        *replica_size == 0 && *replica_count == 0 && targets.values().all(ReplicationTargetUsage::is_empty)
+        *replica_size == 0 && *replica_count == 0 && targets.values().all(ReplicationStats::is_empty)
    }

    #[deprecated(note = "use is_empty instead")]
@@ -715,6 +710,28 @@ impl DataUsageEntry {
        self.children.insert(hash.key());
    }

+    pub fn add_sizes(&mut self, summary: &SizeSummary) {
+        self.size += summary.total_size;
+        self.versions += summary.versions;
+        self.delete_markers += summary.delete_markers;
+        self.obj_sizes.add(summary.total_size as u64);
+        self.obj_versions.add(summary.versions as u64);
+
+        let replication_stats = self.replication_stats.get_or_insert_with(ReplicationAllStats::default);
+        replication_stats.replica_size += summary.replica_size as u64;
+        replication_stats.replica_count += summary.replica_count as u64;
+
+        for (arn, st) in &summary.repl_target_stats {
+            let tgt_stat = replication_stats.targets.entry(arn.to_string()).or_default();
+            tgt_stat.pending_size += st.pending_size as u64;
+            tgt_stat.failed_size += st.failed_size as u64;
+            tgt_stat.replicated_size += st.replicated_size as u64;
+            tgt_stat.replicated_count += st.replicated_count as u64;
+            tgt_stat.failed_count += st.failed_count as u64;
+            tgt_stat.pending_count += st.pending_count as u64;
+        }
+    }
+
    pub fn merge(&mut self, other: &DataUsageEntry) {
        self.objects += other.objects;
        self.versions += other.versions;
@@ -1705,6 +1722,14 @@ impl BucketUsageInfo {
    }

    /// Add size summary to this bucket usage
+    pub fn add_size_summary(&mut self, summary: &SizeSummary) {
+        self.size += summary.total_size as u64;
+        self.versions_count += summary.versions as u64;
+        self.delete_markers_count += summary.delete_markers as u64;
+        self.replica_size += summary.replica_size as u64;
+        self.replica_count += summary.replica_count as u64;
+    }
+
    /// Merge another BucketUsageInfo into this one
    pub fn merge(&mut self, other: &BucketUsageInfo) {
        self.size += other.size;
@@ -1750,32 +1775,29 @@ impl SizeSummary {
        Self::default()
    }

-    /// Add another SizeSummary to this one.
-    ///
-    /// Saturating throughout: a scan that overflows a counter should report the
-    /// ceiling rather than panic in a debug build or wrap in a release one.
+    /// Add another SizeSummary to this one
    pub fn add(&mut self, other: &SizeSummary) {
-        self.total_size = self.total_size.saturating_add(other.total_size);
-        self.versions = self.versions.saturating_add(other.versions);
-        self.delete_markers = self.delete_markers.saturating_add(other.delete_markers);
-        self.replicated_size = self.replicated_size.saturating_add(other.replicated_size);
-        self.replicated_count = self.replicated_count.saturating_add(other.replicated_count);
-        self.pending_size = self.pending_size.saturating_add(other.pending_size);
-        self.failed_size = self.failed_size.saturating_add(other.failed_size);
-        self.replica_size = self.replica_size.saturating_add(other.replica_size);
-        self.replica_count = self.replica_count.saturating_add(other.replica_count);
-        self.pending_count = self.pending_count.saturating_add(other.pending_count);
-        self.failed_count = self.failed_count.saturating_add(other.failed_count);
+        self.total_size += other.total_size;
+        self.versions += other.versions;
+        self.delete_markers += other.delete_markers;
+        self.replicated_size += other.replicated_size;
+        self.replicated_count += other.replicated_count;
+        self.pending_size += other.pending_size;
+        self.failed_size += other.failed_size;
+        self.replica_size += other.replica_size;
+        self.replica_count += other.replica_count;
+        self.pending_count += other.pending_count;
+        self.failed_count += other.failed_count;

        // Merge replication target stats
        for (target, stats) in &other.repl_target_stats {
            let entry = self.repl_target_stats.entry(target.clone()).or_default();
-            entry.replicated_size = entry.replicated_size.saturating_add(stats.replicated_size);
-            entry.replicated_count = entry.replicated_count.saturating_add(stats.replicated_count);
-            entry.pending_size = entry.pending_size.saturating_add(stats.pending_size);
-            entry.failed_size = entry.failed_size.saturating_add(stats.failed_size);
-            entry.pending_count = entry.pending_count.saturating_add(stats.pending_count);
-            entry.failed_count = entry.failed_count.saturating_add(stats.failed_count);
+            entry.replicated_size += stats.replicated_size;
+            entry.replicated_count += stats.replicated_count;
+            entry.pending_size += stats.pending_size;
+            entry.failed_size += stats.failed_size;
+            entry.pending_count += stats.pending_count;
+            entry.failed_count += stats.failed_count;
        }
    }
 }
@@ -2321,64 +2343,6 @@ mod tests {
        assert_eq!(usage1.versions_count, 15);
    }

-    #[test]
-    fn size_summary_add_saturates_instead_of_overflowing() {
-        // The scanner folds one summary per object into a per-prefix total, so a
-        // counter at its ceiling must stay there rather than panic in a debug
-        // build or wrap in a release one (backlog#1828).
-        let mut summary = SizeSummary {
-            total_size: usize::MAX,
-            versions: usize::MAX,
-            replicated_size: i64::MAX,
-            pending_size: i64::MAX,
-            failed_size: i64::MAX,
-            replica_size: i64::MAX,
-            ..Default::default()
-        };
-        summary.repl_target_stats.insert(
-            "arn".to_string(),
-            ReplTargetSizeSummary {
-                replicated_size: i64::MAX,
-                pending_size: i64::MAX,
-                failed_size: i64::MAX,
-                ..Default::default()
-            },
-        );
-
-        let mut increment = SizeSummary {
-            total_size: 1,
-            versions: 1,
-            replicated_size: 1,
-            pending_size: 1,
-            failed_size: 1,
-            replica_size: 1,
-            ..Default::default()
-        };
-        increment.repl_target_stats.insert(
-            "arn".to_string(),
-            ReplTargetSizeSummary {
-                replicated_size: 1,
-                pending_size: 1,
-                failed_size: 1,
-                ..Default::default()
-            },
-        );
-
-        summary.add(&increment);
-
-        assert_eq!(summary.total_size, usize::MAX);
-        assert_eq!(summary.versions, usize::MAX);
-        assert_eq!(summary.replicated_size, i64::MAX);
-        assert_eq!(summary.pending_size, i64::MAX);
-        assert_eq!(summary.failed_size, i64::MAX);
-        assert_eq!(summary.replica_size, i64::MAX);
-
-        let target = summary.repl_target_stats.get("arn").expect("target survives the merge");
-        assert_eq!(target.replicated_size, i64::MAX);
-        assert_eq!(target.pending_size, i64::MAX);
-        assert_eq!(target.failed_size, i64::MAX);
-    }
-
    #[test]
    fn test_size_summary_add() {
        let mut summary1 = SizeSummary::new();
@@ -2469,7 +2433,7 @@ mod tests {

    #[test]
    fn replication_stats_empty_checks_every_field() {
-        type SetField = fn(&mut ReplicationTargetUsage);
+        type SetField = fn(&mut ReplicationStats);

        let cases: [(&str, SetField); 10] = [
            ("pending_size", |stats| stats.pending_size = 1),
@@ -2484,9 +2448,9 @@ mod tests {
            ("replicated_count", |stats| stats.replicated_count = 1),
        ];

-        assert!(ReplicationTargetUsage::default().is_empty());
+        assert!(ReplicationStats::default().is_empty());
        for (field, set_nonzero) in cases {
-            let mut stats = ReplicationTargetUsage::default();
+            let mut stats = ReplicationStats::default();
            set_nonzero(&mut stats);
            assert!(!stats.is_empty(), "{field} must make replication stats non-empty");
        }
@@ -2517,17 +2481,17 @@ mod tests {
        }

        let empty_targets = ReplicationAllStats {
-            targets: HashMap::from([("arn:test:empty".to_string(), ReplicationTargetUsage::default())]),
+            targets: HashMap::from([("arn:test:empty".to_string(), ReplicationStats::default())]),
            ..Default::default()
        };
        assert!(empty_targets.is_empty(), "all-empty targets must keep aggregate stats empty");

        let stats = ReplicationAllStats {
            targets: HashMap::from([
-                ("arn:test:empty".to_string(), ReplicationTargetUsage::default()),
+                ("arn:test:empty".to_string(), ReplicationStats::default()),
                (
                    "arn:test:non-empty".to_string(),
-                    ReplicationTargetUsage {
+                    ReplicationStats {
                        pending_count: 1,
                        ..Default::default()
                    },
@@ -2568,7 +2532,7 @@ mod tests {
                replication_stats: Some(ReplicationAllStats {
                    targets: HashMap::from([(
                        "arn:test:pending".to_string(),
-                        ReplicationTargetUsage {
+                        ReplicationStats {
                            pending_count: 1,
                            ..Default::default()
                        },
@@ -2717,7 +2681,7 @@ mod tests {
                targets: HashMap::from([
                    (
                        "arn:self-only".to_string(),
-                        ReplicationTargetUsage {
+                        ReplicationStats {
                            pending_size: 7,
                            pending_count: 1,
                            ..Default::default()
@@ -2725,7 +2689,7 @@ mod tests {
                    ),
                    (
                        "arn:shared".to_string(),
-                        ReplicationTargetUsage {
+                        ReplicationStats {
                            failed_size: 3,
                            failed_count: 1,
                            missed_threshold_size: 2,
@@ -2744,7 +2708,7 @@ mod tests {
                targets: HashMap::from([
                    (
                        "arn:shared".to_string(),
-                        ReplicationTargetUsage {
+                        ReplicationStats {
                            failed_size: 5,
                            failed_count: 2,
                            after_threshold_size: 4,
@@ -2754,7 +2718,7 @@ mod tests {
                    ),
                    (
                        "arn:other-only".to_string(),
-                        ReplicationTargetUsage {
+                        ReplicationStats {
                            replicated_size: 11,
                            replicated_count: 3,
                            ..Default::default()
@@ -2996,7 +2960,7 @@ mod tests {
    fn replication_target_deserialization_preserves_large_historical_maps() {
        let mut stats = ReplicationAllStats::default();
        for index in 0..=1024 {
-            stats.targets.insert(format!("target-{index}"), ReplicationTargetUsage::default());
+            stats.targets.insert(format!("target-{index}"), ReplicationStats::default());
        }
        let encoded = rmp_serde::to_vec_named(&stats).expect("large replication target fixture should encode");
        let decoded = rmp_serde::from_slice::<ReplicationAllStats>(&encoded)
@@ -3005,42 +2969,6 @@ mod tests {
        assert_eq!(decoded.targets.len(), stats.targets.len());
    }

-    /// Round-trip test: encoding a [`ReplicationTargetUsage`] and decoding it back
-    /// must produce the exact same value.  This guards against accidental serde
-    /// field-name drift during the `ReplicationStats` -> `ReplicationTargetUsage`
-    /// rename.  Wire-level field names are the serialized Rust field identifiers,
-    /// which must remain byte-identical.
-    #[test]
-    fn replication_target_usage_rmp_round_trip() {
-        let original = ReplicationTargetUsage {
-            pending_size: 100,
-            replicated_size: 2_000,
-            failed_size: 50,
-            failed_count: 3,
-            pending_count: 7,
-            missed_threshold_size: 11,
-            after_threshold_size: 22,
-            missed_threshold_count: 1,
-            after_threshold_count: 2,
-            replicated_count: 99,
-        };
-
-        let buf = rmp_serde::to_vec_named(&original).expect("encode ReplicationTargetUsage to msgpack");
-        let decoded: ReplicationTargetUsage =
-            rmp_serde::from_slice(&buf).expect("decode ReplicationTargetUsage from msgpack");
-        assert_eq!(original, decoded, "round-trip through rmp must preserve every field");
-
-        // Also verify that encoding as an unnamed sequence and then decoding
-        // with named fields produces the correct mapping (this catches reordering).
-        let named_buf = rmp_serde::to_vec_named(&original).expect("re-encode for field-name pinning");
-        // Spot-check that known field names appear in the named encoding.
-        let named_str = String::from_utf8_lossy(&named_buf);
-        assert!(named_str.contains("pending_size"), "field 'pending_size' must survive the rename");
-        assert!(named_str.contains("replicated_size"), "field 'replicated_size' must survive the rename");
-        assert!(named_str.contains("missed_threshold_size"), "field 'missed_threshold_size' must survive the rename");
-        assert!(named_str.contains("after_threshold_count"), "field 'after_threshold_count' must survive the rename");
-    }
-
    #[test]
    fn checked_merge_rejects_noncanonical_histograms_without_mutation() {
        let mut entry = DataUsageEntry {
@@ -38,6 +38,7 @@ mod tests {
    use rustfs_signer::constants::UNSIGNED_PAYLOAD;
    use rustfs_signer::sign_v4;
    use s3s::Body;
+    use serial_test::serial;
    use std::error::Error;
    use std::io::Read;
    use std::process::{Command, Stdio};
@@ -161,6 +162,7 @@ mod tests {
    /// A fully authenticated but non-admin credential must be rejected with
    /// `403 AccessDenied` on an admin API, while the root credential succeeds.
    #[tokio::test(flavor = "multi_thread")]
+    #[serial]
    async fn non_admin_credential_denied_on_admin_api() -> Result<(), Box<dyn Error + Send + Sync>> {
        init_logging();
        let mut env = RustFSTestEnvironment::new().await?;
@@ -196,6 +198,7 @@ mod tests {
    }

    #[tokio::test(flavor = "multi_thread")]
+    #[serial]
    async fn non_admin_credential_denied_on_manual_transition_run() -> Result<(), Box<dyn Error + Send + Sync>> {
        init_logging();
        let mut env = RustFSTestEnvironment::new().await?;
@@ -323,6 +326,7 @@ mod tests {
    /// credential is accepted and the old one is rejected, on both the S3 data
    /// plane and the admin plane.
    #[tokio::test(flavor = "multi_thread")]
+    #[serial]
    async fn root_credential_rotation_takes_effect() -> Result<(), Box<dyn Error + Send + Sync>> {
        init_logging();
        let mut env = RustFSTestEnvironment::new().await?;
@@ -385,6 +389,7 @@ mod tests {
    /// runtime. We capture the child's stdout/stderr directly (the shared
    /// harness inherits stdio) and poll for the warning until it appears.
    #[tokio::test(flavor = "multi_thread")]
+    #[serial]
    async fn default_credentials_emit_startup_warning() -> Result<(), Box<dyn Error + Send + Sync>> {
        init_logging();

@@ -33,6 +33,7 @@ use aws_sdk_s3::config::{Credentials, Region};
 use aws_sdk_s3::primitives::ByteStream;
 use aws_sdk_s3::{Client, Config};
 use reqwest::StatusCode;
+use serial_test::serial;
 use std::error::Error;
 use tokio::time::{Duration, sleep};

@@ -177,6 +178,7 @@ async fn assert_admin_status(
 }

 #[tokio::test]
+#[serial]
 async fn test_update_service_account_enforces_owner_and_parent_scope() -> TestResult {
    init_logging();

@@ -346,6 +348,7 @@ async fn test_update_service_account_enforces_owner_and_parent_scope() -> TestRe
 /// Full user -> policy -> service-account lifecycle, proving each management
 /// call takes effect on the data plane, not just that the endpoint answers 200.
 #[tokio::test]
+#[serial]
 async fn test_admin_user_policy_service_account_crud_lifecycle() -> TestResult {
    init_logging();

@@ -570,6 +573,7 @@ async fn test_admin_user_policy_service_account_crud_lifecycle() -> TestResult {
 /// non-admin credential with 403 AccessDenied (sec-4 assertion pattern; the
 /// gate implementation itself is owned by sec-4 / admin_auth_test).
 #[tokio::test]
+#[serial]
 async fn test_admin_iam_endpoints_deny_non_admin_credential() -> TestResult {
    init_logging();

@@ -21,6 +21,7 @@ use rustfs_signer::constants::UNSIGNED_PAYLOAD;
 use rustfs_signer::sign_v4;
 use s3s::Body;
 use serde::Deserialize;
+use serial_test::serial;
 use std::error::Error;
 use std::process::Command;
 use tokio::time::{Duration, sleep, timeout};
@@ -99,6 +100,7 @@ fn offline_server_count(info: &InfoMessage) -> usize {
 }

 #[tokio::test(flavor = "multi_thread")]
+#[serial]
 async fn test_single_admin_timeout_does_not_immediately_mark_peer_offline() -> Result<(), Box<dyn Error + Send + Sync>> {
    init_logging();

@@ -18,6 +18,7 @@

 use crate::common::{RustFSTestEnvironment, init_logging, local_http_client};
 use aws_sdk_s3::types::PublicAccessBlockConfiguration;
+use serial_test::serial;
 use tracing::info;

 async fn setup_public_bucket(
@@ -72,6 +73,7 @@ async fn anonymous_get_object(
 /// Issue #2036: Anonymous GetObject should succeed when bucket policy allows it
 /// and no PublicAccessBlock configuration exists (ConfigNotFound).
 #[tokio::test]
+#[serial]
 async fn test_anonymous_access_allowed_when_public_access_block_missing() -> Result<(), Box<dyn std::error::Error + Send + Sync>>
 {
    init_logging();
@@ -98,6 +100,7 @@ async fn test_anonymous_access_allowed_when_public_access_block_missing() -> Res

 /// Anonymous GetObject should be denied when RestrictPublicBuckets is true.
 #[tokio::test]
+#[serial]
 async fn test_anonymous_access_denied_when_restrict_public_buckets_enabled()
 -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
    init_logging();
@@ -134,6 +137,7 @@ async fn test_anonymous_access_denied_when_restrict_public_buckets_enabled()
 /// Anonymous GetObject should succeed when PublicAccessBlock exists but
 /// RestrictPublicBuckets is explicitly false.
 #[tokio::test]
+#[serial]
 async fn test_anonymous_access_allowed_when_restrict_public_buckets_disabled()
 -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
    init_logging();
@@ -172,6 +176,7 @@ async fn test_anonymous_access_allowed_when_restrict_public_buckets_disabled()
 /// reaches authorization through a fallback branch, and that branch has to apply the
 /// same public-access gate as a direct grant.
 #[tokio::test]
+#[serial]
 async fn ghsa_x298_anonymous_list_object_versions_denied_when_restrict_public_buckets_enabled()
 -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
    init_logging();
@@ -18,11 +18,13 @@
 //! completely inert with default configuration.

 use crate::common::{RustFSTestEnvironment, init_logging, local_http_client};
+use serial_test::serial;
 use tracing::info;

 type TestResult = Result<(), Box<dyn std::error::Error + Send + Sync>>;

 #[tokio::test]
+#[serial]
 async fn api_rate_limit_enforces_429_with_retry_after_when_enabled() -> TestResult {
    init_logging();
    let mut env = RustFSTestEnvironment::new().await?;
@@ -85,6 +87,7 @@ async fn api_rate_limit_enforces_429_with_retry_after_when_enabled() -> TestResu
 }

 #[tokio::test]
+#[serial]
 async fn api_rate_limit_bucket_dimension_throttles_per_bucket() -> TestResult {
    init_logging();
    let mut env = RustFSTestEnvironment::new().await?;
@@ -130,6 +133,7 @@ async fn api_rate_limit_bucket_dimension_throttles_per_bucket() -> TestResult {
 }

 #[tokio::test]
+#[serial]
 async fn api_rate_limit_stays_inert_by_default() -> TestResult {
    init_logging();
    let mut env = RustFSTestEnvironment::new().await?;
@@ -24,6 +24,7 @@ mod tests {
    use rustfs_signer::constants::UNSIGNED_PAYLOAD;
    use rustfs_signer::{pre_sign_v4, sign_v4};
    use s3s::Body;
+    use serial_test::serial;
    use sha2::{Digest, Sha256};
    use std::error::Error;
    use std::io::{Cursor, Write};
@@ -338,6 +339,7 @@ mod tests {
    }

    #[tokio::test]
+    #[serial]
    async fn test_archive_put_allows_content_encoding_by_default() -> Result<(), Box<dyn Error + Send + Sync>> {
        init_logging();
        let mut env = RustFSTestEnvironment::new().await?;
@@ -365,6 +367,7 @@ mod tests {
    }

    #[tokio::test]
+    #[serial]
    async fn test_archive_put_rejects_content_encoding_when_strict_mode_enabled() -> Result<(), Box<dyn Error + Send + Sync>> {
        init_logging();
        let mut env = RustFSTestEnvironment::new().await?;
@@ -388,6 +391,7 @@ mod tests {
    }

    #[tokio::test]
+    #[serial]
    async fn test_archive_put_with_aws_chunked_does_not_persist_content_encoding_by_default()
    -> Result<(), Box<dyn Error + Send + Sync>> {
        init_logging();
@@ -423,6 +427,7 @@ mod tests {
    }

    #[tokio::test]
+    #[serial]
    async fn test_archive_put_with_aws_chunked_and_effective_encoding_roundtrips_by_default()
    -> Result<(), Box<dyn Error + Send + Sync>> {
        init_logging();
@@ -458,6 +463,7 @@ mod tests {
    }

    #[tokio::test]
+    #[serial]
    async fn test_archive_put_with_aws_chunked_allowed_when_strict_mode_enabled() -> Result<(), Box<dyn Error + Send + Sync>> {
        init_logging();
        let mut env = RustFSTestEnvironment::new().await?;
@@ -492,6 +498,7 @@ mod tests {
    }

    #[tokio::test]
+    #[serial]
    async fn test_archive_put_with_aws_chunked_and_effective_encoding_rejects_when_strict_mode_enabled()
    -> Result<(), Box<dyn Error + Send + Sync>> {
        init_logging();
@@ -522,6 +529,7 @@ mod tests {
    }

    #[tokio::test]
+    #[serial]
    async fn test_archive_download_roundtrip_with_http_compression_enabled() -> Result<(), Box<dyn Error + Send + Sync>> {
        init_logging();
        let mut env = RustFSTestEnvironment::new().await?;
@@ -583,6 +591,7 @@ mod tests {
    }

    #[tokio::test]
+    #[serial]
    async fn test_archive_multipart_roundtrip_preserves_bytes() -> Result<(), Box<dyn Error + Send + Sync>> {
        init_logging();
        let mut env = RustFSTestEnvironment::new().await?;
@@ -678,6 +687,7 @@ mod tests {
    }

    #[tokio::test]
+    #[serial]
    async fn test_multipart_get_ignores_empty_conditional_etag_headers() -> Result<(), Box<dyn Error + Send + Sync>> {
        init_logging();
        let mut env = RustFSTestEnvironment::new().await?;
@@ -713,6 +723,7 @@ mod tests {
    }

    #[tokio::test]
+    #[serial]
    async fn test_archive_multipart_with_aws_chunked_and_effective_encoding_roundtrips_by_default()
    -> Result<(), Box<dyn Error + Send + Sync>> {
        init_logging();
@@ -742,6 +753,7 @@ mod tests {
    }

    #[tokio::test]
+    #[serial]
    async fn test_archive_multipart_with_aws_chunked_allowed_when_strict_mode_enabled() -> Result<(), Box<dyn Error + Send + Sync>>
    {
        init_logging();
@@ -771,6 +783,7 @@ mod tests {
    }

    #[tokio::test]
+    #[serial]
    async fn test_archive_multipart_with_aws_chunked_and_effective_encoding_rejects_when_strict_mode_enabled()
    -> Result<(), Box<dyn Error + Send + Sync>> {
        init_logging();
@@ -803,6 +816,7 @@ mod tests {
    }

    #[tokio::test]
+    #[serial]
    async fn test_presigned_get_and_reverse_proxy_preserve_multipart_bytes() -> Result<(), Box<dyn Error + Send + Sync>> {
        init_logging();
        let mut env = RustFSTestEnvironment::new().await?;
@@ -24,9 +24,11 @@ mod tests {
    };
    use http::Method;
    use http::header::CONTENT_TYPE;
+    use serial_test::serial;
    use tracing::info;

    #[tokio::test]
+    #[serial]
    async fn test_dummy_bucket_compatibility_endpoints() {
        init_logging();
        info!("Starting test: dummy-compat bucket APIs should match S3-compatible behavior");
@@ -234,6 +236,7 @@ mod tests {
    }

    #[tokio::test]
+    #[serial]
    async fn test_dummy_bucket_compatibility_endpoints_no_such_bucket() {
        init_logging();
        info!("Starting test: dummy-compat bucket APIs should return NoSuchBucket for missing bucket");
@@ -389,6 +392,7 @@ mod tests {
    }

    #[tokio::test]
+    #[serial]
    async fn test_dummy_bucket_endpoints_http_contracts() {
        init_logging();
        info!("Starting test: dummy-compat bucket API HTTP contracts");
@@ -18,6 +18,7 @@
 use crate::common::{RustFSTestEnvironment, init_logging};
 use aws_sdk_s3::config::{Credentials, Region};
 use aws_sdk_s3::{Client, Config};
+use serial_test::serial;
 use tracing::info;

 async fn create_user(
@@ -50,6 +51,7 @@ fn create_user_client(env: &RustFSTestEnvironment, access_key: &str, secret_key:
 }

 #[tokio::test]
+#[serial]
 async fn test_bucket_policy_authenticated_user() -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
    init_logging();
    if !crate::common::awscurl_available() {
@@ -35,6 +35,7 @@ mod tests {
    use aws_sdk_s3::primitives::ByteStream;
    use aws_sdk_s3::types::{BucketVersioningStatus, VersioningConfiguration};
    use rustfs_data_usage::DataUsageInfo;
+    use serial_test::serial;
    use std::error::Error;
    use tokio::time::{Duration, sleep};
    use tracing::info;
@@ -58,6 +59,7 @@ mod tests {
    /// 3. Query admin data usage API
    /// 4. Verify object count > 0
    #[tokio::test]
+    #[serial]
    async fn test_bucket_object_count_updates_after_put() -> TestResult {
        init_logging();
        info!("RT-09: bucket object count updates after PUT");
@@ -124,6 +126,7 @@ mod tests {
    /// Regression pattern: stats remain unchanged after objects are deleted
    /// (rustfs#5615).
    #[tokio::test]
+    #[serial]
    async fn test_bucket_object_count_updates_after_delete() -> TestResult {
        init_logging();
        info!("RT-09b: bucket object count updates after DELETE");
@@ -217,6 +220,7 @@ mod tests {
    /// Regression pattern: DataUsageInfo undercounts versioned bucket versions
    /// and delete markers (rustfs#3898).
    #[tokio::test]
+    #[serial]
    async fn test_versioned_bucket_stats_count_all_versions() -> TestResult {
        init_logging();
        info!("RT-09c: versioned bucket stats count all versions");
@@ -26,6 +26,7 @@ mod tests {
    use base64::Engine;
    use md5::{Digest as Md5Digest, Md5};
    use rustfs_rio::{Checksum, ChecksumType as RioChecksumType};
+    use serial_test::serial;
    use sha2::Sha256;
    use tracing::info;

@@ -89,6 +90,7 @@ mod tests {

    /// PutObject with Content-MD5: upload succeeds and GetObject returns same content.
    #[tokio::test]
+    #[serial]
    async fn test_put_object_with_content_md5() {
        init_logging();
        info!("TEST: PutObject with Content-MD5");
@@ -124,6 +126,7 @@ mod tests {

    /// PutObject with x-amz-checksum-sha256: upload succeeds and GetObject returns same content.
    #[tokio::test]
+    #[serial]
    async fn test_put_object_with_checksum_sha256() {
        init_logging();
        info!("TEST: PutObject with x-amz-checksum-sha256");
@@ -161,6 +164,7 @@ mod tests {
    /// PutObject with a SHA256 checksum that does NOT match the body must be
    /// rejected (BadDigest / checksum mismatch), NOT accepted with HTTP 200.
    #[tokio::test]
+    #[serial]
    async fn test_put_object_rejects_mismatched_sha256() {
        init_logging();
        info!("TEST: PutObject rejects mismatched x-amz-checksum-sha256 (issue #4341)");
@@ -208,6 +212,7 @@ mod tests {
    /// After PutObject with a correct SHA256 checksum, HeadObject with
    /// ChecksumMode=ENABLED must return that stored base64 SHA256 digest.
    #[tokio::test]
+    #[serial]
    async fn test_head_object_returns_stored_sha256() {
        init_logging();
        info!("TEST: HeadObject returns stored SHA256 with ChecksumMode=ENABLED (issue #4341)");
@@ -253,6 +258,7 @@ mod tests {
    /// Multipart upload with checksum: CreateMultipartUpload, UploadPart(s) with checksum_sha256, CompleteMultipartUpload; then GetObject verifies content.
    /// Uses part size >= 5MB (server minimum) for two parts.
    #[tokio::test]
+    #[serial]
    async fn test_multipart_upload_with_checksum() {
        init_logging();
        info!("TEST: MultipartUpload with checksum (checksum_sha256 on parts)");
@@ -350,6 +356,7 @@ mod tests {
    /// Regression test for issue #2282:
    /// CRC64NVME full-object checksum should match between direct PutObject and multipart upload.
    #[tokio::test]
+    #[serial]
    async fn test_crc64nvme_matches_between_put_object_and_multipart_upload() {
        init_logging();
        info!("TEST: CRC64NVME matches between direct PutObject and multipart upload");
@@ -485,6 +492,7 @@ mod tests {
    /// value is rejected with BadDigest and nothing is stored. Full HEAD/GET header
    /// echo round-trip is additionally exercised by the boto3+awscrt e2e.
    #[tokio::test]
+    #[serial]
    async fn test_additional_checksums_verify_on_write() {
        init_logging();
        info!("TEST: additional checksums (XXHash3/64/128, SHA-512, MD5) verify-on-write");
@@ -16,6 +16,7 @@ use crate::common::RustFSTestClusterEnvironment;
 use aws_sdk_s3::Client;
 use aws_sdk_s3::error::SdkError;
 use bytes::Bytes;
+use serial_test::serial;
 use std::sync::Arc;
 use tokio::sync::Barrier;
 use tracing::{info, warn};
@@ -134,6 +135,7 @@ async fn run_race_iteration(
 }

 #[tokio::test]
+#[serial]
 async fn test_conditional_put_race_cluster() -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
    crate::common::init_logging();
    info!("Starting conditional PUT race test with auto cluster");
@@ -190,6 +192,7 @@ async fn test_conditional_put_race_cluster() -> Result<(), Box<dyn std::error::E
 }

 #[tokio::test]
+#[serial]
 async fn test_conditional_put_basic_cluster() -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
    crate::common::init_logging();
    info!("Starting basic conditional PUT test with auto cluster");
@@ -31,6 +31,7 @@
 //! (toxiproxy / socket proxy) and 5GiB large-object budgets.

 use crate::common::{ClusterTopology, RustFSTestClusterEnvironment};
+use serial_test::serial;

 type TestResult = Result<(), Box<dyn std::error::Error + Send + Sync>>;

@@ -57,6 +58,7 @@ async fn put_get_roundtrip(cluster: &RustFSTestClusterEnvironment, key: &str, pa

 /// 4 nodes x 2 drives, single pool: the multi-drive layout boots and round-trips.
 #[tokio::test]
+#[serial]
 async fn cluster_multidrive_single_pool_smoke() -> TestResult {
    crate::common::init_logging();

@@ -79,6 +81,7 @@ async fn cluster_multidrive_single_pool_smoke() -> TestResult {
 /// Two single-node pools, 2 drives each: the multi-pool layout boots and
 /// round-trips. Every pool is a distinct erasure pool (`pool_idx` 0 and 1).
 #[tokio::test]
+#[serial]
 async fn cluster_two_pool_smoke() -> TestResult {
    crate::common::init_logging();

@@ -53,8 +53,7 @@ pub(crate) const FAST_DATA_USAGE_SCANNER_ENV: &[(&str, &str)] =
 pub const TEST_BUCKET: &str = "e2e-test-bucket";
 const RUSTFS_FULL_FEATURE: &str = "full";
 const TEST_PORT_MIN: u16 = 20_000;
-// Keep allocator ports below the ephemeral range used by bind(..., 0) test helpers.
-const TEST_PORT_RANGE: u16 = 10_000;
+const TEST_PORT_RANGE: u16 = 40_000;
 const TEST_PORT_COUNTER_PATH: &str = "/tmp/rustfs_e2e_next_port";
 const TEST_PORT_LOCK_DIR: &str = "/tmp/rustfs_e2e_port_allocator.lock";
 const TEST_PORT_LOCK_STALE_AFTER: Duration = Duration::from_secs(30);
@@ -3,9 +3,13 @@
 use crate::common::{RustFSTestEnvironment, init_logging, rustfs_binary_path};
 use aws_sdk_s3::primitives::ByteStream;
 use aws_sdk_s3::types::{CompletedMultipartUpload, CompletedPart};
+use serial_test::serial;
 use std::fs;
 use std::path::PathBuf;
 use std::process::Command;
+use std::time::Duration;
+use tokio::net::TcpStream;
+use tokio::time::sleep;
 use tracing::info;

 const COMPRESSION_TEST_BUCKET: &str = "compression-test-bucket";
@@ -84,10 +88,21 @@ async fn start_rustfs_with_compression(env: &mut RustFSTestEnvironment) -> Resul
    env.process = Some(process);

    info!("Waiting for RustFS server with compression enabled on {}", env.address);
-    env.wait_for_server_ready().await
+    for i in 0..30 {
+        if TcpStream::connect(&env.address).await.is_ok() {
+            info!("RustFS server is ready after {} attempts", i + 1);
+            return Ok(());
+        }
+        if i == 29 {
+            return Err("RustFS server failed to become ready".into());
+        }
+        sleep(Duration::from_secs(1)).await;
+    }
+    Ok(())
 }

 #[tokio::test]
+#[serial]
 async fn test_compression_roundtrip() -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
    init_logging();
    info!("Starting compression roundtrip test");
@@ -215,6 +230,7 @@ async fn fetch_range(
 /// (rustfs/rustfs#5957: multipart uploads previously bypassed disk compression
 /// entirely).
 #[tokio::test]
+#[serial]
 async fn test_compression_multipart_roundtrip() -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
    init_logging();
    info!("Starting multipart compression roundtrip test");
@@ -333,6 +349,7 @@ const MPU_HIGH_RATIO_BUCKET: &str = "compression-mpu-high-ratio-bucket";
 /// reproduced the mid-payload Pending truncation (rustfs/rustfs#5957). Every GET shape must return
 /// the exact original bytes, and the stored size must show the data really was compressed.
 #[tokio::test]
+#[serial]
 async fn test_compression_multipart_high_ratio_binary_roundtrip() -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
    init_logging();
    info!("Starting multipart high-ratio binary compression roundtrip test");
@@ -429,6 +446,7 @@ const MPU_COPY_RANGE_LEN: usize = 5 * 1024 * 1024;
 /// range must be decompressed on read and re-compressed into the destination part, so the final
 /// object has to match "source prefix + uploaded tail" byte for byte.
 #[tokio::test]
+#[serial]
 async fn test_compression_multipart_upload_part_copy_roundtrip() -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
    init_logging();
    info!("Starting multipart upload-part-copy compression roundtrip test");
@@ -552,6 +570,7 @@ const MPU_THREE_PARTS_TAIL_SIZE: usize = 512 * 1024;
 /// Three-part upload with uneven part sizes: each partNumber GET must map back to exactly one
 /// compressed part stream, and a suffix range must resolve inside the trailing part.
 #[tokio::test]
+#[serial]
 async fn test_compression_multipart_three_parts_part_number_gets() -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
    init_logging();
    info!("Starting three-part multipart compression partNumber test");
@@ -653,13 +672,24 @@ async fn start_rustfs_with_compression_and_sse(
    env.process = Some(process);

    info!("Waiting for RustFS server with compression + SSE-S3 enabled on {}", env.address);
-    env.wait_for_server_ready().await
+    for i in 0..30 {
+        if TcpStream::connect(&env.address).await.is_ok() {
+            info!("RustFS server is ready after {} attempts", i + 1);
+            return Ok(());
+        }
+        if i == 29 {
+            return Err("RustFS server failed to become ready".into());
+        }
+        sleep(Duration::from_secs(1)).await;
+    }
+    Ok(())
 }

 /// SSE-S3 + disk compression multipart: each part is compressed and then encrypted, and every GET
 /// shape must still return the original plaintext bytes. Physical size must shrink because the
 /// compression runs before encryption.
 #[tokio::test]
+#[serial]
 async fn test_compression_multipart_sse_s3_roundtrip() -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
    use aws_sdk_s3::types::ServerSideEncryption;

@@ -18,6 +18,7 @@
 //! concurrency — a queued connection is served only after a held one closes.

 use crate::common::{RustFSTestEnvironment, init_logging};
+use serial_test::serial;
 use std::time::Duration;
 use tokio::io::{AsyncReadExt, AsyncWriteExt};
 use tokio::net::TcpStream;
@@ -56,6 +57,7 @@ async fn read_response_head(stream: &mut TcpStream, dur: Duration) -> Option<Str
 }

 #[tokio::test]
+#[serial]
 async fn connection_cap_releases_permits_on_close() -> TestResult {
    init_logging();
    let mut env = RustFSTestEnvironment::new().await?;
@@ -87,6 +89,7 @@ async fn open_and_stall(addr: &str) -> std::io::Result<TcpStream> {
 }

 #[tokio::test]
+#[serial]
 async fn connection_cap_blocks_excess_connections_until_permits_free() -> TestResult {
    init_logging();
    let mut env = RustFSTestEnvironment::new().await?;
@@ -33,6 +33,7 @@
 //!     serve the unauthenticated console endpoints at all.

 use crate::common::{RustFSTestEnvironment, init_logging, local_http_client};
+use serial_test::serial;
 use std::error::Error;
 use tokio::time::{Duration, sleep};

@@ -57,6 +58,7 @@ async fn wait_for_console_ready(console_base: &str) -> Result<reqwest::Response,
 }

 #[tokio::test]
+#[serial]
 async fn test_console_over_the_wire_smoke() -> TestResult {
    init_logging();

@@ -22,10 +22,12 @@
 mod tests {
    use crate::common::{RustFSTestEnvironment, init_logging};
    use aws_sdk_s3::primitives::ByteStream;
+    use serial_test::serial;
    use tracing::info;

    /// Verify Content-Encoding header roundtrips through PUT, GET, and HEAD operations
    #[tokio::test]
+    #[serial]
    async fn test_content_encoding_roundtrip() {
        init_logging();
        info!("Starting Content-Encoding roundtrip test");
@@ -103,6 +105,7 @@ mod tests {
    /// Issue #1857: Content-Encoding "aws-chunked" is used by SigV4 streaming clients and must
    /// not be stored or returned. Upload with aws-chunked and verify GET/HEAD do not return it.
    #[tokio::test]
+    #[serial]
    async fn test_content_encoding_aws_chunked_not_returned_issue_1857() {
        init_logging();
        info!("Issue #1857: aws-chunked must not be persisted or returned");
@@ -158,6 +161,7 @@ mod tests {
    /// Issue #2475 / Route A: when aws-chunked is combined with an effective object encoding,
    /// only the effective encoding should roundtrip through GET/HEAD.
    #[tokio::test]
+    #[serial]
    async fn test_content_encoding_aws_chunked_with_effective_encoding_roundtrip() {
        init_logging();
        info!("aws-chunked,gzip should persist only gzip");
@@ -30,6 +30,7 @@ mod tests {
    use base64::Engine as _;
    use base64::engine::general_purpose::STANDARD as BASE64;
    use rustfs_rio::{Checksum, ChecksumType as RioChecksumType};
+    use serial_test::serial;
    use sha2::{Digest, Sha256};
    use tracing::info;

@@ -113,6 +114,7 @@ mod tests {
    }

    #[tokio::test]
+    #[serial]
    async fn test_copy_supports_all_checksum_algorithms() {
        init_logging();

@@ -194,6 +196,7 @@ mod tests {
    }

    #[tokio::test]
+    #[serial]
    async fn test_copy_without_algorithm_preserves_every_supported_source_checksum() {
        init_logging();

@@ -259,6 +262,7 @@ mod tests {
    }

    #[tokio::test]
+    #[serial]
    async fn test_copy_without_algorithm_preserves_composite_checksum_type() {
        init_logging();

@@ -348,6 +352,7 @@ mod tests {
    }

    #[tokio::test]
+    #[serial]
    async fn test_copy_rejects_unknown_algorithm_without_destination_mutation() {
        init_logging();

@@ -448,6 +453,7 @@ mod tests {
    /// bytes, return it in `CopyObjectResult.ChecksumSHA256`, and persist it so a checksum-mode
    /// HEAD on the destination returns the identical value.
    #[tokio::test]
+    #[serial]
    async fn test_copy_with_checksum_algorithm_returns_and_persists_sha256() {
        init_logging();
        info!("Issue #4996: CopyObject with ChecksumAlgorithm=SHA256 must return and persist the checksum");
@@ -517,6 +523,7 @@ mod tests {
    /// No algorithm requested: when the source object already carries a checksum, the copy must
    /// preserve it on the destination (AWS default), visible via a checksum-mode HEAD.
    #[tokio::test]
+    #[serial]
    async fn test_copy_without_algorithm_preserves_source_checksum() {
        init_logging();
        info!("Issue #4996: CopyObject without ChecksumAlgorithm must preserve the source object's checksum");
@@ -596,6 +603,7 @@ mod tests {
    /// checksum-not-inherited path, and exercises the CRC32 code path (a different branch of
    /// ChecksumType::from_string than SHA256).
    #[tokio::test]
+    #[serial]
    async fn test_copy_requested_algorithm_overrides_source_checksum() {
        init_logging();
        info!("Issue #4996: a requested CopyObject checksum algorithm must override the source object's algorithm");
@@ -22,9 +22,11 @@ mod tests {
    use aws_sdk_s3::types::{
        BucketVersioningStatus, CompletedMultipartUpload, CompletedPart, MetadataDirective, StorageClass, VersioningConfiguration,
    };
+    use serial_test::serial;
    use tracing::info;

    #[tokio::test]
+    #[serial]
    async fn copy_object_standard_metadata_copy_replace_and_clear() {
        init_logging();
        info!("Issue #2789: self-copy metadata replacement must preserve object data");
@@ -298,6 +300,7 @@ mod tests {
    }

    #[tokio::test]
+    #[serial]
    async fn copy_object_replace_accepts_each_standard_field_independently() {
        init_logging();
        let mut env = RustFSTestEnvironment::new().await.expect("Failed to create test environment");
@@ -413,6 +416,7 @@ mod tests {
    }

    #[tokio::test]
+    #[serial]
    async fn copy_object_replace_handles_versioned_multipart_source() {
        init_logging();
        let mut env = RustFSTestEnvironment::new().await.expect("Failed to create test environment");
@@ -526,6 +530,7 @@ mod tests {
    }

    #[tokio::test]
+    #[serial]
    async fn invalid_replacement_metadata_does_not_mutate_destination() {
        init_logging();
        let mut env = RustFSTestEnvironment::new().await.expect("Failed to create test environment");
@@ -21,6 +21,7 @@ mod tests {
    use aws_sdk_s3::error::ProvideErrorMetadata;
    use aws_sdk_s3::primitives::ByteStream;
    use aws_sdk_s3::types::{BucketVersioningStatus, MetadataDirective, TaggingDirective, VersioningConfiguration};
+    use serial_test::serial;
    use std::collections::BTreeMap;

    async fn object_tags(client: &Client, bucket: &str, key: &str) -> BTreeMap<String, String> {
@@ -38,6 +39,7 @@ mod tests {
    }

    #[tokio::test]
+    #[serial]
    async fn copy_object_applies_copy_replace_and_empty_tagging_directives() {
        init_logging();
        let mut env = RustFSTestEnvironment::new()
@@ -303,6 +305,7 @@ mod tests {
    }

    #[tokio::test]
+    #[serial]
    async fn copy_object_tag_replacement_honors_request_tag_policy_denial() -> Result<(), Box<dyn std::error::Error + Send + Sync>>
    {
        init_logging();
@@ -21,9 +21,11 @@ mod tests {
    use crate::common::{RustFSTestEnvironment, init_logging};
    use aws_sdk_s3::primitives::ByteStream;
    use aws_sdk_s3::types::{BucketVersioningStatus, VersioningConfiguration};
+    use serial_test::serial;
    use tracing::info;

    #[tokio::test]
+    #[serial]
    async fn test_self_copy_of_historical_version_restores_data_and_metadata() {
        init_logging();
        info!("Issue #4238: self-copy of a historical version must be allowed and preserve metadata");
@@ -163,6 +165,7 @@ mod tests {
    /// version copied via `x-amz-copy-source-version-id` (SDK `CopySourceVersionId`), kept distinct
    /// from the newly created destination `x-amz-version-id`.
    #[tokio::test]
+    #[serial]
    async fn test_copy_of_non_latest_source_version_returns_copy_source_version_id() {
        init_logging();
        info!("Issue #4976: versioned CopyObject must return x-amz-copy-source-version-id for the exact source version");
@@ -47,6 +47,7 @@ mod tests {
    use rustfs_signer::constants::UNSIGNED_PAYLOAD;
    use rustfs_signer::sign_v4;
    use s3s::Body;
+    use serial_test::serial;
    use std::error::Error;

    /// Signed raw `PUT` copy request with an explicit copy-source conditional
@@ -83,6 +84,7 @@ mod tests {
    }

    #[tokio::test]
+    #[serial]
    async fn test_copy_source_if_unmodified_since_valid_and_invalid() -> Result<(), Box<dyn Error + Send + Sync>> {
        init_logging();
        let mut env = RustFSTestEnvironment::new().await?;
@@ -25,11 +25,13 @@
 mod tests {
    use crate::common::{RustFSTestEnvironment, init_logging};
    use aws_sdk_s3::types::{BucketLocationConstraint, CreateBucketConfiguration};
+    use serial_test::serial;
    use std::error::Error;

    /// `CreateBucket` with a `LocationConstraint` body must pass SigV4 validation
    /// and create the bucket, mirroring `minio-go` `MakeBucket(bucket, "us-east-1")`.
    #[tokio::test]
+    #[serial]
    async fn test_create_bucket_with_us_east_1_location_constraint() -> Result<(), Box<dyn Error + Send + Sync>> {
        init_logging();
        let mut env = RustFSTestEnvironment::new().await?;
@@ -60,6 +62,7 @@ mod tests {
    /// A plain `CreateBucket` (no body) must also succeed; guards against a
    /// regression where an empty body would be hashed incorrectly during SigV4.
    #[tokio::test]
+    #[serial]
    async fn test_create_bucket_without_location_constraint() -> Result<(), Box<dyn Error + Send + Sync>> {
        init_logging();
        let mut env = RustFSTestEnvironment::new().await?;
@@ -15,6 +15,7 @@
 use aws_sdk_s3::primitives::ByteStream;
 use aws_sdk_s3::types::{BucketVersioningStatus, VersioningConfiguration};
 use rustfs_data_usage::DataUsageInfo;
+use serial_test::serial;
 use tokio::time::{Duration, sleep};

 use crate::common::{FAST_DATA_USAGE_SCANNER_ENV, RustFSTestEnvironment, TEST_BUCKET, awscurl_get, init_logging};
@@ -59,6 +60,7 @@ where
 /// Regression test for data usage accuracy (issue #1012).
 /// Launches rustfs, writes 1000 objects, then asserts admin data usage reports the full count.
 #[tokio::test(flavor = "multi_thread")]
+#[serial]
 #[ignore = "Starts a rustfs server and requires awscurl; enable when running full E2E"]
 async fn data_usage_reports_all_objects() -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
    init_logging();
@@ -116,6 +118,7 @@ async fn data_usage_reports_all_objects() -> Result<(), Box<dyn std::error::Erro
 /// Regression test for issue #3898.
 /// Versioned buckets should expose versions and delete markers through admin data usage.
 #[tokio::test(flavor = "multi_thread")]
+#[serial]
 #[ignore = "Starts a rustfs server and requires awscurl; enable when running full E2E"]
 async fn data_usage_reports_versioned_objects_and_delete_markers() -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
    init_logging();
@@ -18,6 +18,7 @@ mod tests {
    use aws_sdk_s3::Client;
    use aws_sdk_s3::primitives::ByteStream;
    use aws_sdk_s3::types::{BucketVersioningStatus, VersioningConfiguration};
+    use serial_test::serial;

    async fn create_versioned_bucket(client: &Client, bucket: &str) {
        client
@@ -71,6 +72,7 @@ mod tests {
    }

    #[tokio::test]
+    #[serial]
    async fn test_versioning_only_delete_marker_has_minio_compatible_visibility_for_migration_proof() {
        init_logging();
        let mut env = RustFSTestEnvironment::new().await.expect("create test environment");
@@ -111,6 +113,7 @@ mod tests {
    }

    #[tokio::test]
+    #[serial]
    async fn test_versioning_delete_marker_plus_history_remains_visible_for_migration_proof() {
        init_logging();
        let mut env = RustFSTestEnvironment::new().await.expect("create test environment");
@@ -24,6 +24,7 @@ mod tests {
    use rustfs_signer::constants::UNSIGNED_PAYLOAD;
    use rustfs_signer::sign_v4;
    use s3s::Body;
+    use serial_test::serial;
    use std::error::Error;
    use tokio::io::{AsyncReadExt, AsyncWriteExt};
    use tokio::net::TcpStream;
@@ -91,6 +92,7 @@ mod tests {
    }

    #[tokio::test]
+    #[serial]
    async fn test_delete_object_version_without_content_length_succeeds() -> Result<(), Box<dyn Error + Send + Sync>> {
        init_logging();
        info!("🧪 TEST: signed DELETE Object?versionId succeeds without Content-Length");
@@ -29,6 +29,7 @@ mod tests {
    use crate::common::{RustFSTestEnvironment, init_logging};
    use aws_sdk_s3::Client;
    use aws_sdk_s3::types::{BucketVersioningStatus, Delete, ObjectIdentifier, VersioningConfiguration};
+    use serial_test::serial;
    use tracing::info;

    fn create_s3_client(env: &RustFSTestEnvironment) -> Client {
@@ -41,6 +42,7 @@ mod tests {
    /// a versioned bucket, calling `list_object_versions` **immediately** (with
    /// no sleep) returns the newly-created DeleteMarker with `is_latest = true`.
    #[tokio::test]
+    #[serial]
    async fn test_delete_objects_delete_marker_immediately_visible() {
        init_logging();
        info!("🧪 TEST: DeleteMarker from delete_objects is immediately visible via list_object_versions");
@@ -188,6 +190,7 @@ mod tests {
    /// a single `delete_objects` call all have their delete markers visible
    /// immediately afterwards.
    #[tokio::test]
+    #[serial]
    async fn test_delete_objects_multiple_keys_delete_markers_immediately_visible() {
        init_logging();
        info!("🧪 TEST: Multiple delete markers from delete_objects are immediately visible");
@@ -33,6 +33,7 @@ mod tests {
    use crate::common::{RustFSTestEnvironment, init_logging};
    use aws_sdk_s3::primitives::ByteStream;
    use aws_sdk_s3::types::{BucketVersioningStatus, Delete, ObjectIdentifier, VersioningConfiguration};
+    use serial_test::serial;
    use std::error::Error;
    use tracing::info;

@@ -50,6 +51,7 @@ mod tests {
    /// 4. Verify the object is NOT in LIST
    /// 5. Verify HEAD returns 404
    #[tokio::test]
+    #[serial]
    async fn test_delete_removes_object_from_list() -> TestResult {
        init_logging();
        info!("RT-05: delete removes object from list");
@@ -130,6 +132,7 @@ mod tests {
    /// Regression pattern: batch delete returns success but some objects
    /// remain in LIST.
    #[tokio::test]
+    #[serial]
    async fn test_batch_delete_removes_all_objects() -> TestResult {
        init_logging();
        info!("RT-05c: batch delete removes all objects");
@@ -209,6 +212,7 @@ mod tests {
    /// Covers the pattern where permanent deletion of a specific version
    /// fails with FileAccessDenied (rustfs#4978).
    #[tokio::test]
+    #[serial]
    async fn test_versioned_permanent_delete() -> TestResult {
        init_logging();
        info!("RT-05d: versioned permanent delete");
@@ -279,6 +283,7 @@ mod tests {
    /// Covers the pattern where creating a delete marker and then listing
    /// versions shows incorrect state (rustfs#760).
    #[tokio::test]
+    #[serial]
    async fn test_versioned_delete_marker_and_list_consistency() -> TestResult {
        init_logging();
        info!("RT-05e: versioned delete marker and list consistency");
@@ -374,6 +379,7 @@ mod tests {
    /// Regression pattern: after delete, the object data files remain on disk
    /// (rustfs#5029: Node Does Not Remove Files After Reconnect).
    #[tokio::test]
+    #[serial]
    async fn test_delete_removes_object_head_returns_404() -> TestResult {
        init_logging();
        info!("RT-05f: delete → HEAD 404 consistency");
@@ -32,6 +32,7 @@
 mod tests {
    use crate::common::{RustFSTestClusterEnvironment, init_logging};
    use aws_sdk_s3::primitives::ByteStream;
+    use serial_test::serial;
    use std::error::Error;
    use tokio::time::{Duration, sleep};
    use tracing::info;
@@ -49,6 +50,7 @@ mod tests {
    /// 3. Verify all nodes report healthy
    /// 4. Verify S3 operations work through any node
    #[tokio::test]
+    #[serial]
    async fn test_four_node_cluster_startup_and_health() -> TestResult {
        init_logging();
        info!("RT-10: 4-node cluster startup and health");
@@ -101,6 +103,7 @@ mod tests {
    /// Regression pattern: after a node restart, it cannot rejoin the cluster
    /// or enters a faulty state (rustfs#2601).
    #[tokio::test]
+    #[serial]
    async fn test_cluster_survives_node_restart() -> TestResult {
        init_logging();
        info!("RT-10b: cluster survives node restart");
@@ -165,6 +168,7 @@ mod tests {
    /// Regression pattern: bucket metadata is not replicated to all nodes,
    /// causing NoSuchBucket errors on some nodes (rustfs#3191).
    #[tokio::test]
+    #[serial]
    async fn test_bucket_visible_from_all_nodes() -> TestResult {
        init_logging();
        info!("RT-10c: bucket visible from all nodes");
@@ -23,6 +23,7 @@ use aws_sdk_s3::config::{Credentials, Region};
 use aws_sdk_s3::primitives::ByteStream;
 use aws_sdk_s3::types::{Delete, ObjectIdentifier, Tag, Tagging};
 use aws_sdk_s3::{Client, Config};
+use serial_test::serial;
 use tracing::info;
 use uuid::Uuid;

@@ -173,6 +174,7 @@ async fn cleanup_bucket_and_object(admin: &Client, bucket: &str, key: &str) {

 /// IAM identity policy: GetObject allowed only when `s3:ExistingObjectTag/security` == `public`.
 #[tokio::test]
+#[serial]
 async fn test_e2e_iam_policy_existing_object_tag_get_object() -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
    init_logging();
    if !awscurl_available() {
@@ -231,6 +233,7 @@ async fn test_e2e_iam_policy_existing_object_tag_get_object() -> Result<(), Box<

 /// Bucket policy: same `ExistingObjectTag` condition; user has no canned IAM policy attached.
 #[tokio::test]
+#[serial]
 async fn test_e2e_bucket_policy_existing_object_tag_get_object() -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
    init_logging();
    if !awscurl_available() {
@@ -292,6 +295,7 @@ async fn test_e2e_bucket_policy_existing_object_tag_get_object() -> Result<(), B

 /// STS `AssumeRole` with inline `Policy` (session policy): GetObject only when `ExistingObjectTag/security` is `public`.
 #[tokio::test]
+#[serial]
 async fn test_e2e_sts_assume_role_session_policy_existing_object_tag() -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
    init_logging();
    if !awscurl_available() {
@@ -368,6 +372,7 @@ async fn test_e2e_sts_assume_role_session_policy_existing_object_tag() -> Result

 /// STS inline session policy: DeleteObjects must evaluate `s3:DeleteObject` per requested object key.
 #[tokio::test]
+#[serial]
 async fn test_e2e_sts_session_policy_delete_objects_object_prefix_only() -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
    init_logging();
    if !awscurl_available() {
@@ -66,6 +66,7 @@ mod tests {
    use aws_sdk_s3::error::ProvideErrorMetadata;
    use aws_sdk_s3::primitives::ByteStream;
    use aws_sdk_s3::types::{CompletedMultipartUpload, CompletedPart};
+    use serial_test::serial;
    use sha2::{Digest, Sha256};
    use std::collections::BTreeMap;
    use std::error::Error;
@@ -276,6 +277,7 @@ mod tests {
    }

    #[tokio::test]
+    #[serial]
    async fn codec_streaming_matches_legacy_duplex_body_and_headers() -> TestResult {
        init_logging();

@@ -1,250 +0,0 @@
-// Copyright 2024 RustFS Team
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-//! E2E proof that a mid-stream GET failure is *reportable* — rustfs#4784.
-//!
-//! The functional invariant (a beyond-quorum read must fail rather than return
-//! a clean short body) is already covered by
-//! `degraded_read_eof_regression_test`. This suite covers the half that issue
-//! #4784 got stuck on for a month: whether an operator can tell, from the
-//! source server's log alone, that a GET failed mid-body and **which object**
-//! it failed on.
-//!
-//! The reporter saw only downstream symptoms — `rclone` reporting
-//! `unexpected EOF` on its PUT, and the receiving RustFS logging
-//! `Io error: error reading a body from connection` with a 500. In a cross-remote
-//! `rclone sync`, the source GET body *is* the destination PUT body, so a source
-//! read that ends short of its committed `Content-Length` surfaces as a PUT
-//! failure on the far side. Built-in replication and site replication have the
-//! same shape (read locally, PUT remotely), which is why every transport in that
-//! report failed the same way.
-//!
-//! The source side, meanwhile, said nothing:
-//!   * `GetObjectReaderStream`'s short-read and read-error arms only incremented
-//!     a metric; their log lines sat behind the `tracing-chunk-debug` cargo
-//!     feature, which is not in the default feature set and therefore is not
-//!     compiled into any released binary.
-//!   * `GetObjectStreamingReader` did log mid-stream failures, but only under a
-//!     `request_id` — with no bucket or object name, a failure could not be
-//!     traced back to the object that caused it.
-//!   * Those lines were `warn!`, while `DEFAULT_LOG_LEVEL` is `error`, so a
-//!     default deployment filtered them out anyway.
-//!
-//! This test reproduces the source-side fault against a real server over the S3
-//! API and asserts the operator-visible evidence, at the **default** log level.
-
-#[cfg(test)]
-mod tests {
-    use crate::chaos::DiskFaultHarness;
-    use crate::common::init_logging;
-    use aws_sdk_s3::Client;
-    use aws_sdk_s3::primitives::ByteStream;
-    use aws_sdk_s3::types::{CompletedMultipartUpload, CompletedPart};
-    use serial_test::serial;
-    use std::error::Error;
-    use tokio::time::{Duration, timeout};
-    use tracing::info;
-
-    type TestResult = Result<(), Box<dyn Error + Send + Sync>>;
-
-    const MIB: usize = 1024 * 1024;
-    const OP_TIMEOUT: Duration = Duration::from_secs(90);
-
-    /// The structured event name every GET body failure is tagged with.
-    const STREAM_BODY_EVENT: &str = "get_object_stream_body";
-
-    fn payload(len: usize, seed: u8) -> Vec<u8> {
-        (0..len)
-            .map(|i| (i as u64).wrapping_mul(2654435761).wrapping_add(seed as u64) as u8)
-            .collect()
-    }
-
-    /// Upload a multipart object so the data lands in real `part.*` shard files
-    /// rather than being inlined into `xl.meta` (inlined objects cannot be
-    /// corrupted shard-wise, and never exercise the streaming read path).
-    async fn put_multipart(
-        client: &Client,
-        bucket: &str,
-        key: &str,
-        parts: Vec<Vec<u8>>,
-    ) -> Result<usize, Box<dyn Error + Send + Sync>> {
-        let total_len = parts.iter().map(Vec::len).sum();
-
-        let create = client.create_multipart_upload().bucket(bucket).key(key).send().await?;
-        let upload_id = create.upload_id().ok_or("missing upload id")?.to_string();
-
-        let mut completed = Vec::with_capacity(parts.len());
-        for (index, part_body) in parts.into_iter().enumerate() {
-            let part_number = (index + 1) as i32;
-            let uploaded = timeout(
-                OP_TIMEOUT,
-                client
-                    .upload_part()
-                    .bucket(bucket)
-                    .key(key)
-                    .upload_id(&upload_id)
-                    .part_number(part_number)
-                    .body(ByteStream::from(part_body))
-                    .send(),
-            )
-            .await
-            .map_err(|_| format!("upload_part {part_number} timed out"))??;
-            completed.push(
-                CompletedPart::builder()
-                    .part_number(part_number)
-                    .e_tag(uploaded.e_tag().ok_or("missing part etag")?)
-                    .build(),
-            );
-        }
-
-        timeout(
-            OP_TIMEOUT,
-            client
-                .complete_multipart_upload()
-                .bucket(bucket)
-                .key(key)
-                .upload_id(&upload_id)
-                .multipart_upload(CompletedMultipartUpload::builder().set_parts(Some(completed)).build())
-                .send(),
-        )
-        .await
-        .map_err(|_| "complete_multipart_upload timed out")??;
-
-        Ok(total_len)
-    }
-
-    /// rustfs#4784: reproduce the source-side fault the reporter kept hitting —
-    /// a GET that commits `200` + a full `Content-Length` and then cannot finish
-    /// the body — and assert the server log names the object, at the log level a
-    /// default deployment actually runs with.
-    #[tokio::test]
-    #[serial]
-    async fn midstream_get_failure_is_logged_with_the_object_at_default_log_level() -> TestResult {
-        init_logging();
-        info!("rustfs#4784: a mid-stream GET failure must name its object in the source log");
-
-        let mut harness = DiskFaultHarness::new(4).await?;
-
-        // Capture the child's stdout so the test can read what an operator would.
-        let log_path = format!("{}/server.log", harness.env.temp_dir);
-        harness.env.capture_log_path = Some(log_path.clone());
-
-        // Reproduce a DEFAULT deployment's logging, not the e2e harness's
-        // permissive `rustfs=info`: `DEFAULT_LOG_LEVEL` is `error`. Before the
-        // #4784 fix these failures were `warn!`, so a default deployment
-        // filtered them out entirely — which is why the reporter's source logs
-        // were empty. extra_env is applied after the harness's own RUST_LOG, so
-        // this wins.
-        harness.set_env("RUST_LOG", "error");
-        harness.set_env("RUSTFS_OBS_LOGGER_LEVEL", "error");
-
-        harness.start_server().await?;
-        let client = harness.env.create_s3_client();
-
-        let bucket = "issue4784-source-read";
-        client.create_bucket().bucket(bucket).send().await?;
-
-        // Named after the reporter's restic index objects, which is where they
-        // saw the failures.
-        let key = "index/3b18542ab3af4c3d03f804c7a24173e7836ef7fa447b5d1e9d634f975cc51611";
-        let expected_len = put_multipart(
-            &client,
-            bucket,
-            key,
-            vec![payload(5 * MIB, 71), payload(5 * MIB, 72), payload(5 * MIB, 73)],
-        )
-        .await?;
-
-        // Baseline: the object reads back completely before any corruption.
-        let baseline = timeout(OP_TIMEOUT, client.get_object().bucket(bucket).key(key).send())
-            .await
-            .map_err(|_| "baseline GET timed out")??
-            .body
-            .collect()
-            .await?;
-        assert_eq!(baseline.into_bytes().len(), expected_len, "baseline GET must return the whole object");
-
-        // Corrupt three of four shards in a 2+2 set: below the 2-shard read
-        // quorum. The corruption sits mid-file, so block 0 still reads clean —
-        // the server commits 200 + the full Content-Length and only then cannot
-        // reconstruct. That is the mid-stream window the reporter's downstream
-        // saw as `unexpected EOF`.
-        harness.corrupt_object_shard(0, bucket, key)?;
-        harness.corrupt_object_shard(1, bucket, key)?;
-        harness.corrupt_object_shard(2, bucket, key)?;
-
-        let response = timeout(OP_TIMEOUT, client.get_object().bucket(bucket).key(key).send())
-            .await
-            .map_err(|_| "degraded GET timed out")?;
-
-        // Either outcome is functionally correct (that invariant belongs to
-        // degraded_read_eof_regression_test); this suite only needs the read to
-        // have failed so there is something to report.
-        let delivered = match response {
-            Err(err) => {
-                info!("degraded GET failed before the body: {err}");
-                None
-            }
-            Ok(response) => match response.body.collect().await {
-                Ok(aggregated) => Some(aggregated.into_bytes().len()),
-                Err(err) => {
-                    info!("degraded GET failed mid-body as expected: {err}");
-                    None
-                }
-            },
-        };
-        assert_ne!(
-            delivered,
-            Some(expected_len),
-            "the beyond-quorum read unexpectedly succeeded; this suite needs a failed read to have something to report"
-        );
-
-        // Give the child a moment to flush its stdout.
-        tokio::time::sleep(Duration::from_millis(500)).await;
-        let logged = std::fs::read_to_string(&log_path)?;
-
-        let failure_lines: Vec<&str> = logged.lines().filter(|line| line.contains(STREAM_BODY_EVENT)).collect();
-
-        assert!(
-            !failure_lines.is_empty(),
-            "a mid-stream GET failure produced no `{STREAM_BODY_EVENT}` line at the default log level. \
-             This is the #4784 blind spot: the failure was only counted in a metric, or logged below \
-             `error` and filtered out. Captured log:\n{logged}"
-        );
-
-        // The identity is the whole point: a request_id alone cannot be resolved
-        // back to an object once the request is over.
-        assert!(
-            failure_lines.iter().any(|line| line.contains(key)),
-            "no `{STREAM_BODY_EVENT}` line named the failing object `{key}`, so the report is still \
-             unactionable. Lines seen:\n{}",
-            failure_lines.join("\n")
-        );
-        assert!(
-            failure_lines.iter().any(|line| line.contains(bucket)),
-            "no `{STREAM_BODY_EVENT}` line named the failing bucket `{bucket}`. Lines seen:\n{}",
-            failure_lines.join("\n")
-        );
-
-        info!(
-            "source-side evidence now present: {} stream-body failure line(s) naming the object",
-            failure_lines.len()
-        );
-        for line in &failure_lines {
-            info!("operator-visible evidence: {line}");
-        }
-
-        Ok(())
-    }
-}
@@ -17,6 +17,7 @@
 use crate::common::{RustFSTestEnvironment, admin_request, awscurl_delete, awscurl_get, awscurl_put, init_logging};
 use aws_sdk_s3::config::{Credentials, Region};
 use aws_sdk_s3::{Client, Config};
+use serial_test::serial;
 use tracing::info;

 fn create_user_s3_client(env: &RustFSTestEnvironment, access_key: &str, secret_key: &str) -> Client {
@@ -83,6 +84,7 @@ async fn update_group_members_rejects_invalid_new_group_names() -> Result<(), Bo

 /// Test that deleting a group with members fails, and deleting an empty group succeeds.
 #[tokio::test(flavor = "multi_thread")]
+#[serial]
 #[ignore = "requires awscurl and spawns a real RustFS server"]
 async fn test_delete_group_requires_empty_membership() -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
    init_logging();
@@ -142,6 +144,7 @@ async fn test_delete_group_requires_empty_membership() -> Result<(), Box<dyn std
 /// Test that a user with only group membership (no explicit user policy) gets group policies
 /// and can perform actions allowed by the group (regression test for #2028.1).
 #[tokio::test(flavor = "multi_thread")]
+#[serial]
 #[ignore = "requires awscurl and spawns a real RustFS server"]
 async fn test_user_with_only_group_gets_group_policies() -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
    init_logging();
@@ -209,6 +212,7 @@ async fn test_user_with_only_group_gets_group_policies() -> Result<(), Box<dyn s
 /// Test that after deleting a user who was the only member of a group, the group can be deleted
 /// (regression test for #2028.2: delete group uses backend membership, not stale cache).
 #[tokio::test(flavor = "multi_thread")]
+#[serial]
 #[ignore = "requires awscurl and spawns a real RustFS server"]
 async fn test_delete_group_after_deleting_user() -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
    init_logging();
@@ -16,6 +16,7 @@ use crate::common::{RustFSTestEnvironment, init_logging, local_http_client};
 use aws_sdk_s3::presigning::PresigningConfig;
 use aws_sdk_s3::primitives::ByteStream;
 use aws_sdk_s3::types::{CompletedMultipartUpload, CompletedPart};
+use serial_test::serial;
 use std::time::Duration;
 use tracing::info;

@@ -28,6 +29,7 @@ fn list_contains_key(output: &aws_sdk_s3::operation::list_objects_v2::ListObject
 }

 #[tokio::test]
+#[serial]
 async fn head_object_consistency_after_write_and_multipart_and_presigned_head()
 -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
    init_logging();
@@ -1,5 +1,6 @@
 use crate::common::{RustFSTestEnvironment, init_logging};
 use aws_sdk_s3::primitives::ByteStream;
+use serial_test::serial;
 use tracing::info;

 const RANGE_HEAD_BUCKET: &str = "range-head-test-bucket";
@@ -7,6 +8,7 @@ const RANGE_HEAD_KEY: &str = "range-head-object.bin";
 const ACCEPT_RANGES_BYTES: &str = "bytes";

 #[tokio::test]
+#[serial]
 async fn head_object_advertises_accept_ranges() -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
    init_logging();
    info!("Starting HeadObject Accept-Ranges regression test");
@@ -19,6 +19,7 @@ mod tests {
    use crate::chaos::signed_admin_post;
    use crate::common::{RustFSTestClusterEnvironment, RustFSTestEnvironment, init_logging};
    use aws_sdk_s3::primitives::ByteStream;
+    use serial_test::serial;
    use std::collections::HashSet;
    use std::error::Error;
    use std::path::{Path, PathBuf};
@@ -62,6 +63,7 @@ mod tests {
    }

    #[tokio::test]
+    #[serial]
    async fn test_auto_heal_rebuilds_runtime_wiped_disk_without_restart() {
        init_logging();
        info!("Issue #1533: auto heal should rebuild a runtime-wiped disk in a 4-disk single-node erasure set without restart");
@@ -180,6 +182,7 @@ mod tests {
    }

    #[tokio::test]
+    #[serial]
    async fn test_admin_deep_heal_rebuilds_cleared_disk_in_single_node_erasure_set() {
        init_logging();
        info!("Discussion #2964: admin deep heal should rebuild a wiped disk in a 4-disk single-node erasure set");
@@ -329,6 +332,7 @@ mod tests {
    }

    #[tokio::test(flavor = "multi_thread")]
+    #[serial]
    async fn test_cluster_root_heal_rebuilds_replaced_remote_disk() -> Result<(), Box<dyn Error + Send + Sync>> {
        init_logging();
        info!("Root recursive heal should rebuild data on a remote node after its disk is replaced and the node rejoins");
@@ -440,6 +444,7 @@ mod tests {
    /// topology early-return or the merge hard-fail) turns the down-window
    /// response into a 500 and fails this test.
    #[tokio::test]
+    #[serial]
    async fn test_background_heal_status_degrades_while_peer_down_and_recovers_after_rejoin()
    -> Result<(), Box<dyn Error + Send + Sync>> {
        init_logging();
@@ -1028,6 +1028,20 @@ impl<'a> ReaderPathExpectation<'a> {
        }
    }

+    fn with_size_bucket(
+        object: ReaderObject<'a>,
+        expected_path: &'a str,
+        object_class: &'a str,
+        expected_size_bucket: &'a str,
+    ) -> Self {
+        Self {
+            object,
+            expected_path,
+            object_class,
+            expected_size_bucket: Some(expected_size_bucket),
+        }
+    }
+
    fn with_any_size_bucket(object: ReaderObject<'a>, expected_path: &'a str, object_class: &'a str) -> Self {
        Self {
            object,
@@ -1895,7 +1909,12 @@ async fn four_node_compressed_inline_fallback() -> TestResult {
    assert_reader_path(
        &collector,
        &client,
-        ReaderPathExpectation::for_class(ReaderObject::new(bucket, key, &body, put.e_tag(), None), LEGACY_DUPLEX, COMPRESSED),
+        ReaderPathExpectation::with_size_bucket(
+            ReaderObject::new(bucket, key, &body, put.e_tag(), None),
+            LEGACY_DUPLEX,
+            COMPRESSED,
+            size_bucket(4 * KIB),
+        ),
    )
    .await?;

@@ -2255,7 +2274,6 @@ async fn four_node_manual_transition_distributed_admission_conflict_reports_stat
    hot.set_env("RUSTFS_SCANNER_CYCLE", "3600");
    hot.set_env("RUSTFS_MAX_TRANSITION_WORKERS", "1");
    hot.set_env("RUSTFS_TRANSITION_QUEUE_CAPACITY", "1");
-    hot.set_env("RUSTFS_TRANSITION_QUEUE_SEND_TIMEOUT_MS", "1");
    hot.start().await?;

    let hot_client = hot.create_s3_client(0)?;
@@ -2272,7 +2290,7 @@ async fn four_node_manual_transition_distributed_admission_conflict_reports_stat
            .put_object()
            .bucket(&bucket)
            .key(key)
-            .body(ByteStream::from(payload(1024 * KIB, index)))
+            .body(ByteStream::from(payload(64 * KIB, index)))
            .send()
            .await?;
    }
@@ -101,6 +101,7 @@ use rustfs_config::{
 };
 use rustfs_protos::canonical_make_volume_request_body;
 use rustfs_protos::proto_gen::node_service::{MakeVolumeRequest, MakeVolumeResponse, PingRequest, PingResponse};
+use serial_test::serial;
 use sha2::{Digest, Sha256};
 use std::error::Error;
 use tonic::{Code, Request, Response, Status};
@@ -396,6 +397,7 @@ fn assert_rejected(result: Result<MakeVolumeResponse, Status>, expected: Code, e
 /// Grouped into one server start because each case is independent and spawning
 /// a `rustfs` process per assertion would dominate the runtime.
 #[tokio::test]
+#[serial]
 async fn internode_rpc_signature_default_posture_e2e() -> TestResult {
    init_logging();
    align_rpc_secret_with_server();
@@ -422,6 +424,7 @@ async fn internode_rpc_signature_default_posture_e2e() -> TestResult {
 /// epoch is learned from a real response, then the same server is restarted in place to prove its
 /// replacement epoch rejects the captured request even though the nonce cache is necessarily new.
 #[tokio::test]
+#[serial]
 async fn replay_scope_rejects_replay_path_transplant_and_stale_epoch_e2e() -> TestResult {
    init_logging();
    align_rpc_secret_with_server();
@@ -494,6 +497,7 @@ async fn replay_scope_rejects_replay_path_transplant_and_stale_epoch_e2e() -> Te
 /// A mutating v2 request cannot use that lane; once the epoch proof is returned, the first v3
 /// mutation succeeds. This protects a server restart without reopening a general downgrade path.
 #[tokio::test]
+#[serial]
 async fn replay_scope_strict_requires_v3_after_ping_bootstrap_e2e() -> TestResult {
    init_logging();
    align_rpc_secret_with_server();
@@ -700,6 +704,7 @@ async fn legacy_only_signature_is_accepted_in_default_posture(url: &str) {
 ///
 /// The paired v2 positive control rules out "strict simply breaks everything".
 #[tokio::test]
+#[serial]
 async fn signature_strict_rejects_legacy_only_downgrade() -> TestResult {
    init_logging();
    align_rpc_secret_with_server();
@@ -736,6 +741,7 @@ async fn signature_strict_rejects_legacy_only_downgrade() -> TestResult {
 /// takes the still-open legacy lane), which is what pins the rejection to the
 /// handler's digest gate; the cited message confirms which check spoke.
 #[tokio::test]
+#[serial]
 async fn body_digest_strict_rejects_digestless_mutation() -> TestResult {
    init_logging();
    align_rpc_secret_with_server();
@@ -27,10 +27,12 @@ use aws_sdk_s3::types::{
    ServerSideEncryptionByDefault, ServerSideEncryptionConfiguration, ServerSideEncryptionRule,
 };
 use rustfs_rio::{Checksum, ChecksumType};
+use serial_test::serial;
 use tracing::{debug, info, warn};

 /// Test 1: When bucket is configured with default SSE-S3 encryption, put_object should automatically apply encryption
 #[tokio::test]
+#[serial]
 async fn test_bucket_default_sse_s3_put_object() -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
    init_logging();
    info!("Testing bucket default SSE-S3 encryption impact on put_object");
@@ -153,6 +155,7 @@ async fn test_bucket_default_sse_s3_put_object() -> Result<(), Box<dyn std::erro

 /// Test 2: When bucket is configured with default SSE-KMS encryption, put_object should automatically apply encryption and use the specified KMS key
 #[tokio::test]
+#[serial]
 async fn test_bucket_default_sse_kms_put_object() -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
    init_logging();
    info!("Testing bucket default SSE-KMS encryption impact on put_object");
@@ -272,6 +275,7 @@ async fn test_bucket_default_sse_kms_put_object() -> Result<(), Box<dyn std::err

 /// Test 3: When bucket is configured with default encryption, create_multipart_upload should inherit the configuration
 #[tokio::test]
+#[serial]
 async fn test_bucket_default_sse_kms_multipart_crc32() -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
    init_logging();
    info!("Testing bucket default encryption impact on create_multipart_upload");
@@ -469,6 +473,7 @@ async fn test_bucket_default_sse_kms_multipart_crc32() -> Result<(), Box<dyn std

 /// Test 4: Explicitly specified encryption parameters in requests should override bucket default configuration
 #[tokio::test]
+#[serial]
 async fn test_explicit_encryption_overrides_bucket_default() -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
    init_logging();
    info!("Testing explicitly specified encryption parameters override bucket default configuration");
@@ -564,6 +569,7 @@ async fn test_explicit_encryption_overrides_bucket_default() -> Result<(), Box<d
 /// Test 5: Setting SSE-KMS without a specific key ID should auto-populate the
 /// default KMS key ID so that GetBucketEncryption returns it (issue #3039).
 #[tokio::test]
+#[serial]
 async fn test_sse_kms_without_key_id_populates_default() -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
    init_logging();
    info!("Testing SSE-KMS without explicit key ID populates default key");
@@ -20,6 +20,7 @@ use super::common::{
 };
 use aws_sdk_s3::primitives::ByteStream;
 use aws_sdk_s3::types::{BucketVersioningStatus, ServerSideEncryption, VersioningConfiguration};
+use serial_test::serial;
 use std::error::Error;
 use uuid::Uuid;

@@ -385,6 +386,7 @@ async fn assert_versioned_sse_kms_roundtrip_and_cleanup(
 }

 #[tokio::test]
+#[serial]
 async fn test_configured_local_kms_admin_and_versioned_cleanup() -> TestResult {
    let mut env = LocalKMSTestEnvironment::new().await?;
    env.base_env.start_rustfs_server(Vec::new()).await?;
@@ -432,6 +434,7 @@ async fn test_configured_local_kms_admin_and_versioned_cleanup() -> TestResult {
 }

 #[tokio::test]
+#[serial]
 #[ignore = "requires a Vault binary"]
 async fn test_configured_vault_kms_admin_and_versioned_cleanup() -> TestResult {
    let mut env = VaultTestEnvironment::new().await?;
@@ -32,9 +32,11 @@ use aws_sdk_s3::types::{
    MetadataDirective, ServerSideEncryption, ServerSideEncryptionByDefault, ServerSideEncryptionConfiguration,
    ServerSideEncryptionRule,
 };
+use serial_test::serial;
 use tracing::info;

 #[tokio::test]
+#[serial]
 async fn test_metadata_replace_self_copy_of_sse_object_stays_decryptable() {
    init_logging();
    info!("same-key CopyObject with REPLACE metadata must not re-key an SSE-S3 object");
@@ -134,6 +136,7 @@ async fn test_metadata_replace_self_copy_of_sse_object_stays_decryptable() {
 }

 #[tokio::test]
+#[serial]
 async fn test_metadata_replace_self_copy_dropping_sse_rewrites_plaintext() {
    init_logging();
    info!("same-key CopyObject that drops SSE must rewrite the data, not orphan the ciphertext");
@@ -230,6 +233,7 @@ async fn test_metadata_replace_self_copy_dropping_sse_rewrites_plaintext() {
 }

 #[tokio::test]
+#[serial]
 async fn test_metadata_replace_self_copy_under_bucket_default_sse_stays_decryptable() {
    init_logging();
    info!("bucket default encryption must also keep a same-key copy off the metadata-only path");
@@ -25,9 +25,11 @@ use super::common::{LocalKMSTestEnvironment, create_key_with_specific_id};
 use crate::common::init_logging;
 use aws_sdk_s3::primitives::ByteStream;
 use aws_sdk_s3::types::{BucketVersioningStatus, ServerSideEncryption, VersioningConfiguration};
+use serial_test::serial;
 use tracing::info;

 #[tokio::test]
+#[serial]
 async fn test_self_copy_of_historical_sse_s3_version_is_readable() {
    init_logging();
    info!("Issue #4238 (SSE): restoring an encrypted historical version must stay decryptable");
@@ -22,6 +22,7 @@ use aws_sdk_s3::types::{
    CompletedMultipartUpload, CompletedPart, ServerSideEncryption, ServerSideEncryptionByDefault,
    ServerSideEncryptionConfiguration, ServerSideEncryptionRule,
 };
+use serial_test::serial;
 use std::collections::{HashMap, VecDeque};
 use tracing::info;

@@ -81,6 +82,7 @@ pub(super) fn assert_storage_encrypted(storage_root: &std::path::Path, bucket: &
 }

 #[tokio::test]
+#[serial]
 async fn test_head_reports_managed_metadata_for_sse_s3() -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
    init_logging();
    info!("Validating SSE-S3 managed encryption metadata exposure");
@@ -141,6 +143,7 @@ async fn test_head_reports_managed_metadata_for_sse_s3() -> Result<(), Box<dyn s
 }

 #[tokio::test]
+#[serial]
 async fn test_head_reports_managed_metadata_for_sse_kms_and_copy() -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
    init_logging();
    info!("Validating SSE-KMS managed encryption metadata (including copy)");
@@ -244,6 +247,7 @@ async fn test_head_reports_managed_metadata_for_sse_kms_and_copy() -> Result<(),
 }

 #[tokio::test]
+#[serial]
 async fn test_multipart_upload_writes_encrypted_data() -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
    init_logging();
    info!("Validating ciphertext persistence for multipart SSE-KMS uploads");
@@ -35,11 +35,11 @@ use aws_sdk_s3::config::{Config, Credentials, Region};
 use aws_sdk_s3::error::ProvideErrorMetadata;
 use aws_sdk_s3::primitives::ByteStream;
 use aws_sdk_s3::types::ServerSideEncryption;
+use serial_test::serial;
 use std::time::Duration;
 use tracing::info;

 type TestResult = Result<(), Box<dyn std::error::Error + Send + Sync>>;
-type S3OperationResult<T> = Result<T, Box<aws_sdk_s3::Error>>;

 const ALLOWED_KEY: &str = "kms-matrix-allowed-key";
 const OTHER_KEY: &str = "kms-matrix-other-key";
@@ -131,7 +131,7 @@ fn policy_document(statements: Vec<serde_json::Value>) -> String {
    serde_json::json!({ "Version": "2012-10-17", "Statement": statements }).to_string()
 }

-async fn put_sse_kms(client: &Client, key: &str, kms_key_id: &str) -> S3OperationResult<()> {
+async fn put_sse_kms(client: &Client, key: &str, kms_key_id: &str) -> Result<(), aws_sdk_s3::Error> {
    client
        .put_object()
        .bucket(BUCKET)
@@ -142,23 +142,16 @@ async fn put_sse_kms(client: &Client, key: &str, kms_key_id: &str) -> S3Operatio
        .send()
        .await
        .map(|_| ())
-        .map_err(|error| Box::new(aws_sdk_s3::Error::from(error)))
+        .map_err(aws_sdk_s3::Error::from)
 }

 /// Assert the operation failed with `AccessDenied` rather than any other error.
 ///
 /// A bare `is_err` would also accept `KMSKeyDisabled` or an internal error, which
 /// would hide both a leak of key state and an outage masquerading as a denial.
-fn assert_access_denied<T: std::fmt::Debug, E: std::fmt::Debug + std::borrow::Borrow<aws_sdk_s3::Error>>(
-    result: Result<T, E>,
-    what: &str,
-) {
+fn assert_access_denied<T: std::fmt::Debug>(result: Result<T, aws_sdk_s3::Error>, what: &str) {
    let error = result.expect_err(&format!("{what} must be denied"));
-    assert_eq!(
-        error.borrow().code(),
-        Some("AccessDenied"),
-        "{what} must fail with AccessDenied: {error:?}"
-    );
+    assert_eq!(error.code(), Some("AccessDenied"), "{what} must fail with AccessDenied: {error:?}");
 }

 /// Retry an SSE-KMS write until the identity's policy has reached the request path.
@@ -216,6 +209,7 @@ fn disable_body(key_id: &str) -> String {

 /// Data-path matrix: SSE-KMS writes and reads are authorized against the resolved key.
 #[tokio::test]
+#[serial]
 async fn sse_kms_per_key_authorization_negative_matrix() -> TestResult {
    init_logging();

@@ -304,7 +298,7 @@ async fn sse_kms_per_key_authorization_negative_matrix() -> TestResult {
            .send()
            .await
            .map(|_| ())
-            .map_err(|err| Box::new(aws_sdk_s3::Error::from(err))),
+            .map_err(aws_sdk_s3::Error::from),
        "SSE-KMS read by an identity holding no kms grant",
    );

@@ -318,7 +312,7 @@ async fn sse_kms_per_key_authorization_negative_matrix() -> TestResult {
            .send()
            .await
            .map(|_| ())
-            .map_err(|err| Box::new(aws_sdk_s3::Error::from(err))),
+            .map_err(aws_sdk_s3::Error::from),
        "SSE-KMS read by an identity holding kms:GenerateDataKey but not kms:Decrypt",
    );

@@ -361,6 +355,7 @@ async fn sse_kms_per_key_authorization_negative_matrix() -> TestResult {
 /// Runs without the SSE enforcement switch: admin scoping is unconditional, and
 /// leaving the switch off proves the two planes are independent.
 #[tokio::test]
+#[serial]
 async fn kms_admin_per_key_authorization_negative_matrix() -> TestResult {
    init_logging();

@@ -24,11 +24,13 @@ use super::common::{
    test_sse_kms_encryption, test_sse_s3_encryption,
 };
 use crate::common::{TEST_BUCKET, init_logging};
+use serial_test::serial;
 use tokio::time::{Duration, sleep};
 use tracing::info;

 /// Comprehensive test: Full KMS workflow with all encryption types
 #[tokio::test]
+#[serial]
 async fn test_comprehensive_kms_full_workflow() -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
    init_logging();
    info!("🏁 Start the KMS full-featured synthesis test");
@@ -97,6 +99,7 @@ async fn test_mixed_encryption_workload(

 /// Comprehensive stress test: Large dataset with multiple encryption types
 #[tokio::test]
+#[serial]
 async fn test_comprehensive_stress_test() -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
    init_logging();
    info!("💪 Start the KMS stress test");
@@ -131,6 +134,7 @@ async fn test_comprehensive_stress_test() -> Result<(), Box<dyn std::error::Erro

 /// Test encryption key isolation and security
 #[tokio::test]
+#[serial]
 async fn test_comprehensive_key_isolation() -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
    init_logging();
    info!("🔐 Begin the comprehensive test of encryption key isolation");
@@ -202,6 +206,7 @@ async fn test_comprehensive_key_isolation() -> Result<(), Box<dyn std::error::Er

 /// Test concurrent encryption operations
 #[tokio::test]
+#[serial]
 async fn test_comprehensive_concurrent_operations() -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
    init_logging();
    info!("⚡ Started comprehensive testing of concurrent encryption operations");
@@ -247,6 +252,7 @@ async fn test_comprehensive_concurrent_operations() -> Result<(), Box<dyn std::e

 /// Test encryption/decryption performance with different file sizes
 #[tokio::test]
+#[serial]
 async fn test_comprehensive_performance_benchmark() -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
    init_logging();
    info!("📊 Start KMS performance benchmarking");
@@ -26,6 +26,7 @@ use crate::common::{TEST_BUCKET, init_logging};
 use aws_sdk_s3::types::ServerSideEncryption;
 use base64::Engine;
 use md5::{Digest as Md5Digest, Md5};
+use serial_test::serial;
 use std::sync::Arc;
 use tokio::sync::Semaphore;
 use tracing::{info, warn};
@@ -38,6 +39,7 @@ fn md5_hex(input: impl AsRef<[u8]>) -> String {

 /// Test encryption of zero-byte files (empty files)
 #[tokio::test]
+#[serial]
 async fn test_kms_zero_byte_file_encryption() -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
    init_logging();
    info!("🧪 Testing KMS encryption with zero-byte files");
@@ -111,6 +113,7 @@ async fn test_kms_zero_byte_file_encryption() -> Result<(), Box<dyn std::error::

 /// Test encryption of single-byte files
 #[tokio::test]
+#[serial]
 async fn test_kms_single_byte_file_encryption() -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
    init_logging();
    info!("🧪 Testing KMS encryption with single-byte files");
@@ -203,6 +206,7 @@ async fn test_kms_single_byte_file_encryption() -> Result<(), Box<dyn std::error

 /// Test multipart upload boundary conditions (minimum 5MB part size)
 #[tokio::test]
+#[serial]
 async fn test_kms_multipart_boundary_conditions() -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
    init_logging();
    info!("🧪 Testing KMS multipart upload boundary conditions");
@@ -278,6 +282,7 @@ async fn test_kms_multipart_boundary_conditions() -> Result<(), Box<dyn std::err

 /// Test invalid key scenarios and error handling
 #[tokio::test]
+#[serial]
 async fn test_kms_invalid_key_scenarios() -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
    init_logging();
    info!("🧪 Testing KMS invalid key scenarios and error handling");
@@ -365,6 +370,7 @@ async fn test_kms_invalid_key_scenarios() -> Result<(), Box<dyn std::error::Erro

 /// Test concurrent encryption operations
 #[tokio::test]
+#[serial]
 async fn test_kms_concurrent_encryption() -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
    init_logging();
    info!("🧪 Testing KMS concurrent encryption operations");
@@ -472,6 +478,7 @@ async fn test_kms_concurrent_encryption() -> Result<(), Box<dyn std::error::Erro

 /// Test key validation and security properties
 #[tokio::test]
+#[serial]
 async fn test_kms_key_validation_security() -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
    init_logging();
    info!("🧪 Testing KMS key validation and security properties");
@@ -24,6 +24,7 @@
 use super::common::LocalKMSTestEnvironment;
 use crate::common::{TEST_BUCKET, init_logging};
 use aws_sdk_s3::types::ServerSideEncryption;
+use serial_test::serial;
 use std::fs;
 use std::time::Duration;
 use tokio::time::sleep;
@@ -31,6 +32,7 @@ use tracing::{info, warn};

 /// Test KMS behavior when key directory is temporarily unavailable
 #[tokio::test]
+#[serial]
 async fn test_kms_key_directory_unavailable() -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
    init_logging();
    info!("🧪 Testing KMS behavior with unavailable key directory");
@@ -121,6 +123,7 @@ async fn test_kms_key_directory_unavailable() -> Result<(), Box<dyn std::error::

 /// Test handling of corrupted key files
 #[tokio::test]
+#[serial]
 async fn test_kms_corrupted_key_files() -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
    init_logging();
    info!("🧪 Testing KMS behavior with corrupted key files");
@@ -212,6 +215,7 @@ async fn test_kms_corrupted_key_files() -> Result<(), Box<dyn std::error::Error

 /// Test multipart upload interruption and recovery
 #[tokio::test]
+#[serial]
 async fn test_kms_multipart_upload_interruption() -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
    init_logging();
    info!("🧪 Testing KMS multipart upload interruption and recovery");
@@ -395,6 +399,7 @@ async fn test_kms_multipart_upload_interruption() -> Result<(), Box<dyn std::err

 /// Test KMS resilience to temporary resource constraints
 #[tokio::test]
+#[serial]
 async fn test_kms_resource_constraints() -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
    init_logging();
    info!("🧪 Testing KMS behavior under resource constraints");
@@ -51,6 +51,7 @@ use aws_sdk_s3::types::{
    TransitionStorageClass,
 };
 use serde::Deserialize;
+use serial_test::serial;
 use std::time::{Duration as StdDuration, Instant};
 use tracing::info;

@@ -423,6 +424,7 @@ async fn wait_for_restore_complete(client: &Client, bucket: &str, key: &str, dea
 /// filter as the cause of the deletion and proves the encrypted bucket stays
 /// readable end to end after the scanner has run.
 #[tokio::test]
+#[serial]
 async fn ilm_expiration_on_sse_kms_bucket_under_enforcement() -> TestResult {
    init_logging();

@@ -483,6 +485,7 @@ async fn ilm_expiration_on_sse_kms_bucket_under_enforcement() -> TestResult {
 /// (the mechanism `reliant/tiering.rs` established), so the test does not
 /// depend on scanner scheduling; the 1s scanner cycle stays on as a backstop.
 #[tokio::test]
+#[serial]
 async fn ilm_transition_on_sse_kms_bucket_under_enforcement_reads_back() -> TestResult {
    init_logging();

@@ -24,9 +24,11 @@ use super::common::{
    test_kms_key_management, test_sse_c_encryption,
 };
 use crate::common::{TEST_BUCKET, init_logging};
+use serial_test::serial;
 use tracing::{error, info};

 #[tokio::test]
+#[serial]
 async fn test_local_kms_end_to_end() -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
    init_logging();
    if skip_if_kms_admin_tool_unavailable("test_local_kms_end_to_end") {
@@ -112,6 +114,7 @@ async fn test_local_kms_end_to_end() -> Result<(), Box<dyn std::error::Error + S
 }

 #[tokio::test]
+#[serial]
 async fn test_local_kms_key_isolation() {
    init_logging();
    info!("Starting Local KMS Key Isolation Test");
@@ -212,6 +215,7 @@ async fn test_local_kms_key_isolation() {
 }

 #[tokio::test]
+#[serial]
 async fn test_local_kms_large_file() {
    init_logging();
    info!("Starting Local KMS Large File Test");
@@ -294,6 +298,7 @@ async fn test_local_kms_large_file() {
 }

 #[tokio::test]
+#[serial]
 async fn test_local_kms_multipart_upload() {
    init_logging();
    info!("Starting Local KMS Multipart Upload Test");
@@ -647,10 +652,7 @@ async fn test_multipart_upload_with_sse_c(
 }

 /// Test large multipart upload to verify streaming encryption works correctly
-#[allow(
-    dead_code,
-    reason = "parked behind the TODO in test_local_kms_multipart_upload until streaming encryption is fixed for large files (backlog#1823)"
-)]
+#[allow(dead_code)]
 async fn test_large_multipart_upload(
    s3_client: &aws_sdk_s3::Client,
    bucket: &str,
@@ -23,10 +23,12 @@

 use super::common::{LocalKMSTestEnvironment, sse_customer_key_md5_base64};
 use crate::common::{TEST_BUCKET, init_logging};
+use serial_test::serial;
 use tracing::{debug, info};

 /// Step 1: Test the basic single-file encryption function (ensure that SSE-S3 works properly in non-sharded scenarios)
 #[tokio::test]
+#[serial]
 async fn test_step1_basic_single_file_encryption() -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
    init_logging();
    info!("🧪 Step 1: Test the basic single-file encryption function");
@@ -83,6 +85,7 @@ async fn test_step1_basic_single_file_encryption() -> Result<(), Box<dyn std::er

 /// Step 2: Test the unencrypted shard upload (make sure the shard upload base is working properly)
 #[tokio::test]
+#[serial]
 async fn test_step2_basic_multipart_upload_without_encryption() -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
    init_logging();
    info!("🧪 Step 2: Test unencrypted shard uploads");
@@ -181,6 +184,7 @@ async fn test_step2_basic_multipart_upload_without_encryption() -> Result<(), Bo

 /// Step 3: Test Shard Upload + SSE-S3 Encryption (Focus Test)
 #[tokio::test]
+#[serial]
 async fn test_step3_multipart_upload_with_sse_s3() -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
    init_logging();
    info!("🧪 Step 3: Test Shard Upload + SSE-S3 Encryption");
@@ -304,6 +308,7 @@ async fn test_step3_multipart_upload_with_sse_s3() -> Result<(), Box<dyn std::er

 /// Step 4: test larger multipart uploads (streaming encryption)
 #[tokio::test]
+#[serial]
 async fn test_step4_large_multipart_upload_with_encryption() -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
    init_logging();
    info!("🧪 Step 4: test large-file multipart encryption");
@@ -429,6 +434,7 @@ async fn test_step4_large_multipart_upload_with_encryption() -> Result<(), Box<d

 /// Step 5: test multipart uploads for every encryption mode
 #[tokio::test]
+#[serial]
 async fn test_step5_all_encryption_types_multipart() -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
    init_logging();
    info!("🧪 Step 5: test multipart uploads for every encryption mode");
@@ -19,6 +19,7 @@
 //! filtering, and comprehensive reporting capabilities.

 use crate::common::init_logging;
+use serial_test::serial;
 use std::time::Instant;
 use tokio::time::{Duration, sleep};
 use tracing::{debug, error, info, warn};
@@ -457,6 +458,7 @@ impl KMSTestSuite {

 /// Quick test suite for critical tests only
 #[tokio::test]
+#[serial]
 async fn test_kms_critical_suite() -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
    let config = TestSuiteConfig {
        categories: vec![TestCategory::CoreFunctionality, TestCategory::MultipartEncryption],
@@ -479,6 +481,7 @@ async fn test_kms_critical_suite() -> Result<(), Box<dyn std::error::Error + Sen

 /// Full comprehensive test suite
 #[tokio::test]
+#[serial]
 async fn test_kms_full_suite() -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
    let suite = KMSTestSuite::new();
    let results = suite.run_test_suite().await;
@@ -24,6 +24,7 @@ mod tests {
    use crate::common::{RustFSTestEnvironment, init_logging};
    use aws_sdk_s3::Client;
    use aws_sdk_s3::primitives::ByteStream;
+    use serial_test::serial;
    use std::error::Error;
    use tracing::info;

@@ -35,6 +36,7 @@ mod tests {
    /// PUT with a leading-slash key must succeed and the object must be
    /// readable under the normalized key (leading slash stripped).
    #[tokio::test]
+    #[serial]
    async fn test_put_object_with_leading_slash_key() -> Result<(), Box<dyn Error + Send + Sync>> {
        init_logging();
        info!("Starting test: PUT object with leading slash in key (Issue #2427)");
@@ -92,6 +94,7 @@ mod tests {

    /// Duplicate and repeated slashes after a leading slash collapse MinIO-style.
    #[tokio::test]
+    #[serial]
    async fn test_put_object_with_duplicate_slashes_normalized() -> Result<(), Box<dyn Error + Send + Sync>> {
        init_logging();
        info!("Starting test: duplicate slash normalization (Issue #2427)");
@@ -48,11 +48,6 @@ mod replacement_privileged_e2e_test;
 #[cfg(test)]
 mod degraded_read_eof_regression_test;

-// rustfs#4784: a mid-stream GET failure must be reportable from the source
-// server's log alone — naming the object, at the default log level.
-#[cfg(test)]
-mod get_stream_failure_observability_test;
-
 // backlog#1183: GET codec-streaming fast path must be byte/header identical to
 // the legacy duplex path before its rollout gates can be flipped on by default.
 #[cfg(test)]
@@ -36,6 +36,7 @@ mod tests {
        BucketLifecycleConfiguration, BucketVersioningStatus, ExpirationStatus, LifecycleExpiration, LifecycleRule,
        LifecycleRuleFilter, NoncurrentVersionExpiration, VersioningConfiguration,
    };
+    use serial_test::serial;
    use std::error::Error;
    use tracing::info;

@@ -79,6 +80,7 @@ mod tests {
    ///
    /// This tests the rule persistence path (rustfs#4963: 3 days → 0 days).
    #[tokio::test]
+    #[serial]
    async fn test_lifecycle_expiration_rule_persists_correctly() -> TestResult {
        init_logging();
        info!("RT-03: lifecycle expiration rule persists correctly");
@@ -146,6 +148,7 @@ mod tests {
    /// Covers the pattern where noncurrent version expiration rules are
    /// accepted but old versions are never cleaned up.
    #[tokio::test]
+    #[serial]
    async fn test_lifecycle_noncurrent_version_expiration_rule_persists() -> TestResult {
        init_logging();
        info!("RT-03b: noncurrent version expiration rule persists");
@@ -230,6 +233,7 @@ mod tests {
    /// after restart. Transition rules require a configured remote tier
    /// (tested in reliant/tiering.rs), so this test uses expiration only.
    #[tokio::test]
+    #[serial]
    async fn test_lifecycle_prefix_rule_persists() -> TestResult {
        init_logging();
        info!("RT-04: lifecycle prefix rule persists");
@@ -290,6 +294,7 @@ mod tests {
    /// Regression pattern: DELETE on a versioned object fails or does not
    /// create a delete marker, or the delete marker is not visible in LIST.
    #[tokio::test]
+    #[serial]
    async fn test_delete_marker_creation_and_visibility() -> TestResult {
        init_logging();
        info!("RT-05b: delete marker creation and visibility");
@@ -27,6 +27,7 @@ mod tests {
    use rustfs_signer::constants::UNSIGNED_PAYLOAD;
    use rustfs_signer::sign_v4;
    use s3s::Body;
+    use serial_test::serial;
    use std::error::Error;

    /// Sends a SigV4-signed `GET` where the signature is computed over `sign_path`
@@ -66,6 +67,7 @@ mod tests {

    /// `GET /` (path-style service call) returns `ListBuckets`.
    #[tokio::test]
+    #[serial]
    async fn test_list_buckets_single_slash() -> Result<(), Box<dyn Error + Send + Sync>> {
        init_logging();
        let mut env = RustFSTestEnvironment::new().await?;
@@ -84,6 +86,7 @@ mod tests {
    /// compat layer rewrites `//` to `/` before `s3s` parses/verifies the request,
    /// so both routing and signature verification operate on `/`.
    #[tokio::test]
+    #[serial]
    async fn test_list_buckets_double_slash_browser_compat() -> Result<(), Box<dyn Error + Send + Sync>> {
        init_logging();
        let mut env = RustFSTestEnvironment::new().await?;
@@ -102,6 +105,7 @@ mod tests {
    /// (`GET //bucket`) must be left untouched by the compat layer — it is not a
    /// `ListBuckets` request and s3s continues to reject the empty bucket name.
    #[tokio::test]
+    #[serial]
    async fn test_double_slash_rewrite_is_narrowly_scoped() -> Result<(), Box<dyn Error + Send + Sync>> {
        init_logging();
        let mut env = RustFSTestEnvironment::new().await?;
@@ -15,6 +15,7 @@
 use crate::common::{RustFSTestEnvironment, admin_ok, build_test_s3_config, build_test_sts_client, init_logging};
 use aws_sdk_s3::Client;
 use aws_sdk_s3::error::ProvideErrorMetadata;
+use serial_test::serial;
 use tokio::time::{Duration, Instant};

 fn user_client(env: &RustFSTestEnvironment, access_key: &str, secret_key: &str, session_token: Option<&str>) -> Client {
@@ -75,6 +76,7 @@ async fn create_service_account(
 }

 #[tokio::test]
+#[serial]
 async fn list_buckets_filters_with_iam_bucket_resources() -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
    init_logging();
    let mut env = RustFSTestEnvironment::new().await?;
@@ -24,6 +24,7 @@ mod tests {
    use rustfs_signer::constants::UNSIGNED_PAYLOAD;
    use rustfs_signer::sign_v4;
    use s3s::Body;
+    use serial_test::serial;
    use std::error::Error;
    use tracing::info;

@@ -53,6 +54,7 @@ mod tests {
    }

    #[tokio::test]
+    #[serial]
    async fn test_list_object_versions_metadata_extension_returns_metadata_tags_and_internal()
    -> Result<(), Box<dyn Error + Send + Sync>> {
        init_logging();
@@ -21,6 +21,7 @@ mod tests {
    use aws_sdk_s3::Client;
    use aws_sdk_s3::primitives::ByteStream;
    use aws_sdk_s3::types::{BucketVersioningStatus, VersioningConfiguration};
+    use serial_test::serial;
    use tracing::info;

    fn create_s3_client(env: &RustFSTestEnvironment) -> Client {
@@ -28,6 +29,7 @@ mod tests {
    }

    #[tokio::test]
+    #[serial]
    async fn test_list_object_versions_immediately_returns_latest_put_after_delete_marker() {
        init_logging();
        info!("🧪 TEST: ListObjectVersions returns the newest version immediately after put -> delete -> put");
@@ -180,6 +182,7 @@ mod tests {
    }

    #[tokio::test]
+    #[serial]
    async fn test_list_object_versions_prefix_with_marker_object_returns_children() {
        init_logging();
        info!("🧪 TEST: ListObjectVersions returns prefix children when a marker object also exists");
@@ -17,6 +17,7 @@ mod tests {
    use crate::common::{RustFSTestEnvironment, init_logging};
    use aws_sdk_s3::Client;
    use aws_sdk_s3::primitives::ByteStream;
+    use serial_test::serial;
    use tracing::info;

    /// Helper function to create an S3 client for testing
@@ -59,6 +60,7 @@ mod tests {
    /// The bug was that "folder/" (the object) and "folder/" (derived prefix) were both added to CommonPrefixes
    /// when delimiter was "/" because the deduplication check was explicitly skipped for "/" delimiter.
    #[tokio::test]
+    #[serial]
    async fn test_list_objects_v2_unique_common_prefixes() {
        init_logging();
        info!("Starting test: ListObjectsV2 should return unique CommonPrefixes");
@@ -138,6 +140,7 @@ mod tests {
    /// When both "marker/subdir/" and "marker/subdir/file.txt" exist, listing with
    /// Prefix="marker/" must not duplicate "marker/subdir/file.txt" in Contents.
    #[tokio::test]
+    #[serial]
    async fn test_list_objects_v2_unique_contents_with_explicit_directory_markers() {
        init_logging();
        info!("Starting test: ListObjectsV2 should return unique keys with explicit directory markers");
@@ -205,6 +208,7 @@ mod tests {
    /// and never produce the prefix entry `a/`. Delimiter="/" listings then
    /// returned Contents `a` but silently dropped CommonPrefix `a/`.
    #[tokio::test]
+    #[serial]
    async fn test_list_objects_v2_object_and_same_named_prefix_coexist() {
        init_logging();
        info!("Starting test: ListObjectsV2 should return both object `a` and CommonPrefix `a/`");
@@ -23,6 +23,7 @@ mod tests {
    use rustfs_signer::constants::UNSIGNED_PAYLOAD;
    use rustfs_signer::sign_v4;
    use s3s::Body;
+    use serial_test::serial;
    use std::error::Error;
    use tracing::info;

@@ -52,6 +53,7 @@ mod tests {
    }

    #[tokio::test]
+    #[serial]
    async fn test_list_objects_v2_metadata_extension_returns_metadata_tags_and_internal()
    -> Result<(), Box<dyn Error + Send + Sync>> {
        init_logging();
@@ -30,6 +30,7 @@ mod tests {
    use crate::common::{RustFSTestEnvironment, init_logging};
    use aws_sdk_s3::Client;
    use aws_sdk_s3::primitives::ByteStream;
+    use serial_test::serial;
    use std::collections::HashSet;
    use tracing::info;

@@ -60,6 +61,7 @@ mod tests {
    /// Test for Issue #2775: continuation forwarding must not
    /// skip a child directory when the prefix component repeats in the key.
    #[tokio::test]
+    #[serial]
    async fn test_list_objects_v2_repeated_prefix_continuation() {
        init_logging();
        info!("Starting test: ListObjectsV2 repeated-prefix continuation");
@@ -185,6 +187,7 @@ mod tests {
    /// This is the core bug from issue #1596: the server was returning
    /// IsTruncated=true even when all objects fit within the requested max_keys.
    #[tokio::test]
+    #[serial]
    async fn test_list_objects_v2_not_truncated_when_all_objects_returned() {
        init_logging();
        info!("Starting test: ListObjectsV2 should not be truncated when all objects fit within max_keys");
@@ -249,6 +252,7 @@ mod tests {
    /// 2. NextContinuationToken is returned (not NextMarker)
    /// 3. Using ContinuationToken fetches the remaining objects
    #[tokio::test]
+    #[serial]
    async fn test_list_objects_v2_pagination_with_continuation_token() {
        init_logging();
        info!("Starting test: ListObjectsV2 pagination with continuation token");
@@ -390,6 +394,7 @@ mod tests {
    /// Edge case: when max_keys exactly equals the number of objects,
    /// IsTruncated should be false.
    #[tokio::test]
+    #[serial]
    async fn test_list_objects_v2_max_keys_equals_object_count() {
        init_logging();
        info!("Starting test: ListObjectsV2 with max_keys equal to object count");
@@ -450,6 +455,7 @@ mod tests {
    ///
    /// Edge case: IsTruncated should be false for empty bucket.
    #[tokio::test]
+    #[serial]
    async fn test_list_objects_v2_empty_bucket() {
        init_logging();
        info!("Starting test: ListObjectsV2 with empty bucket");
@@ -489,6 +495,7 @@ mod tests {

    /// Test ListObjectsV2 caps max_keys above the service limit and still paginates.
    #[tokio::test]
+    #[serial]
    async fn test_list_objects_v2_max_keys_above_limit_returns_token() {
        init_logging();
        info!("Starting test: ListObjectsV2 with max_keys above limit");
@@ -556,6 +563,7 @@ mod tests {
    /// S3 semantics: when max_keys is 0, the response should include no objects
    /// and IsTruncated should be false.
    #[tokio::test]
+    #[serial]
    async fn test_list_objects_v2_max_keys_zero() {
        init_logging();
        info!("Starting test: ListObjectsV2 with max_keys=0");
@@ -612,6 +620,7 @@ mod tests {
    /// With max_keys=1000, all 5 visible results (3 prefixes + 2 objects) fit in one
    /// page, so IsTruncated must be false even though raw entry count is much larger.
    #[tokio::test]
+    #[serial]
    async fn test_list_objects_v2_delimiter_collapsed_prefix_no_false_truncation() {
        init_logging();
        info!("Starting test: ListObjectsV2 delimiter collapsed-prefix no false truncation");
@@ -735,6 +744,7 @@ mod tests {
    /// Each page returns up to 50 CommonPrefixes. The server must correctly set
    /// IsTruncated and provide a valid continuation token across all pages.
    #[tokio::test]
+    #[serial]
    async fn test_list_objects_v2_delimiter_small_page_traverses_all() {
        init_logging();
        info!("Starting test: ListObjectsV2 delimiter small page traverses all keys");
@@ -857,6 +867,7 @@ mod tests {
    /// but after delimiter collapse only 10 CommonPrefixes are visible (10 < 1000).
    /// IsTruncated must be false since there are no additional visible results.
    #[tokio::test]
+    #[serial]
    async fn test_list_objects_v2_raw_exceeds_maxkeys_but_visible_below() {
        init_logging();
        info!("Starting test: ListObjectsV2 raw > MaxKeys but visible < MaxKeys after collapse");
@@ -959,6 +970,7 @@ mod tests {
    /// This complements test_list_objects_v2_max_keys_above_limit_returns_token which
    /// tests the non-delimiter case.
    #[tokio::test]
+    #[serial]
    async fn test_list_objects_v2_maxkeys_above_limit_with_delimiter() {
        init_logging();
        info!("Starting test: ListObjectsV2 MaxKeys above limit with delimiter");
@@ -1029,6 +1041,7 @@ mod tests {
    /// the next page: with keys `a`, `a.txt`, `zz` and max_keys=1, page 2
    /// returned `zz` and `a.txt` was never listed.
    #[tokio::test]
+    #[serial]
    async fn test_list_objects_v2_continuation_keeps_keys_after_marker_stem() {
        init_logging();
        info!("Starting test: continuation must not skip keys sorting below the cursor tag");
@@ -31,6 +31,7 @@
 mod tests {
    use crate::common::{RustFSTestEnvironment, init_logging};
    use aws_sdk_s3::primitives::ByteStream;
+    use serial_test::serial;
    use std::collections::HashSet;
    use std::error::Error;
    use tracing::info;
@@ -48,6 +49,7 @@ mod tests {
    /// 3. Verify all 100 keys are returned exactly once
    /// 4. Verify no duplicates or skipped keys
    #[tokio::test]
+    #[serial]
    async fn test_list_objects_v2_completeness_100_objects() -> TestResult {
        init_logging();
        info!("RT-06: listing completeness with 100 objects");
@@ -131,6 +133,7 @@ mod tests {
    /// Regression pattern: prefix filter returns empty or includes wrong keys
    /// (rustfs#5051: empty results for shallow prefixes).
    #[tokio::test]
+    #[serial]
    async fn test_list_objects_v2_prefix_filter_correctness() -> TestResult {
        init_logging();
        info!("RT-06b: prefix filter correctness");
@@ -230,6 +233,7 @@ mod tests {
    /// Regression pattern: delimiter handling produces incorrect CommonPrefixes
    /// or misses objects at the delimiter boundary.
    #[tokio::test]
+    #[serial]
    async fn test_list_objects_v2_delimiter_common_prefixes() -> TestResult {
        init_logging();
        info!("RT-06c: delimiter and CommonPrefixes");
@@ -286,6 +290,7 @@ mod tests {
    /// Regression pattern: IsTruncated=false when there are more objects
    /// (rustfs#4810: walk_dir timeout truncation with false IsTruncated).
    #[tokio::test]
+    #[serial]
    async fn test_list_objects_v2_is_truncated_correctness() -> TestResult {
        init_logging();
        info!("RT-06d: IsTruncated correctness");
@@ -13,6 +13,7 @@
 // limitations under the License.

 use crate::common::{DEFAULT_ACCESS_KEY, DEFAULT_SECRET_KEY, RustFSTestEnvironment};
+use serial_test::serial;
 use std::path::Path;
 use std::process::Command;
 use std::time::Duration;
@@ -72,6 +73,7 @@ fn count_files(root: &Path) -> usize {
 }

 #[tokio::test]
+#[serial]
 async fn test_mc_mirror_small_bucket_completes_without_list_timeout() -> TestResult {
    crate::common::init_logging();
    info!("Starting issue #3107 mc mirror regression test");
@@ -17,7 +17,6 @@
 use crate::common::{RustFSTestEnvironment, init_logging, local_http_client};
 use async_compression::tokio::write::{BzEncoder, XzEncoder};
 use aws_sdk_s3::error::{ProvideErrorMetadata, SdkError};
-use aws_sdk_s3::operation::head_object::HeadObjectOutput;
 use aws_sdk_s3::primitives::ByteStream;
 use aws_sdk_s3::types::{
    ServerSideEncryption, ServerSideEncryptionByDefault, ServerSideEncryptionConfiguration, ServerSideEncryptionRule,
@@ -349,71 +348,6 @@ async fn run_post_object_policy_case(
    Ok(())
 }

-/// One accepted POST Object upload driven end-to-end (backlog#1838): starts a
-/// fresh server, allows anonymous PutObject on `bucket`, posts an anonymous
-/// POST Object form whose policy carries `policy_conditions` and whose form
-/// carries `form_field` on top of the mandatory key+policy fields, then asserts
-/// 204 with an empty body, that `read_stored` observes the submitted value on
-/// the stored object, and that the object body round-tripped unchanged.
-/// `case` prefixes every assertion message so a failing table row is
-/// identifiable at a glance.
-#[allow(clippy::too_many_arguments)]
-async fn run_post_object_accept_case(
-    bucket: &str,
-    object_key: &str,
-    policy_conditions: Vec<serde_json::Value>,
-    form_field: (&str, &str),
-    file_mime: &str,
-    file_body: &[u8],
-    read_stored: fn(&HeadObjectOutput) -> Option<&str>,
-    case: &str,
-) -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
-    let mut env = RustFSTestEnvironment::new().await?;
-    env.start_rustfs_server(vec![]).await?;
-
-    let admin_client = env.create_s3_client();
-    admin_client.create_bucket().bucket(bucket).send().await?;
-    allow_anonymous_put_object(&admin_client, bucket).await?;
-
-    let policy = encode_post_policy(policy_conditions);
-
-    let (field_name, field_value) = form_field;
-    let post_form = reqwest::multipart::Form::new()
-        .text("key", object_key.to_string())
-        .text("policy", policy)
-        .text(field_name.to_string(), field_value.to_string())
-        .part(
-            "file",
-            reqwest::multipart::Part::bytes(file_body.to_vec())
-                .file_name("upload.txt")
-                .mime_str(file_mime)?,
-        );
-
-    let post_resp = local_http_client()
-        .post(format!("{}/{}", env.url, bucket))
-        .multipart(post_form)
-        .send()
-        .await?;
-
-    let status = post_resp.status();
-    let response_body = post_resp.text().await?;
-
-    assert_eq!(status, reqwest::StatusCode::NO_CONTENT, "[{case}] unexpected status");
-    assert!(
-        response_body.is_empty(),
-        "[{case}] 204 response should not contain a body, got: {response_body}"
-    );
-
-    let head = admin_client.head_object().bucket(bucket).key(object_key).send().await?;
-    assert_eq!(read_stored(&head), Some(field_value), "[{case}] stored {field_name} mismatch");
-
-    let get_out = admin_client.get_object().bucket(bucket).key(object_key).send().await?;
-    let uploaded = get_out.body.collect().await?.into_bytes();
-    assert_eq!(uploaded.as_ref(), file_body, "[{case}] uploaded body mismatch");
-
-    Ok(())
-}
-
 /// Table-driven fold of the nine `*_missing_from_policy_conditions` POST
 /// Object tests (backlog#1838 PR1). Every row keeps its original test's exact
 /// bucket, key, form field, file body, and expected error strings; the shared
@@ -1600,6 +1534,59 @@ async fn test_anonymous_post_object_accepts_sse_s3_missing_from_policy_condition
    Ok(())
 }

+#[tokio::test]
+async fn test_anonymous_post_object_accepts_storage_class_exact_policy_match()
+-> Result<(), Box<dyn std::error::Error + Send + Sync>> {
+    init_logging();
+
+    let mut env = RustFSTestEnvironment::new().await?;
+    env.start_rustfs_server(vec![]).await?;
+
+    let bucket = "anon-post-storage-class";
+    let object_key = "post-storage-class-object.txt";
+    let expected_body = b"post-storage-class-body".to_vec();
+    let storage_class = "REDUCED_REDUNDANCY";
+
+    let admin_client = env.create_s3_client();
+    admin_client.create_bucket().bucket(bucket).send().await?;
+    allow_anonymous_put_object(&admin_client, bucket).await?;
+
+    let policy = encode_post_policy(vec![
+        serde_json::json!({ "bucket": bucket }),
+        serde_json::json!({ "key": object_key }),
+        serde_json::json!({ "x-amz-storage-class": storage_class }),
+        serde_json::json!(["content-length-range", 0, 1024]),
+    ]);
+
+    let post_form = reqwest::multipart::Form::new()
+        .text("key", object_key.to_string())
+        .text("policy", policy)
+        .text("x-amz-storage-class", storage_class)
+        .part(
+            "file",
+            reqwest::multipart::Part::bytes(expected_body.clone())
+                .file_name("upload.txt")
+                .mime_str("text/plain")?,
+        );
+
+    let post_resp = local_http_client()
+        .post(format!("{}/{}", env.url, bucket))
+        .multipart(post_form)
+        .send()
+        .await?;
+
+    assert_eq!(post_resp.status(), reqwest::StatusCode::NO_CONTENT);
+
+    let head = admin_client.head_object().bucket(bucket).key(object_key).send().await?;
+    assert_eq!(head.storage_class().map(|value| value.as_str()), Some(storage_class));
+
+    let uploaded = admin_client.get_object().bucket(bucket).key(object_key).send().await?;
+    let uploaded = uploaded.body.collect().await?.into_bytes();
+    assert_eq!(uploaded.as_ref(), expected_body.as_slice());
+
+    Ok(())
+}
+
 #[tokio::test]
 async fn test_anonymous_post_object_rejects_storage_class_missing_from_policy_conditions()
 -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
@@ -2597,182 +2584,512 @@ async fn test_anonymous_post_object_rejects_success_action_redirect_missing_from
    Ok(())
 }

-/// Table-driven fold of the eleven accepted POST Object form-field tests
-/// (backlog#1838 PR4). Every row keeps its original test's exact bucket, key,
-/// form field, submitted value, policy condition, file MIME type, and file
-/// body; the shared shape is: the policy covers the field (exact condition or
-/// `starts-with` prefix), the form submits it, the upload returns 204 with an
-/// empty body, and the stored object echoes the submitted value back.
 #[tokio::test]
-async fn test_anonymous_post_object_accepts_fields_covered_by_policy_conditions()
+async fn test_anonymous_post_object_accepts_metadata_field_covered_by_starts_with()
 -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
    init_logging();

-    // (case, bucket, object_key, field, submitted value, `starts-with` prefix
-    // (`None` pins the field to an exact policy condition), file part MIME type,
-    // file body, stored-value accessor)
-    type Case = (
-        &'static str,
-        &'static str,
-        &'static str,
-        &'static str,
-        &'static str,
-        Option<&'static str>,
-        &'static str,
-        &'static [u8],
-        fn(&HeadObjectOutput) -> Option<&str>,
-    );
-    let cases: &[Case] = &[
-        (
-            "storage-class",
-            "anon-post-storage-class",
-            "post-storage-class-object.txt",
-            "x-amz-storage-class",
-            "REDUCED_REDUNDANCY",
-            None,
-            "text/plain",
-            b"post-storage-class-body",
-            |head: &HeadObjectOutput| head.storage_class().map(|value| value.as_str()),
-        ),
-        (
-            "metadata-starts-with",
-            "anon-post-policy-meta-accept",
-            "uploads/meta-object.txt",
-            "x-amz-meta-project",
-            "alpha-demo",
-            Some("alpha-"),
-            "text/plain",
-            b"post-policy-meta-body",
-            |head: &HeadObjectOutput| head.metadata().and_then(|meta| meta.get("project")).map(String::as_str),
-        ),
-        (
-            "content-type",
-            "anon-post-policy-content-type-accept",
-            "uploads/content-type-accept.txt",
-            "Content-Type",
-            "text/plain",
-            None,
-            "text/plain",
-            b"post-policy-content-type-accept",
-            |head: &HeadObjectOutput| head.content_type(),
-        ),
-        (
-            "content-type-starts-with",
-            "anon-post-policy-content-type-accept",
-            "uploads/content-type-object.txt",
-            "Content-Type",
-            "image/png",
-            Some("image/"),
-            "image/png",
-            b"post-policy-content-type-body",
-            |head: &HeadObjectOutput| head.content_type(),
-        ),
-        (
-            "content-disposition",
-            "anon-post-policy-disposition-accept",
-            "uploads/disposition-object.txt",
-            "Content-Disposition",
-            "attachment; filename=\"upload.txt\"",
-            None,
-            "text/plain",
-            b"post-policy-disposition-body",
-            |head: &HeadObjectOutput| head.content_disposition(),
-        ),
-        (
-            "cache-control",
-            "anon-post-policy-cache-control-accept",
-            "uploads/cache-control-object.txt",
-            "Cache-Control",
-            "max-age=60",
-            None,
-            "text/plain",
-            b"post-policy-cache-control-body",
-            |head: &HeadObjectOutput| head.cache_control(),
-        ),
-        (
-            "content-language",
-            "anon-post-policy-content-language-accept",
-            "uploads/content-language-object.txt",
-            "Content-Language",
-            "en-US",
-            None,
-            "text/plain",
-            b"post-policy-content-language-body",
-            |head: &HeadObjectOutput| head.content_language(),
-        ),
-        (
-            "content-encoding",
-            "anon-post-policy-content-encoding-accept",
-            "uploads/content-encoding-object.txt",
-            "Content-Encoding",
-            "gzip",
-            None,
-            "text/plain",
-            b"post-policy-content-encoding-body",
-            |head: &HeadObjectOutput| head.content_encoding(),
-        ),
-        (
-            "website-redirect-location",
-            "anon-post-policy-website-redirect-accept",
-            "uploads/website-redirect-object.txt",
-            "x-amz-website-redirect-location",
-            "/docs/landing.html",
-            None,
-            "text/plain",
-            b"post-policy-website-redirect-body",
-            |head: &HeadObjectOutput| head.website_redirect_location(),
-        ),
-        (
-            "expires",
-            "anon-post-policy-expires-accept",
-            "uploads/expires-object.txt",
-            "Expires",
-            "Wed, 21 Oct 2037 07:28:00 GMT",
-            None,
-            "text/plain",
-            b"post-policy-expires-body",
-            |head: &HeadObjectOutput| head.expires_string(),
-        ),
-        (
-            "metadata-exact",
-            "anon-post-policy-meta-exact-accept",
-            "uploads/meta-exact-accept-object.txt",
-            "x-amz-meta-project",
-            "alpha-demo",
-            None,
-            "text/plain",
-            b"post-policy-meta-exact-body",
-            |head: &HeadObjectOutput| head.metadata().and_then(|meta| meta.get("project")).map(String::as_str),
-        ),
-    ];
+    let mut env = RustFSTestEnvironment::new().await?;
+    env.start_rustfs_server(vec![]).await?;

-    for (case, bucket, object_key, field, value, starts_with_prefix, file_mime, file_body, read_stored) in cases {
-        let condition = match starts_with_prefix {
-            Some(prefix) => serde_json::json!(["starts-with", format!("${field}"), prefix]),
-            None => {
-                let mut exact = serde_json::Map::new();
-                exact.insert((*field).to_string(), serde_json::Value::String((*value).to_string()));
-                serde_json::Value::Object(exact)
-            }
-        };
+    let bucket = "anon-post-policy-meta-accept";
+    let object_key = "uploads/meta-object.txt";
+    let metadata_value = "alpha-demo";
+    let expected_body = b"post-policy-meta-body".to_vec();

-        run_post_object_accept_case(
-            bucket,
-            object_key,
-            vec![
-                serde_json::json!({ "bucket": bucket }),
-                serde_json::json!({ "key": object_key }),
-                condition,
-                serde_json::json!(["content-length-range", 0, 1024]),
-            ],
-            (field, value),
-            file_mime,
-            file_body,
-            *read_stored,
-            case,
-        )
+    let admin_client = env.create_s3_client();
+    admin_client.create_bucket().bucket(bucket).send().await?;
+    allow_anonymous_put_object(&admin_client, bucket).await?;
+
+    let policy = encode_post_policy(vec![
+        serde_json::json!({ "bucket": bucket }),
+        serde_json::json!({ "key": object_key }),
+        serde_json::json!(["starts-with", "$x-amz-meta-project", "alpha-"]),
+        serde_json::json!(["content-length-range", 0, 1024]),
+    ]);
+
+    let post_form = reqwest::multipart::Form::new()
+        .text("key", object_key.to_string())
+        .text("policy", policy)
+        .text("x-amz-meta-project", metadata_value)
+        .part(
+            "file",
+            reqwest::multipart::Part::bytes(expected_body.clone())
+                .file_name("upload.txt")
+                .mime_str("text/plain")?,
+        );
+
+    let post_resp = local_http_client()
+        .post(format!("{}/{}", env.url, bucket))
+        .multipart(post_form)
+        .send()
        .await?;
-    }
+
+    let status = post_resp.status();
+    let response_body = post_resp.text().await?;
+
+    assert_eq!(status, reqwest::StatusCode::NO_CONTENT);
+    assert!(response_body.is_empty(), "204 response should not contain a body, got: {response_body}");
+
+    let head = admin_client.head_object().bucket(bucket).key(object_key).send().await?;
+    let metadata = head.metadata().expect("head_object should expose uploaded metadata");
+    assert_eq!(metadata.get("project").map(String::as_str), Some(metadata_value));
+
+    Ok(())
+}
+
+#[tokio::test]
+async fn test_anonymous_post_object_accepts_content_type_field_exact_policy_match()
+-> Result<(), Box<dyn std::error::Error + Send + Sync>> {
+    init_logging();
+
+    let mut env = RustFSTestEnvironment::new().await?;
+    env.start_rustfs_server(vec![]).await?;
+
+    let bucket = "anon-post-policy-content-type-accept";
+    let object_key = "uploads/content-type-accept.txt";
+    let content_type = "text/plain";
+    let expected_body = b"post-policy-content-type-accept".to_vec();
+
+    let admin_client = env.create_s3_client();
+    admin_client.create_bucket().bucket(bucket).send().await?;
+    allow_anonymous_put_object(&admin_client, bucket).await?;
+
+    let policy = encode_post_policy(vec![
+        serde_json::json!({ "bucket": bucket }),
+        serde_json::json!({ "key": object_key }),
+        serde_json::json!({ "Content-Type": content_type }),
+        serde_json::json!(["content-length-range", 0, 1024]),
+    ]);
+
+    let post_form = reqwest::multipart::Form::new()
+        .text("key", object_key.to_string())
+        .text("policy", policy)
+        .text("Content-Type", content_type)
+        .part(
+            "file",
+            reqwest::multipart::Part::bytes(expected_body.clone())
+                .file_name("upload.txt")
+                .mime_str(content_type)?,
+        );
+
+    let post_resp = local_http_client()
+        .post(format!("{}/{}", env.url, bucket))
+        .multipart(post_form)
+        .send()
+        .await?;
+
+    let status = post_resp.status();
+    let response_body = post_resp.text().await?;
+
+    assert_eq!(status, reqwest::StatusCode::NO_CONTENT);
+    assert!(response_body.is_empty(), "204 response should not contain a body, got: {response_body}");
+
+    let head = admin_client.head_object().bucket(bucket).key(object_key).send().await?;
+    assert_eq!(head.content_type(), Some(content_type));
+
+    let get_out = admin_client.get_object().bucket(bucket).key(object_key).send().await?;
+    let uploaded = get_out.body.collect().await?.into_bytes();
+    assert_eq!(uploaded.as_ref(), expected_body.as_slice());
+
+    Ok(())
+}
+
+#[tokio::test]
+async fn test_anonymous_post_object_accepts_content_type_field_covered_by_starts_with()
+-> Result<(), Box<dyn std::error::Error + Send + Sync>> {
+    init_logging();
+
+    let mut env = RustFSTestEnvironment::new().await?;
+    env.start_rustfs_server(vec![]).await?;
+
+    let bucket = "anon-post-policy-content-type-accept";
+    let object_key = "uploads/content-type-object.txt";
+    let content_type = "image/png";
+    let expected_body = b"post-policy-content-type-body".to_vec();
+
+    let admin_client = env.create_s3_client();
+    admin_client.create_bucket().bucket(bucket).send().await?;
+    allow_anonymous_put_object(&admin_client, bucket).await?;
+
+    let policy = encode_post_policy(vec![
+        serde_json::json!({ "bucket": bucket }),
+        serde_json::json!({ "key": object_key }),
+        serde_json::json!(["starts-with", "$Content-Type", "image/"]),
+        serde_json::json!(["content-length-range", 0, 1024]),
+    ]);
+
+    let post_form = reqwest::multipart::Form::new()
+        .text("key", object_key.to_string())
+        .text("policy", policy)
+        .text("Content-Type", content_type)
+        .part(
+            "file",
+            reqwest::multipart::Part::bytes(expected_body.clone())
+                .file_name("upload.txt")
+                .mime_str(content_type)?,
+        );
+
+    let post_resp = local_http_client()
+        .post(format!("{}/{}", env.url, bucket))
+        .multipart(post_form)
+        .send()
+        .await?;
+
+    let status = post_resp.status();
+    let response_body = post_resp.text().await?;
+
+    assert_eq!(status, reqwest::StatusCode::NO_CONTENT);
+    assert!(response_body.is_empty(), "204 response should not contain a body, got: {response_body}");
+
+    let head = admin_client.head_object().bucket(bucket).key(object_key).send().await?;
+    assert_eq!(head.content_type(), Some(content_type));
+
+    let get_out = admin_client.get_object().bucket(bucket).key(object_key).send().await?;
+    let uploaded = get_out.body.collect().await?.into_bytes();
+    assert_eq!(uploaded.as_ref(), expected_body.as_slice());
+
+    Ok(())
+}
+
+#[tokio::test]
+async fn test_anonymous_post_object_accepts_content_disposition_field_exact_policy_match()
+-> Result<(), Box<dyn std::error::Error + Send + Sync>> {
+    init_logging();
+
+    let mut env = RustFSTestEnvironment::new().await?;
+    env.start_rustfs_server(vec![]).await?;
+
+    let bucket = "anon-post-policy-disposition-accept";
+    let object_key = "uploads/disposition-object.txt";
+    let content_disposition = "attachment; filename=\"upload.txt\"";
+    let expected_body = b"post-policy-disposition-body".to_vec();
+
+    let admin_client = env.create_s3_client();
+    admin_client.create_bucket().bucket(bucket).send().await?;
+    allow_anonymous_put_object(&admin_client, bucket).await?;
+
+    let policy = encode_post_policy(vec![
+        serde_json::json!({ "bucket": bucket }),
+        serde_json::json!({ "key": object_key }),
+        serde_json::json!({ "Content-Disposition": content_disposition }),
+        serde_json::json!(["content-length-range", 0, 1024]),
+    ]);
+
+    let post_form = reqwest::multipart::Form::new()
+        .text("key", object_key.to_string())
+        .text("policy", policy)
+        .text("Content-Disposition", content_disposition)
+        .part(
+            "file",
+            reqwest::multipart::Part::bytes(expected_body.clone())
+                .file_name("upload.txt")
+                .mime_str("text/plain")?,
+        );
+
+    let post_resp = local_http_client()
+        .post(format!("{}/{}", env.url, bucket))
+        .multipart(post_form)
+        .send()
+        .await?;
+
+    let status = post_resp.status();
+    let response_body = post_resp.text().await?;
+
+    assert_eq!(status, reqwest::StatusCode::NO_CONTENT);
+    assert!(response_body.is_empty(), "204 response should not contain a body, got: {response_body}");
+
+    let head = admin_client.head_object().bucket(bucket).key(object_key).send().await?;
+    assert_eq!(head.content_disposition(), Some(content_disposition));
+
+    let get_out = admin_client.get_object().bucket(bucket).key(object_key).send().await?;
+    let uploaded = get_out.body.collect().await?.into_bytes();
+    assert_eq!(uploaded.as_ref(), expected_body.as_slice());
+
+    Ok(())
+}
+
+#[tokio::test]
+async fn test_anonymous_post_object_accepts_cache_control_field_exact_policy_match()
+-> Result<(), Box<dyn std::error::Error + Send + Sync>> {
+    init_logging();
+
+    let mut env = RustFSTestEnvironment::new().await?;
+    env.start_rustfs_server(vec![]).await?;
+
+    let bucket = "anon-post-policy-cache-control-accept";
+    let object_key = "uploads/cache-control-object.txt";
+    let cache_control = "max-age=60";
+    let expected_body = b"post-policy-cache-control-body".to_vec();
+
+    let admin_client = env.create_s3_client();
+    admin_client.create_bucket().bucket(bucket).send().await?;
+    allow_anonymous_put_object(&admin_client, bucket).await?;
+
+    let policy = encode_post_policy(vec![
+        serde_json::json!({ "bucket": bucket }),
+        serde_json::json!({ "key": object_key }),
+        serde_json::json!({ "Cache-Control": cache_control }),
+        serde_json::json!(["content-length-range", 0, 1024]),
+    ]);
+
+    let post_form = reqwest::multipart::Form::new()
+        .text("key", object_key.to_string())
+        .text("policy", policy)
+        .text("Cache-Control", cache_control)
+        .part(
+            "file",
+            reqwest::multipart::Part::bytes(expected_body.clone())
+                .file_name("upload.txt")
+                .mime_str("text/plain")?,
+        );
+
+    let post_resp = local_http_client()
+        .post(format!("{}/{}", env.url, bucket))
+        .multipart(post_form)
+        .send()
+        .await?;
+
+    let status = post_resp.status();
+    let response_body = post_resp.text().await?;
+
+    assert_eq!(status, reqwest::StatusCode::NO_CONTENT);
+    assert!(response_body.is_empty(), "204 response should not contain a body, got: {response_body}");
+
+    let head = admin_client.head_object().bucket(bucket).key(object_key).send().await?;
+    assert_eq!(head.cache_control(), Some(cache_control));
+
+    let get_out = admin_client.get_object().bucket(bucket).key(object_key).send().await?;
+    let uploaded = get_out.body.collect().await?.into_bytes();
+    assert_eq!(uploaded.as_ref(), expected_body.as_slice());
+
+    Ok(())
+}
+
+#[tokio::test]
+async fn test_anonymous_post_object_accepts_content_language_field_exact_policy_match()
+-> Result<(), Box<dyn std::error::Error + Send + Sync>> {
+    init_logging();
+
+    let mut env = RustFSTestEnvironment::new().await?;
+    env.start_rustfs_server(vec![]).await?;
+
+    let bucket = "anon-post-policy-content-language-accept";
+    let object_key = "uploads/content-language-object.txt";
+    let content_language = "en-US";
+    let expected_body = b"post-policy-content-language-body".to_vec();
+
+    let admin_client = env.create_s3_client();
+    admin_client.create_bucket().bucket(bucket).send().await?;
+    allow_anonymous_put_object(&admin_client, bucket).await?;
+
+    let policy = encode_post_policy(vec![
+        serde_json::json!({ "bucket": bucket }),
+        serde_json::json!({ "key": object_key }),
+        serde_json::json!({ "Content-Language": content_language }),
+        serde_json::json!(["content-length-range", 0, 1024]),
+    ]);
+
+    let post_form = reqwest::multipart::Form::new()
+        .text("key", object_key.to_string())
+        .text("policy", policy)
+        .text("Content-Language", content_language)
+        .part(
+            "file",
+            reqwest::multipart::Part::bytes(expected_body.clone())
+                .file_name("upload.txt")
+                .mime_str("text/plain")?,
+        );
+
+    let post_resp = local_http_client()
+        .post(format!("{}/{}", env.url, bucket))
+        .multipart(post_form)
+        .send()
+        .await?;
+
+    let status = post_resp.status();
+    let response_body = post_resp.text().await?;
+
+    assert_eq!(status, reqwest::StatusCode::NO_CONTENT);
+    assert!(response_body.is_empty(), "204 response should not contain a body, got: {response_body}");
+
+    let head = admin_client.head_object().bucket(bucket).key(object_key).send().await?;
+    assert_eq!(head.content_language(), Some(content_language));
+
+    let get_out = admin_client.get_object().bucket(bucket).key(object_key).send().await?;
+    let uploaded = get_out.body.collect().await?.into_bytes();
+    assert_eq!(uploaded.as_ref(), expected_body.as_slice());
+
+    Ok(())
+}
+
+#[tokio::test]
+async fn test_anonymous_post_object_accepts_content_encoding_field_exact_policy_match()
+-> Result<(), Box<dyn std::error::Error + Send + Sync>> {
+    init_logging();
+
+    let mut env = RustFSTestEnvironment::new().await?;
+    env.start_rustfs_server(vec![]).await?;
+
+    let bucket = "anon-post-policy-content-encoding-accept";
+    let object_key = "uploads/content-encoding-object.txt";
+    let content_encoding = "gzip";
+    let expected_body = b"post-policy-content-encoding-body".to_vec();
+
+    let admin_client = env.create_s3_client();
+    admin_client.create_bucket().bucket(bucket).send().await?;
+    allow_anonymous_put_object(&admin_client, bucket).await?;
+
+    let policy = encode_post_policy(vec![
+        serde_json::json!({ "bucket": bucket }),
+        serde_json::json!({ "key": object_key }),
+        serde_json::json!({ "Content-Encoding": content_encoding }),
+        serde_json::json!(["content-length-range", 0, 1024]),
+    ]);
+
+    let post_form = reqwest::multipart::Form::new()
+        .text("key", object_key.to_string())
+        .text("policy", policy)
+        .text("Content-Encoding", content_encoding)
+        .part(
+            "file",
+            reqwest::multipart::Part::bytes(expected_body.clone())
+                .file_name("upload.txt")
+                .mime_str("text/plain")?,
+        );
+
+    let post_resp = local_http_client()
+        .post(format!("{}/{}", env.url, bucket))
+        .multipart(post_form)
+        .send()
+        .await?;
+
+    let status = post_resp.status();
+    let response_body = post_resp.text().await?;
+
+    assert_eq!(status, reqwest::StatusCode::NO_CONTENT);
+    assert!(response_body.is_empty(), "204 response should not contain a body, got: {response_body}");
+
+    let head = admin_client.head_object().bucket(bucket).key(object_key).send().await?;
+    assert_eq!(head.content_encoding(), Some(content_encoding));
+
+    let get_out = admin_client.get_object().bucket(bucket).key(object_key).send().await?;
+    let uploaded = get_out.body.collect().await?.into_bytes();
+    assert_eq!(uploaded.as_ref(), expected_body.as_slice());
+
+    Ok(())
+}
+
+#[tokio::test]
+async fn test_anonymous_post_object_accepts_website_redirect_location_exact_policy_match()
+-> Result<(), Box<dyn std::error::Error + Send + Sync>> {
+    init_logging();
+
+    let mut env = RustFSTestEnvironment::new().await?;
+    env.start_rustfs_server(vec![]).await?;
+
+    let bucket = "anon-post-policy-website-redirect-accept";
+    let object_key = "uploads/website-redirect-object.txt";
+    let website_redirect_location = "/docs/landing.html";
+    let expected_body = b"post-policy-website-redirect-body".to_vec();
+
+    let admin_client = env.create_s3_client();
+    admin_client.create_bucket().bucket(bucket).send().await?;
+    allow_anonymous_put_object(&admin_client, bucket).await?;
+
+    let policy = encode_post_policy(vec![
+        serde_json::json!({ "bucket": bucket }),
+        serde_json::json!({ "key": object_key }),
+        serde_json::json!({ "x-amz-website-redirect-location": website_redirect_location }),
+        serde_json::json!(["content-length-range", 0, 1024]),
+    ]);
+
+    let post_form = reqwest::multipart::Form::new()
+        .text("key", object_key.to_string())
+        .text("policy", policy)
+        .text("x-amz-website-redirect-location", website_redirect_location)
+        .part(
+            "file",
+            reqwest::multipart::Part::bytes(expected_body.clone())
+                .file_name("upload.txt")
+                .mime_str("text/plain")?,
+        );
+
+    let post_resp = local_http_client()
+        .post(format!("{}/{}", env.url, bucket))
+        .multipart(post_form)
+        .send()
+        .await?;
+
+    let status = post_resp.status();
+    let response_body = post_resp.text().await?;
+
+    assert_eq!(status, reqwest::StatusCode::NO_CONTENT);
+    assert!(response_body.is_empty(), "204 response should not contain a body, got: {response_body}");
+
+    let head = admin_client.head_object().bucket(bucket).key(object_key).send().await?;
+    assert_eq!(head.website_redirect_location(), Some(website_redirect_location));
+
+    let get_out = admin_client.get_object().bucket(bucket).key(object_key).send().await?;
+    let uploaded = get_out.body.collect().await?.into_bytes();
+    assert_eq!(uploaded.as_ref(), expected_body.as_slice());
+
+    Ok(())
+}
+
+#[tokio::test]
+async fn test_anonymous_post_object_accepts_expires_field_exact_policy_match()
+-> Result<(), Box<dyn std::error::Error + Send + Sync>> {
+    init_logging();
+
+    let mut env = RustFSTestEnvironment::new().await?;
+    env.start_rustfs_server(vec![]).await?;
+
+    let bucket = "anon-post-policy-expires-accept";
+    let object_key = "uploads/expires-object.txt";
+    let expires = "Wed, 21 Oct 2037 07:28:00 GMT";
+    let expected_body = b"post-policy-expires-body".to_vec();
+
+    let admin_client = env.create_s3_client();
+    admin_client.create_bucket().bucket(bucket).send().await?;
+    allow_anonymous_put_object(&admin_client, bucket).await?;
+
+    let policy = encode_post_policy(vec![
+        serde_json::json!({ "bucket": bucket }),
+        serde_json::json!({ "key": object_key }),
+        serde_json::json!({ "Expires": expires }),
+        serde_json::json!(["content-length-range", 0, 1024]),
+    ]);
+
+    let post_form = reqwest::multipart::Form::new()
+        .text("key", object_key.to_string())
+        .text("policy", policy)
+        .text("Expires", expires)
+        .part(
+            "file",
+            reqwest::multipart::Part::bytes(expected_body.clone())
+                .file_name("upload.txt")
+                .mime_str("text/plain")?,
+        );
+
+    let post_resp = local_http_client()
+        .post(format!("{}/{}", env.url, bucket))
+        .multipart(post_form)
+        .send()
+        .await?;
+
+    let status = post_resp.status();
+    let response_body = post_resp.text().await?;
+
+    assert_eq!(status, reqwest::StatusCode::NO_CONTENT);
+    assert!(response_body.is_empty(), "204 response should not contain a body, got: {response_body}");
+
+    let head = admin_client.head_object().bucket(bucket).key(object_key).send().await?;
+    assert_eq!(head.expires_string(), Some(expires));
+
+    let get_out = admin_client.get_object().bucket(bucket).key(object_key).send().await?;
+    let uploaded = get_out.body.collect().await?.into_bytes();
+    assert_eq!(uploaded.as_ref(), expected_body.as_slice());

    Ok(())
 }
@@ -3123,6 +3440,64 @@ async fn test_anonymous_post_object_accepts_tagging_field_exact_policy_match()
    Ok(())
 }

+#[tokio::test]
+async fn test_anonymous_post_object_accepts_metadata_field_exact_policy_match()
+-> Result<(), Box<dyn std::error::Error + Send + Sync>> {
+    init_logging();
+
+    let mut env = RustFSTestEnvironment::new().await?;
+    env.start_rustfs_server(vec![]).await?;
+
+    let bucket = "anon-post-policy-meta-exact-accept";
+    let object_key = "uploads/meta-exact-accept-object.txt";
+    let metadata_value = "alpha-demo";
+    let expected_body = b"post-policy-meta-exact-body".to_vec();
+
+    let admin_client = env.create_s3_client();
+    admin_client.create_bucket().bucket(bucket).send().await?;
+    allow_anonymous_put_object(&admin_client, bucket).await?;
+
+    let policy = encode_post_policy(vec![
+        serde_json::json!({ "bucket": bucket }),
+        serde_json::json!({ "key": object_key }),
+        serde_json::json!({ "x-amz-meta-project": metadata_value }),
+        serde_json::json!(["content-length-range", 0, 1024]),
+    ]);
+
+    let post_form = reqwest::multipart::Form::new()
+        .text("key", object_key.to_string())
+        .text("policy", policy)
+        .text("x-amz-meta-project", metadata_value)
+        .part(
+            "file",
+            reqwest::multipart::Part::bytes(expected_body.clone())
+                .file_name("upload.txt")
+                .mime_str("text/plain")?,
+        );
+
+    let post_resp = local_http_client()
+        .post(format!("{}/{}", env.url, bucket))
+        .multipart(post_form)
+        .send()
+        .await?;
+
+    let status = post_resp.status();
+    let response_body = post_resp.text().await?;
+
+    assert_eq!(status, reqwest::StatusCode::NO_CONTENT);
+    assert!(response_body.is_empty(), "204 response should not contain a body, got: {response_body}");
+
+    let head = admin_client.head_object().bucket(bucket).key(object_key).send().await?;
+    let metadata = head.metadata().expect("head_object should expose uploaded metadata");
+    assert_eq!(metadata.get("project").map(String::as_str), Some(metadata_value));
+
+    let get_out = admin_client.get_object().bucket(bucket).key(object_key).send().await?;
+    let uploaded = get_out.body.collect().await?.into_bytes();
+    assert_eq!(uploaded.as_ref(), expected_body.as_slice());
+
+    Ok(())
+}
+
 #[tokio::test]
 async fn test_anonymous_post_object_allows_x_ignore_fields_outside_policy_conditions()
 -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
@@ -16,6 +16,7 @@ use crate::common::RustFSTestClusterEnvironment;
 use aws_sdk_s3::Client;
 use aws_sdk_s3::error::SdkError;
 use bytes::Bytes;
+use serial_test::serial;
 use std::sync::Arc;
 use tokio::sync::Barrier;
 use tracing::{info, warn};
@@ -50,6 +51,7 @@ fn format_s3_error(err: SdkError<aws_sdk_s3::operation::put_object::PutObjectErr
 }

 #[tokio::test]
+#[serial]
 async fn test_concurrent_cluster_overwrites_do_not_fail_namespace_lock_quorum() -> TestResult {
    crate::common::init_logging();
    info!("Starting namespace lock quorum regression test with auto cluster");
@@ -126,6 +128,7 @@ async fn test_concurrent_cluster_overwrites_do_not_fail_namespace_lock_quorum()
 /// `StorageError::other(...)` → `StorageError::Io(...)`, which fell through to
 /// `S3ErrorCode::InternalError` (500) in the error mapping.
 #[tokio::test]
+#[serial]
 async fn test_concurrent_put_same_key_never_returns_500() -> TestResult {
    crate::common::init_logging();
    info!("Starting concurrent PUT 500 regression test");
@@ -37,6 +37,7 @@ use crate::common::{RustFSTestEnvironment, init_logging, local_http_client};
 use aws_sdk_s3::primitives::ByteStream;
 use rustfs_signer::constants::UNSIGNED_PAYLOAD;
 use rustfs_signer::request_signature_v4::{SIGN_V4_ALGORITHM, get_scope, get_signature, get_signing_key};
+use serial_test::serial;
 use std::fmt::Write as _;
 use time::macros::format_description;
 use time::{Duration, OffsetDateTime};
@@ -182,6 +183,7 @@ async fn setup(env: &mut RustFSTestEnvironment) -> Result<(), Box<dyn std::error
 /// this, every negative assertion below could pass for the wrong reason (a
 /// broken signer that never produces a valid signature).
 #[tokio::test]
+#[serial]
 async fn valid_header_sigv4_request_succeeds() -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
    init_logging();
    let mut env = RustFSTestEnvironment::new().await?;
@@ -212,6 +214,7 @@ async fn valid_header_sigv4_request_succeeds() -> Result<(), Box<dyn std::error:
 /// (a) Tampering the `Signature=` component must be rejected with
 /// SignatureDoesNotMatch / 403.
 #[tokio::test]
+#[serial]
 async fn tampered_signature_returns_signature_does_not_match() -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
    init_logging();
    let mut env = RustFSTestEnvironment::new().await?;
@@ -251,6 +254,7 @@ async fn tampered_signature_returns_signature_does_not_match() -> Result<(), Box
 /// (b) A valid AccessKeyId paired with the wrong secret key must be rejected
 /// with SignatureDoesNotMatch / 403.
 #[tokio::test]
+#[serial]
 async fn wrong_secret_key_returns_signature_does_not_match() -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
    init_logging();
    let mut env = RustFSTestEnvironment::new().await?;
@@ -275,6 +279,7 @@ async fn wrong_secret_key_returns_signature_does_not_match() -> Result<(), Box<d
 /// signature itself is valid (it covers the *declared* hash), so the server is
 /// forced to detect the payload/hash mismatch while streaming the body.
 #[tokio::test]
+#[serial]
 async fn tampered_payload_is_rejected() -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
    init_logging();
    let mut env = RustFSTestEnvironment::new().await?;
@@ -315,6 +320,7 @@ async fn tampered_payload_is_rejected() -> Result<(), Box<dyn std::error::Error
 /// x-amz-date both derive from the same skewed timestamp, so skew — not a
 /// signature mismatch — is the failure.
 #[tokio::test]
+#[serial]
 async fn skewed_date_returns_request_time_too_skewed() -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
    init_logging();
    let mut env = RustFSTestEnvironment::new().await?;
@@ -338,6 +344,7 @@ async fn skewed_date_returns_request_time_too_skewed() -> Result<(), Box<dyn std
 /// structurally invalid SigV4 header that must be rejected before any
 /// credential/service handling.
 #[tokio::test]
+#[serial]
 async fn malformed_authorization_header_returns_clean_4xx() -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
    init_logging();
    let mut env = RustFSTestEnvironment::new().await?;
@@ -32,6 +32,7 @@
 mod tests {
    use crate::common::{RustFSTestEnvironment, init_logging};
    use aws_sdk_s3::types::{BucketVersioningStatus, VersioningConfiguration};
+    use serial_test::serial;
    use std::error::Error;
    use tracing::info;

@@ -46,6 +47,7 @@ mod tests {
    /// starts successfully with notification enabled and can serve S3 requests.
    /// A full webhook delivery test is in notification_webhook_test.rs.
    #[tokio::test]
+    #[serial]
    async fn test_notification_enabled_server_starts_cleanly() -> TestResult {
        init_logging();
        info!("RT-01: notification enabled server starts cleanly");
@@ -90,6 +92,7 @@ mod tests {
    /// 3. Restart server
    /// 4. Verify notification config still exists
    #[tokio::test]
+    #[serial]
    async fn test_notification_config_survives_restart() -> TestResult {
        init_logging();
        info!("RT-02: notification config survives restart");
@@ -47,6 +47,7 @@ use rustfs_utils::egress::ENV_OUTBOUND_ALLOW_ORIGINS;
 use rustfs_utils::http::headers::{AMZ_REQUEST_ID, REQUEST_ID_HEADER};
 use s3s::Body;
 use serde_json::Value;
+use serial_test::serial;
 use std::error::Error;
 use std::io::Cursor;
 use std::path::Path;
@@ -624,6 +625,7 @@ fn assert_generated_request_id_correlation(record: &Value, request_id: &str) {
 /// RUSTFS_NOTIFY_ENABLE, an HTTPS webhook using a configured CA must become
 /// online and receive a real S3 event POST.
 #[tokio::test]
+#[serial]
 async fn test_https_webhook_target_delivers_event_with_notify_env_enabled() -> TestResult {
    init_logging();

@@ -678,6 +680,7 @@ async fn test_https_webhook_target_delivers_event_with_notify_env_enabled() -> T
 /// PUT / multipart-complete / DELETE each deliver one event with correct fields,
 /// and the prefix/suffix filter drops non-matching keys.
 #[tokio::test]
+#[serial]
 async fn test_webhook_event_delivery_and_filtering() -> TestResult {
    init_logging();

@@ -897,6 +900,7 @@ async fn test_webhook_event_delivery_and_filtering() -> TestResult {
 /// An event queued while the target endpoint rejects delivery survives on the
 /// durable store and is redelivered once the endpoint comes back.
 #[tokio::test]
+#[serial]
 async fn test_webhook_redelivers_event_after_target_recovers() -> TestResult {
    init_logging();

@@ -20,6 +20,7 @@ use rustfs_signer::constants::UNSIGNED_PAYLOAD;
 use rustfs_signer::{pre_sign_v4, sign_v4};
 use rustfs_utils::egress::ENV_OUTBOUND_ALLOW_ORIGINS;
 use s3s::Body;
+use serial_test::serial;
 use std::collections::HashMap;
 use std::error::Error;
 use time::OffsetDateTime;
@@ -547,6 +548,7 @@ async fn read_listen_notification_event(
 }

 #[tokio::test]
+#[serial]
 async fn test_notification_target_persists_across_restart_and_delete() -> Result<(), Box<dyn Error + Send + Sync>> {
    init_logging();

@@ -606,6 +608,7 @@ async fn test_notification_target_persists_across_restart_and_delete() -> Result
 }

 #[tokio::test]
+#[serial]
 async fn test_notification_target_with_path_is_online_via_transport_probe() -> Result<(), Box<dyn Error + Send + Sync>> {
    init_logging();

@@ -638,6 +641,7 @@ async fn test_notification_target_with_path_is_online_via_transport_probe() -> R
 }

 #[tokio::test]
+#[serial]
 async fn test_get_object_lambda_accepts_presigned_requests() -> Result<(), Box<dyn Error + Send + Sync>> {
    init_logging();

@@ -678,6 +682,7 @@ async fn test_get_object_lambda_accepts_presigned_requests() -> Result<(), Box<d
 }

 #[tokio::test]
+#[serial]
 async fn test_get_object_lambda_accepts_named_webhook_target_arn() -> Result<(), Box<dyn Error + Send + Sync>> {
    init_logging();

@@ -717,6 +722,7 @@ async fn test_get_object_lambda_accepts_named_webhook_target_arn() -> Result<(),
 }

 #[tokio::test]
+#[serial]
 async fn test_get_object_lambda_invokes_runtime_webhook_target() -> Result<(), Box<dyn Error + Send + Sync>> {
    init_logging();

@@ -784,6 +790,7 @@ async fn test_get_object_lambda_invokes_runtime_webhook_target() -> Result<(), B
 }

 #[tokio::test]
+#[serial]
 async fn test_get_object_lambda_passthroughs_non_success_webhook_response() -> Result<(), Box<dyn Error + Send + Sync>> {
    init_logging();

@@ -843,6 +850,7 @@ async fn test_get_object_lambda_passthroughs_non_success_webhook_response() -> R
 }

 #[tokio::test]
+#[serial]
 async fn test_get_object_lambda_rejects_success_response_without_auth_headers() -> Result<(), Box<dyn Error + Send + Sync>> {
    init_logging();

@@ -888,6 +896,7 @@ async fn test_get_object_lambda_rejects_success_response_without_auth_headers()
 }

 #[tokio::test]
+#[serial]
 async fn test_get_object_lambda_rejects_success_response_with_mismatched_auth_headers() -> Result<(), Box<dyn Error + Send + Sync>>
 {
    init_logging();
@@ -934,6 +943,7 @@ async fn test_get_object_lambda_rejects_success_response_with_mismatched_auth_he
 }

 #[tokio::test]
+#[serial]
 async fn test_get_object_lambda_rejects_unsupported_target_type() -> Result<(), Box<dyn Error + Send + Sync>> {
    init_logging();

@@ -970,6 +980,7 @@ async fn test_get_object_lambda_rejects_unsupported_target_type() -> Result<(),
 }

 #[tokio::test]
+#[serial]
 async fn test_get_object_lambda_rejects_unconfigured_target() -> Result<(), Box<dyn Error + Send + Sync>> {
    init_logging();

@@ -1006,6 +1017,7 @@ async fn test_get_object_lambda_rejects_unconfigured_target() -> Result<(), Box<
 }

 #[tokio::test]
+#[serial]
 async fn test_get_object_lambda_rejects_disabled_target() -> Result<(), Box<dyn Error + Send + Sync>> {
    init_logging();

@@ -1051,6 +1063,7 @@ async fn test_get_object_lambda_rejects_disabled_target() -> Result<(), Box<dyn
 }

 #[tokio::test]
+#[serial]
 async fn test_configure_object_lambda_target_rejects_invalid_endpoint() -> Result<(), Box<dyn Error + Send + Sync>> {
    init_logging();

@@ -1093,6 +1106,7 @@ async fn test_configure_object_lambda_target_rejects_invalid_endpoint() -> Resul
 }

 #[tokio::test]
+#[serial]
 async fn test_configure_object_lambda_notify_webhook_rejects_response_header_timeout_key()
 -> Result<(), Box<dyn Error + Send + Sync>> {
    init_logging();
@@ -1126,6 +1140,7 @@ async fn test_configure_object_lambda_notify_webhook_rejects_response_header_tim
 }

 #[tokio::test]
+#[serial]
 async fn test_listen_notification_emits_after_put_object() -> Result<(), Box<dyn Error + Send + Sync>> {
    init_logging();

@@ -1169,6 +1184,7 @@ async fn test_listen_notification_emits_after_put_object() -> Result<(), Box<dyn
 }

 #[tokio::test]
+#[serial]
 async fn test_listen_notification_emits_on_empty_bucket_when_notify_disabled() -> Result<(), Box<dyn Error + Send + Sync>> {
    init_logging();

@@ -1203,6 +1219,7 @@ async fn test_listen_notification_emits_on_empty_bucket_when_notify_disabled() -
 }

 #[tokio::test]
+#[serial]
 async fn test_listen_notification_fans_in_remote_node_events() -> Result<(), Box<dyn Error + Send + Sync>> {
    init_logging();

@@ -13,6 +13,7 @@
 // limitations under the License.

 use aws_sdk_s3::primitives::ByteStream;
+use serial_test::serial;
 use std::path::{Path, PathBuf};
 use uuid::Uuid;

@@ -23,6 +24,7 @@ const TEST_OBJECT: &str = "large-object.bin";
 const PAYLOAD_SIZE: usize = 512 * 1024;

 #[tokio::test(flavor = "multi_thread")]
+#[serial]
 async fn unversioned_overwrite_removes_previous_physical_data_dir() -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
    init_logging();

@@ -19,17 +19,32 @@ use std::time::Instant;
 use tokio::time::{Duration, sleep};
 use tracing::{error, info};

+/// Core test categories
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub enum TestCategory {
+    SingleValue,
+    MultiValue,
+    Concatenation,
+    Nested,
+    DenyScenarios,
+}
+
+impl TestCategory {}
+
 /// Test case definition
 #[derive(Debug, Clone)]
 pub struct TestDefinition {
    pub name: String,
+    #[allow(dead_code)]
+    pub category: TestCategory,
    pub is_critical: bool,
 }

 impl TestDefinition {
-    pub fn new(name: impl Into<String>, is_critical: bool) -> Self {
+    pub fn new(name: impl Into<String>, category: TestCategory, is_critical: bool) -> Self {
        Self {
            name: name.into(),
+            category,
            is_critical,
        }
    }
@@ -77,12 +92,12 @@ impl PolicyTestSuite {
    /// Create default test suite
    pub fn new() -> Self {
        let tests = vec![
-            TestDefinition::new("test_aws_policy_variables_single_value", true),
-            TestDefinition::new("test_aws_policy_variables_multi_value", true),
-            TestDefinition::new("test_aws_policy_variables_concatenation", true),
-            TestDefinition::new("test_aws_policy_variables_nested", true),
-            TestDefinition::new("test_aws_policy_variables_deny", true),
-            TestDefinition::new("test_aws_policy_variables_sts", true),
+            TestDefinition::new("test_aws_policy_variables_single_value", TestCategory::SingleValue, true),
+            TestDefinition::new("test_aws_policy_variables_multi_value", TestCategory::MultiValue, true),
+            TestDefinition::new("test_aws_policy_variables_concatenation", TestCategory::Concatenation, true),
+            TestDefinition::new("test_aws_policy_variables_nested", TestCategory::Nested, true),
+            TestDefinition::new("test_aws_policy_variables_deny", TestCategory::DenyScenarios, true),
+            TestDefinition::new("test_aws_policy_variables_sts", TestCategory::SingleValue, true),
        ];

        Self {
@@ -43,6 +43,7 @@ use aws_sdk_s3::presigning::{PresignedRequest, PresigningConfig};
 use aws_sdk_s3::primitives::ByteStream;
 use aws_sdk_s3::{Client, Config};
 use aws_smithy_http_client::Builder as SmithyHttpClientBuilder;
+use serial_test::serial;
 use std::time::{Duration, SystemTime};
 use tracing::info;

@@ -156,6 +157,7 @@ async fn setup(env: &mut RustFSTestEnvironment) -> Result<(), Box<dyn std::error
 /// stored bytes. Without this, every negative assertion could pass for the
 /// wrong reason (a server that rejects all presigned URLs).
 #[tokio::test]
+#[serial]
 async fn valid_presigned_get_succeeds() -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
    init_logging();
    let mut env = RustFSTestEnvironment::new().await?;
@@ -180,6 +182,7 @@ async fn valid_presigned_get_succeeds() -> Result<(), Box<dyn std::error::Error
 /// Positive control (PUT): a valid presigned PUT must store the object, which we
 /// verify with a follow-up authenticated HEAD.
 #[tokio::test]
+#[serial]
 async fn valid_presigned_put_succeeds() -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
    init_logging();
    let mut env = RustFSTestEnvironment::new().await?;
@@ -208,6 +211,7 @@ async fn valid_presigned_put_succeeds() -> Result<(), Box<dyn std::error::Error
 /// ("Request has expired"). s3s checks expiry BEFORE the signature, so the
 /// signature here is otherwise valid — only the elapsed window is at fault.
 #[tokio::test]
+#[serial]
 async fn expired_presigned_get_is_rejected() -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
    init_logging();
    let mut env = RustFSTestEnvironment::new().await?;
@@ -232,6 +236,7 @@ async fn expired_presigned_get_is_rejected() -> Result<(), Box<dyn std::error::E
 /// (b) Tampering the `X-Amz-Signature` query value must be rejected with 403 /
 /// SignatureDoesNotMatch.
 #[tokio::test]
+#[serial]
 async fn tampered_signature_returns_signature_does_not_match() -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
    init_logging();
    let mut env = RustFSTestEnvironment::new().await?;
@@ -257,6 +262,7 @@ async fn tampered_signature_returns_signature_does_not_match() -> Result<(), Box
 /// (c) A presigned URL generated with the WRONG secret (but the real access key
 /// id) must be rejected with 403 / SignatureDoesNotMatch.
 #[tokio::test]
+#[serial]
 async fn wrong_secret_key_returns_signature_does_not_match() -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
    init_logging();
    let mut env = RustFSTestEnvironment::new().await?;
@@ -284,6 +290,7 @@ async fn wrong_secret_key_returns_signature_does_not_match() -> Result<(), Box<d
 /// check runs during auth, before any object lookup, so the swapped key need
 /// not even exist.
 #[tokio::test]
+#[serial]
 async fn tampered_target_key_returns_signature_does_not_match() -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
    init_logging();
    let mut env = RustFSTestEnvironment::new().await?;
@@ -318,6 +325,7 @@ async fn tampered_target_key_returns_signature_does_not_match() -> Result<(), Bo
 /// (e / acceptance 4 negative half) Tampering the signature of a presigned PUT
 /// must be rejected with 403 / SignatureDoesNotMatch — the write must not land.
 #[tokio::test]
+#[serial]
 async fn tampered_presigned_put_returns_signature_does_not_match() -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
    init_logging();
    let mut env = RustFSTestEnvironment::new().await?;
@@ -22,6 +22,7 @@ use crate::protocols::sftp_compliance::{
 };
 use crate::protocols::sftp_core::{test_sftp_core_operations, test_sftp_idle_timeout_disconnects};
 use crate::protocols::webdav_core::test_webdav_core_operations;
+use serial_test::serial;
 use std::time::Instant;
 use tokio::time::{Duration, sleep};
 use tracing::{error, info};
@@ -228,6 +229,7 @@ fn all_protocol_tests() -> Vec<TestDefinition> {

 /// Test suite
 #[tokio::test]
+#[serial]
 async fn test_protocol_core_suite() -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
    let suite = ProtocolTestSuite::new();
    let results = suite.run_test_suite().await;
@@ -233,111 +233,6 @@ pub async fn test_webdav_core_operations() -> Result<()> {
        );
        info!("PASS: PUT file '{}' successful", filename);

-        // Regression for #6260: a bucket-scoped policy must be able to discover its bucket at the
-        // WebDAV root without the unrelated global ListAllMyBuckets permission.
-        let scoped_bucket = "webdav-scoped-bucket";
-        let scoped_file = "visible.txt";
-        let scoped_user = "webdav-scoped-user";
-        let scoped_secret = "webdav-scoped-secret";
-        let scoped_policy_name = "webdav-scoped-policy";
-
-        let resp = client
-            .request(reqwest::Method::from_bytes(b"MKCOL").unwrap(), format!("{}/{}", base_url, scoped_bucket))
-            .header("Authorization", &auth_header)
-            .send()
-            .await?;
-        assert_eq!(resp.status().as_u16(), 201, "scoped test bucket should be created");
-
-        let resp = client
-            .put(format!("{}/{}/{}", base_url, scoped_bucket, scoped_file))
-            .header("Authorization", &auth_header)
-            .body("visible to the scoped principal")
-            .send()
-            .await?;
-        assert_eq!(resp.status().as_u16(), 201, "scoped test object should be created");
-
-        admin_create_user(&admin_base_url, scoped_user, scoped_secret).await?;
-        admin_add_canned_policy(
-            &admin_base_url,
-            scoped_policy_name,
-            &serde_json::json!({
-                "Version": "2012-10-17",
-                "Statement": [
-                    {
-                        "Effect": "Allow",
-                        "Action": ["s3:*"],
-                        "Resource": [
-                            format!("arn:aws:s3:::{}", scoped_bucket),
-                            format!("arn:aws:s3:::{}/*", scoped_bucket)
-                        ]
-                    },
-                    {
-                        "Effect": "Deny",
-                        "Action": ["s3:*"],
-                        "Resource": [
-                            format!("arn:aws:s3:::{}", scoped_bucket),
-                            format!("arn:aws:s3:::{}/*", scoped_bucket)
-                        ],
-                        "Condition": { "Bool": { "aws:SecureTransport": "true" } }
-                    },
-                    {
-                        "Effect": "Deny",
-                        "Action": ["s3:*"],
-                        "Resource": [
-                            format!("arn:aws:s3:::{}", scoped_bucket),
-                            format!("arn:aws:s3:::{}/*", scoped_bucket)
-                        ],
-                        "Condition": { "StringEquals": { "s3:signatureversion": "AWS4-HMAC-SHA256" } }
-                    }
-                ]
-            }),
-        )
-        .await?;
-        admin_attach_policy_to_user(&admin_base_url, scoped_policy_name, scoped_user).await?;
-
-        let scoped_auth = basic_auth_header_for(scoped_user, scoped_secret);
-        let resp = client
-            .request(reqwest::Method::from_bytes(b"PROPFIND").unwrap(), &base_url)
-            .header("Authorization", &scoped_auth)
-            .header("Depth", "1")
-            .header("x-amz-content-sha256", "STREAMING-AWS4-HMAC-SHA256-PAYLOAD")
-            .send()
-            .await?;
-        assert_eq!(resp.status().as_u16(), 207, "bucket-scoped root PROPFIND should succeed");
-        let root_listing = resp.text().await?;
-        assert!(root_listing.contains(scoped_bucket), "the authorized bucket should be listed");
-        assert!(!root_listing.contains(bucket_name), "an unauthorized bucket must not be listed");
-
-        let resp = client
-            .request(
-                reqwest::Method::from_bytes(b"PROPFIND").unwrap(),
-                format!("{}/{}", base_url, scoped_bucket),
-            )
-            .header("Authorization", &scoped_auth)
-            .header("Depth", "1")
-            .send()
-            .await?;
-        assert_eq!(resp.status().as_u16(), 207, "authorized bucket PROPFIND should succeed");
-        assert!(resp.text().await?.contains(scoped_file), "the authorized object should be listed");
-
-        let denied_user = "webdav-no-buckets-user";
-        let denied_secret = "webdav-no-buckets-secret";
-        admin_create_user(&admin_base_url, denied_user, denied_secret).await?;
-        let resp = client
-            .request(reqwest::Method::from_bytes(b"PROPFIND").unwrap(), &base_url)
-            .header("Authorization", basic_auth_header_for(denied_user, denied_secret))
-            .header("Depth", "1")
-            .send()
-            .await?;
-        assert_eq!(
-            resp.status().as_u16(),
-            207,
-            "PROPFIND keeps the root resource visible when the directory listing is forbidden"
-        );
-        let denied_body = resp.text().await?;
-        assert!(!denied_body.contains(scoped_bucket), "a denied response must not leak the scoped bucket");
-        assert!(!denied_body.contains(bucket_name), "a denied response must not leak the admin bucket");
-
        // Test GET (download file)
        info!("Testing WebDAV: GET (download file '{}')", filename);
        let resp = client
@@ -15,6 +15,7 @@
 use crate::common::{RustFSTestEnvironment, admin_request, awscurl_delete, awscurl_get, awscurl_post, awscurl_put, init_logging};
 use aws_sdk_s3::Client;
 use http::{Method, StatusCode};
+use serial_test::serial;
 use tokio::time::{Duration, sleep, timeout};
 use tracing::{debug, info};

@@ -169,42 +170,6 @@ impl QuotaTestEnv {
        bucket: &str,
        quota_bytes: u64,
    ) -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
-        self.wait_for_quota_usage_for(bucket).await?;
-
-        let quota_path = format!("/rustfs/admin/v3/quota/{bucket}");
-        let quota_config = serde_json::json!({
-            "quota": quota_bytes,
-            "quota_type": "HARD"
-        })
-        .to_string();
-        let readiness = async {
-            loop {
-                let (status, response) = admin_request(
-                    &self.env.url,
-                    Method::PUT,
-                    &quota_path,
-                    Some(quota_config.clone()),
-                    &self.env.access_key,
-                    &self.env.secret_key,
-                )
-                .await?;
-                if status.is_success() {
-                    return Ok::<(), Box<dyn std::error::Error + Send + Sync>>(());
-                }
-                if status != StatusCode::SERVICE_UNAVAILABLE {
-                    return Err(format!("failed to set quota for {bucket}: {status} {response}").into());
-                }
-
-                sleep(Duration::from_secs(1)).await;
-            }
-        };
-        match timeout(Duration::from_secs(30), readiness).await {
-            Ok(result) => result,
-            Err(_) => Err(format!("quota readiness did not converge for {bucket} within 30 seconds").into()),
-        }
-    }
-
-    pub async fn wait_for_quota_usage_for(&self, bucket: &str) -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
        let stats_path = format!("/rustfs/admin/v3/quota-stats/{bucket}");
        let readiness = async {
            loop {
@@ -217,12 +182,28 @@ impl QuotaTestEnv {
                if status != StatusCode::SERVICE_UNAVAILABLE {
                    return Err(format!("quota usage readiness failed for {bucket}: {status} {response}").into());
                }
+
                sleep(Duration::from_secs(1)).await;
            }
        };
        match timeout(Duration::from_secs(30), readiness).await {
-            Ok(result) => result,
-            Err(_) => Err(format!("quota usage did not become authoritative for {bucket} within 30 seconds").into()),
+            Ok(result) => result?,
+            Err(_) => {
+                return Err(format!("quota usage did not become authoritative for {bucket} within 30 seconds").into());
+            }
+        }
+
+        let url = format!("{}/rustfs/admin/v3/quota/{}", self.env.url, bucket);
+        let quota_config = serde_json::json!({
+            "quota": quota_bytes,
+            "quota_type": "HARD"
+        });
+
+        let response = awscurl_put(&url, &quota_config.to_string(), &self.env.access_key, &self.env.secret_key).await?;
+        if response.contains("error") {
+            Err(format!("Failed to set quota: {}", response).into())
+        } else {
+            Ok(())
        }
    }

@@ -274,6 +255,7 @@ mod integration_tests {
    use aws_sdk_s3::error::ProvideErrorMetadata;

    #[tokio::test]
+    #[serial]
    async fn test_quota_basic_operations() -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
        init_logging();
        if skip_without_awscurl() {
@@ -318,6 +300,7 @@ mod integration_tests {
    /// with 400 UnexpectedContent, and an over-quota aws-chunked PUT must still get the quota
    /// rejection.
    #[tokio::test]
+    #[serial]
    async fn test_quota_admission_aws_chunked_declared_encoding() -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
        init_logging();
        if skip_without_awscurl() {
@@ -369,6 +352,7 @@ mod integration_tests {
    }

    #[tokio::test]
+    #[serial]
    async fn test_quota_update_and_clear() -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
        init_logging();
        if skip_without_awscurl() {
@@ -404,6 +388,7 @@ mod integration_tests {
    }

    #[tokio::test]
+    #[serial]
    async fn test_quota_delete_operations() -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
        init_logging();
        if skip_without_awscurl() {
@@ -440,6 +425,7 @@ mod integration_tests {
    }

    #[tokio::test]
+    #[serial]
    async fn test_quota_usage_tracking() -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
        init_logging();
        if skip_without_awscurl() {
@@ -478,6 +464,7 @@ mod integration_tests {
    }

    #[tokio::test]
+    #[serial]
    async fn test_quota_statistics() -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
        init_logging();
        if skip_without_awscurl() {
@@ -511,6 +498,7 @@ mod integration_tests {
    }

    #[tokio::test]
+    #[serial]
    async fn test_quota_check_api() -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
        init_logging();
        if skip_without_awscurl() {
@@ -551,6 +539,7 @@ mod integration_tests {
    }

    #[tokio::test]
+    #[serial]
    async fn test_quota_multiple_buckets() -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
        init_logging();
        if skip_without_awscurl() {
@@ -591,6 +580,7 @@ mod integration_tests {
    }

    #[tokio::test]
+    #[serial]
    async fn test_quota_error_handling() -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
        init_logging();
        if skip_without_awscurl() {
@@ -626,6 +616,7 @@ mod integration_tests {
    }

    #[tokio::test]
+    #[serial]
    async fn test_quota_http_endpoints() -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
        init_logging();
        if skip_without_awscurl() {
@@ -634,7 +625,6 @@ mod integration_tests {
        let env = QuotaTestEnv::new().await?;

        env.create_bucket().await?;
-        env.wait_for_quota_usage_for(&env.bucket_name).await?;

        // Test 1: GET quota for bucket without quota config
        let url = format!("{}/rustfs/admin/v3/quota/{}", env.env.url, env.bucket_name);
@@ -642,7 +632,12 @@ mod integration_tests {
        assert!(response.contains("quota") && response.contains("null"));

        // Test 2: PUT quota - valid config
-        env.set_bucket_quota(1048576).await?;
+        let quota_config = serde_json::json!({
+            "quota": 1048576,
+            "quota_type": "HARD"
+        });
+        let response = awscurl_put(&url, &quota_config.to_string(), &env.env.access_key, &env.env.secret_key).await?;
+        assert!(response.contains("success") || !response.contains("error"));

        // Test 3: GET quota after setting
        let response = awscurl_get(&url, &env.env.access_key, &env.env.secret_key).await?;
@@ -687,6 +682,7 @@ mod integration_tests {

    /// Test that a normal user with `readwrite` policy can read quota but cannot set/clear quota.
    #[tokio::test]
+    #[serial]
    async fn test_quota_normal_user_permissions() -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
        init_logging();
        if skip_without_awscurl() {
@@ -742,6 +738,7 @@ mod integration_tests {
    }

    #[tokio::test]
+    #[serial]
    async fn test_quota_copy_operations() -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
        init_logging();
        if skip_without_awscurl() {
@@ -787,6 +784,7 @@ mod integration_tests {
    }

    #[tokio::test]
+    #[serial]
    async fn test_quota_batch_delete() -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
        init_logging();
        if skip_without_awscurl() {
@@ -845,6 +843,7 @@ mod integration_tests {
    }

    #[tokio::test]
+    #[serial]
    async fn test_quota_multipart_upload() -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
        init_logging();
        if skip_without_awscurl() {
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
overtrue	f4f015990b	fix(sse): read MinIO single-part encrypted objects Two independent defects kept them unreadable, both reached only once the fixture harness could load an inlined object at all. The stream was keyed as if the object were multipart. is_multipart_encrypted_object falls back to an ETag length test when there is a single part, and MinIO stores an encrypted ETag for SSE objects — 96 characters for a single-part upload, not the 32 of a plain MD5 — so every such object read as multipart and had a per-part key derived for a stream sealed with the object key itself. MinIO records the answer outright in X-Minio-Internal-Encrypted-Multipart, so that marker is now consulted first, and on a MinIO-written object its absence is treated as just as informative as its presence. The size was then reported as the ciphertext's. MinIO writes an explicit plaintext size only for multipart uploads, deriving it from the DARE stream otherwise, so both the read plan and ObjectInfo::decrypted_size fell back to the physical size — the reader waited for the encoding overhead as if it were payload, and a client would have seen a Content-Length overstated by exactly that much. dare_v2_decrypted_size inverts the package layout the way MinIO's sio.DecryptedSize does. It lives in rustfs-utils so the read plan and the size accessor cannot drift apart, and it returns None for a length no DARE stream can have rather than assigning a malformed object a plausible one. The interop suite is 9/9 with the two single-part cases added, and reverting the classification to the ETag heuristic turns both red. rustfs-ecstore's object_api tests and rustfs-utils are unaffected. Refs rustfs/backlog#1638.	2026-08-19 22:57:24 +08:00
overtrue	d871f4b3d8	test(interop): pair each disk with the metadata that disk stored The fixture harness read the object's FileInfo from one disk and then used it for every disk: the bitrot checksums it passed to all four readers were disk1's, and inline shard data was not passed at all. That was harmless for objects with part files, which is all the harness could load, and it is why objects below MinIO's small-file threshold could not be loaded at all — such an object has no part file, and each disk keeps its erasure shard inline in its own xl.meta. Each disk is now paired with its own metadata and both are placed at the erasure block slot that metadata claims, mirroring the shuffle the read path performs before it reads anything. Inline shards and per-disk checksums follow from that pairing. All seven interop cases exercise it. This does not make single-part objects readable, and no test claims otherwise. It does move where they fail: assembling their inline shards now yields a well-formed DARE stream that fails authentication, rather than bytes that are not a DARE stream at all. The remaining gap is therefore in the read path, not in the harness — which is what backlog#1638's matrix could not previously distinguish. Refs rustfs/backlog#1638.	2026-08-19 20:47:30 +08:00
overtrue	1d305aeb5b	docs(sse): record SSE-C as measured-readable in the migration matrix The SSE-C row moves from unverified to supported now that a MinIO-generated SSE-C object reads end to end, with the test that establishes it. Single-part stays unverified for all three schemes — the fixture harness still cannot load objects MinIO inlined into xl.meta. Also notes the one behavioural difference an operator will observe: a MinIO SSE-C object stores no customer-key MD5, so a wrong key is refused by the decryption rather than by the earlier parameter-mismatch check. Different error, same outcome. Refs rustfs/backlog#1638.	2026-08-19 09:25:10 +08:00
overtrue	fd26567cd7	fix(sse): read MinIO SSE-C objects, and pin the customer-key check MinIO SSE-C objects were unreadable for the same reason its managed objects were: the dispatch demanded a header MinIO never persists. A MinIO SSE-C object stores exactly three keys — the internal sealed key, IV, and seal algorithm — and keeps the customer algorithm on the request, returning it on the response. Recognizing the internal sealed-key slot as well is the whole fix on that side; the customer key still has to be supplied by the caller. The stored customer-key MD5 needed narrower handling. MinIO stores none, so comparing against it made every migrated object fail. The comparison is now skipped only when there is nothing to compare — no stored MD5 and the object carries MinIO's SSE-C slot — which does not weaken what the check buys: it is an early, friendlier rejection, while the key itself is proven by the object-key unseal, whose AEAD fails on a wrong key. A negative test holds that line by reading the fixture with a well-formed but wrong customer key. Writing that test surfaced a gap worth closing on its own: disabling the stored-MD5 comparison for every object left all 115 tests in this file green, so nothing guarded it for RustFS-written objects either, and a later widening of the skip would have gone unnoticed. ssec_stored_md5_mismatch_is_refused_when_an_md5_is_stored now fails when that happens. Verified against fixtures from a real MinIO server: the interop suite is 7/7, including SSE-C multipart, and both mutations — widening the MD5 skip, and the earlier slot-vs-key-id inference — turn it red. Refs rustfs/backlog#1638.	2026-08-19 09:24:30 +08:00
overtrue	035a6f431a	docs(sse): state MinIO interop by measured shape, and pin the production key path The migration warning said RustFS cannot read MinIO-encrypted objects at all. That is no longer true for the shapes this branch fixes, and a blanket 'no' costs a migrating operator a full decrypt-and-recopy they may not need. It is replaced by a table that states support per object shape, with the test that establishes each row. The table's honesty depends on one caveat worth stating in code rather than prose: every interop reader test injected its master key through __RUSTFS_SSE_SIMPLE_CMK, which is #[cfg(test)]-only and never reaches LocalSseDekProvider::new_from_env. Those tests going green therefore said nothing about a deployment. A new case reads a fixture through RUSTFS_SSE_S3_MASTER_KEY alone — the sole production entry point — so the claim now rests on the path operators actually run. Single-part and SSE-C objects are listed as unverified rather than unsupported, because the fixture harness cannot yet load them (small objects live inline in xl.meta, sharded across disks) and they have never been read in a test either way. Conflating 'untested' with 'broken' in the other direction would be the same failure the old warning made. The reverse direction gets an explicit ruling: MinIO cannot read RustFS-written objects, and the MinIO-branded headers RustFS writes are RustFS-internal rather than a compatibility promise — no coexistence plan should assume two-way reads. StaticConfig's doc comment is corrected on the same basis: it described MinIO's ciphertext as the legacy JSON encoding, and claimed MinIO-written objects cannot be read at all, which now belongs to the object read path rather than to this backend. Refs rustfs/backlog#1638.	2026-08-19 08:36:18 +08:00
overtrue	0e4953aeea	Merge remote-tracking branch 'upstream/overtrue/kms-1638-d2-minio-sse-read' into overtrue/kms-1638-d2-minio-sse-read	2026-08-19 07:11:23 +08:00
overtrue	99ec65247a	fix(sse): gate the MinIO data-key trait method behind rio-v2 The method's only call site sits in the rio-v2 branch of the managed read path, so a build without that feature carried a trait method nothing could reach — a warning under default features and, with -D warnings, a hard failure of the sftp lane. The declaration now carries the same gate its implementation and its sibling decrypt_legacy_sse_dek already had. Verified against the lane that caught it (cargo clippy -p rustfs --features sftp --all-targets -- -D warnings, clean), plus the default build and the rio-v2 interop suite (4 passed). Refs rustfs/backlog#1638.	2026-08-19 07:11:10 +08:00
Zhengchao An	6feb573f74	Merge branch 'main' into overtrue/kms-1638-d2-minio-sse-read	2026-08-19 07:09:40 +08:00
houseme	d6814af2bc	Merge branch 'main' into overtrue/kms-1638-d2-minio-sse-read	2026-08-18 23:54:31 +08:00
houseme	dbef072bfe	Merge branch 'main' into overtrue/kms-1638-d2-minio-sse-read	2026-08-18 12:46:12 +08:00
overtrue	420bfa859b	fix(sse): read objects that MinIO encrypted RustFS could not read a single MinIO-encrypted object. Two independent blockers, and backlog#1638 could only argue them statically because the fixtures the interop tests consume are generated, not checked in — so those tests had never once run. With the fixture lab working, both are now measured, fixed and covered. The detection gate required `x-amz-server-side-encryption` to be present. MinIO never persists it: `crypto.S3.CreateMetadata` writes only the `X-Minio-Internal-*` family and the public header is synthesized onto the response by `DecryptObjectInfo`. Every MinIO object therefore fell out of the managed path and failed with "encrypted object metadata is incomplete". The scheme is now inferred from which sealed-key slot is present, which is self-consistent by construction: the slot decides both which header the unseal reads and which domain string the sealing key is derived under, so an inference that disagreed with the slot could not silently derive a wrong key. Inferring from the KMS key id would NOT be safe — MinIO writes `-S3-Kms-Key-Id` on SSE-S3 objects too, which the fixtures show and a mutation test pins. Past the gate, the data key itself could not be unwrapped. Its wire format is `sealed_bytes \|\| iv[16] \|\| nonce[12]` — the randomness trails the ciphertext rather than leading it — with a per-ciphertext sealing key of `HMAC-SHA256(master, iv)` and the encryption context bound as associated data (`internal/kms/secret-key.go`). Note this is not the `{"aead":...}` JSON that backlog#1638's analysis described: current MinIO writes the raw layout and treats JSON only as a legacy encoding, normalizing it into the same byte order. Both are decoded here, in a decoder of their own — `LocalSseDekEnvelope`'s `deny_unknown_fields` is untouched, since loosening it to admit MinIO's shape would also admit malformed RustFS envelopes that backlog#1567 requires to keep failing closed. Routing between the two decoders cannot key on metadata: RustFS's own writer fills MinIO's slots while storing a RustFS envelope in them, so neither the slot nor the header name distinguishes writers. It keys on the data key's own shape instead, recognizing the two strict RustFS JSON shapes positively and leaving only the remainder to MinIO — so neither decoder is ever handed the other's format. Three round-trip tests caught an earlier slot-based attempt doing exactly that. Fail-closed is preserved throughout: a scheme that cannot be established still returns None, and the read plan independently classifies the object as encrypted from its markers and refuses to serve it without material, so no path degrades into returning ciphertext as plaintext. The interop harness also gets a provider reset. The DEK provider is cached process-wide, so a case that ran earlier kept serving its master key to every later case — which silently made the wrong-key negative test unable to fail. It fails correctly now, and the whole suite is meaningful for the first time. Refs rustfs/backlog#1638.	2026-08-18 09:32:29 +08:00