Merge remote-tracking branch 'origin/main' into overtrue/release-1.0.0-rc.2

* fix(storage): restore multipart disk compression and make the legacy decompressor resumable

Multipart uploads have bypassed disk compression since #5169 removed the session marker as a stopgap for mid-stream GET failures. The actual root cause was never the multipart layout: the legacy DecompressReader reset its payload consumption state on every poll re-entry, so a Poll::Pending in the middle of a block payload (routine under the erasure duplex) desynchronized the block framing and surfaced as LZ4 frameType errors. This rewrites the decoder as a resumable state machine, restores the multipart session compression marker, reports logical part sizes in ListParts, and makes the rebalance migration read raw stored bytes so compressed and encrypted objects survive migration verbatim.

Fixes #5957. Internal tracking: backlog#1848, backlog#1850.

* feat(storage): stage multipart compression behind RUSTFS_COMPRESSION_MULTIPART_ENABLED

Review follow-up: a rolling-upgrade window must not create new compressed multipart objects while pre-fix nodes (whose decompressor is not resumable) may still serve reads. The session marker is now additionally gated on RUSTFS_COMPRESSION_MULTIPART_ENABLED, default off, so the restored capability stays dark until the operator confirms fleet convergence. The default flips per the multipart-compression-default-off-window entry in docs/architecture/compat-cleanup-register.md once the minimum supported direct-upgrade release ships the resumable decoder.

* chore(compat): satisfy the cleanup-register guard for the multipart compression switch

The architecture guard requires every backticked identifier in a register entry to carry a RUSTFS_COMPAT_TODO source marker: keep only the entry slug in backticks, and add the marker (with its literal Remove-after condition) at the switch definition.

* chore(rio): drop a dead store in the poison guard and note the end-block branch

Review follow-up: the poison gate re-assigned an already-true flag, and the COMPRESS_TYPE_END branch reads as dead without stating that the writer never emits an end block — that absence is exactly what lets concatenated per-part streams decode as one.

* fix(s3): report empty compressed multipart part size

* fix(s3): report empty encrypted multipart part size

.config/nextest.toml

@@ -252,10 +252,16 @@ test-group = 'ecstore-serial-flaky'
 # cluster, so it keeps the lane's parallel-safe / no-external-dependency
 # properties. The RustFS warm backend has no loopback guard (that guard is
 # replication-only), so it needs no opt-in env for its 127.0.0.1 tier target.
+#
+# Disk compression (backlog#1848): the `compression` module joins the smoke
+# lane so the multipart disk-compression roundtrips (restored after
+# rustfs/rustfs#5169 disabled them) have PR-lane signal, not just merge-gate.
+# Single-node servers on random ports with isolated temp dirs — meets the
+# admission criteria unchanged.
 [profile.e2e-smoke]
 default-filter = """
     package(e2e_test) & (
-        test(/^(delete_marker_migration_semantics|version_id_regression|list_objects_v2_pagination|list_object_versions_regression|list_objects_duplicates|list_buckets_double_slash|list_buckets_auth|list_buckets_iam_filter|leading_slash_key|special_chars|create_bucket_region|delete_objects_versioning|head_object_consistency|head_object_range|copy_object_metadata|copy_object_tagging|copy_source_invalid_date|content_encoding|multipart_storage_class|storage_class_capability|ssec_copy|anonymous_access|bucket_policy_check|presigned_negative|negative_sigv4|admin_auth|notification_webhook|tls_hot_reload|console_smoke|admin_iam_crud|admin_pools|sts_query_compat)_test::|^fake_s3_target::/)
+        test(/^(delete_marker_migration_semantics|version_id_regression|list_objects_v2_pagination|list_object_versions_regression|list_objects_duplicates|list_buckets_double_slash|list_buckets_auth|list_buckets_iam_filter|leading_slash_key|special_chars|create_bucket_region|delete_objects_versioning|head_object_consistency|head_object_range|copy_object_metadata|copy_object_tagging|copy_source_invalid_date|content_encoding|compression|multipart_storage_class|storage_class_capability|ssec_copy|anonymous_access|bucket_policy_check|presigned_negative|negative_sigv4|admin_auth|notification_webhook|tls_hot_reload|console_smoke|admin_iam_crud|admin_pools|sts_query_compat)_test::|^fake_s3_target::/)
         | test(/^replication_extension_test::(test_replication_check_succeeds_with_remote_target|test_replication_check_rejects_target_without_object_lock|test_set_remote_target_rejects_unversioned_source_bucket|test_replication_check_rejects_unversioned_source_bucket|test_replication_check_rejects_missing_replication_config|test_replication_check_rejects_invalid_bucket|test_set_remote_target_rejects_same_bucket_on_same_deployment|test_set_remote_target_rejects_unversioned_target_bucket|test_set_remote_target_update_requires_arn|test_set_remote_target_update_rejects_missing_target|test_set_remote_target_rejects_invalid_target_url|test_set_remote_target_rejects_self_signed_https_target_without_skip_tls_verify|test_set_remote_target_rejects_private_ca_https_target_without_ca_cert_pem|test_list_remote_targets_rejects_empty_bucket|test_list_remote_targets_rejects_invalid_bucket|test_remove_remote_target_rejects_missing_target|test_remove_remote_target_rejects_missing_arn|test_remove_remote_target_rejects_invalid_bucket|test_remove_remote_target_rejects_target_used_by_replication|test_delete_bucket_replication_removes_remote_target)$/)
         | test(/^reliant::lifecycle::/)
         | test(/^reliant::tiering::/)

.github/workflows/cache-warm.yml

@@ -182,7 +182,12 @@ jobs:
             echo '```'
           } >> "$GITHUB_STEP_SUMMARY"
 
-  # Readers: test-and-lint-rio-v2, build-rustfs-debug-binary-rio-v2.
+  # Readers: test-and-lint-rio-v2 (per-PR), build-rustfs-debug-binary-rio-v2
+  # (weekly schedule / manual dispatch only — dormant rio-v2 variant, see
+  # rustfs/backlog#1835 and docs/architecture/minio-file-format-compat.md).
+  # The second build below stays despite the reduced cadence: it warms the
+  # rio-v2,e2e-test-hooks feature resolution the scheduled build restores,
+  # which keeps that lane inside its 30-minute timeout.
   warm-ci-feat-rio:
     name: Warm ci-feat-rio
     runs-on: sm-standard-4

.github/workflows/ci.yml

@@ -533,7 +533,12 @@ jobs:
 
   build-rustfs-debug-binary-rio-v2:
     name: Build RustFS Debug Binary (rio-v2)
-    if: github.event_name != 'pull_request' || github.event.action != 'closed'
+    # Dormant rio-v2 variant (rustfs/backlog#1835): the feature ships in no
+    # default build, so this full-suite lane runs only on the weekly schedule
+    # and manual dispatch. Per-PR cfg-seam coverage stays with
+    # test-and-lint-rio-v2. Lifecycle and the promote-or-delete condition:
+    # docs/architecture/minio-file-format-compat.md ("rio-v2 variant lifecycle").
+    if: github.event_name == 'schedule' || github.event_name == 'workflow_dispatch'
     needs: [ quick-checks ]
     runs-on: sm-standard-4
     timeout-minutes: 30
@@ -824,6 +829,9 @@ jobs:
 
   e2e-tests-rio-v2:
     name: End-to-End Tests (rio-v2)
+    # Inherits the schedule/dispatch-only gate through needs: on every other
+    # event build-rustfs-debug-binary-rio-v2 is skipped, so this job skips
+    # with it (see the dormant-variant comment on that job).
     needs: [ build-rustfs-debug-binary-rio-v2 ]
     runs-on: sm-standard-2
     timeout-minutes: 30

ARCHITECTURE.md

@@ -101,7 +101,10 @@ refactors.
 
 The `rustfs` binary crate composes these libraries into the running server.
 `ecstore` remains the storage engine at the architectural center; its internal
-module split is tracked under `docs/architecture/`.
+module split is tracked under `docs/architecture/`. `rio-v2` is the
+feature-gated MinIO on-disk format compatibility I/O layer; it ships in no
+default build (lifecycle:
+[docs/architecture/minio-file-format-compat.md](docs/architecture/minio-file-format-compat.md)).
 
 ## Architecture Invariants
 

Cargo.lock

@@ -3761,7 +3761,7 @@ checksum = "d0881ea181b1df73ff77ffaaf9c7544ecc11e82fba9b5f27b262a3c73a332555"
 
 [[package]]
 name = "e2e_test"
-version = "1.0.0-rc.1"
+version = "1.0.0-rc.2"
 dependencies = [
  "anyhow",
  "astral-tokio-tar",
@@ -9090,7 +9090,7 @@ dependencies = [
 
 [[package]]
 name = "rustfs"
-version = "1.0.0-rc.1"
+version = "1.0.0-rc.2"
 dependencies = [
  "aes-gcm",
  "anyhow",
@@ -9227,7 +9227,7 @@ dependencies = [
 
 [[package]]
 name = "rustfs-audit"
-version = "1.0.0-rc.1"
+version = "1.0.0-rc.2"
 dependencies = [
  "async-trait",
  "const-str",
@@ -9250,7 +9250,7 @@ dependencies = [
 
 [[package]]
 name = "rustfs-checksums"
-version = "1.0.0-rc.1"
+version = "1.0.0-rc.2"
 dependencies = [
  "base64-simd",
  "bytes",
@@ -9266,7 +9266,7 @@ dependencies = [
 
 [[package]]
 name = "rustfs-common"
-version = "1.0.0-rc.1"
+version = "1.0.0-rc.2"
 dependencies = [
  "chrono",
  "hotpath",
@@ -9284,7 +9284,7 @@ dependencies = [
 
 [[package]]
 name = "rustfs-concurrency"
-version = "1.0.0-rc.1"
+version = "1.0.0-rc.2"
 dependencies = [
  "hotpath",
  "insta",
@@ -9297,7 +9297,7 @@ dependencies = [
 
 [[package]]
 name = "rustfs-config"
-version = "1.0.0-rc.1"
+version = "1.0.0-rc.2"
 dependencies = [
  "const-str",
  "hotpath",
@@ -9307,7 +9307,7 @@ dependencies = [
 
 [[package]]
 name = "rustfs-credentials"
-version = "1.0.0-rc.1"
+version = "1.0.0-rc.2"
 dependencies = [
  "base64-simd",
  "hmac 0.13.0",
@@ -9321,7 +9321,7 @@ dependencies = [
 
 [[package]]
 name = "rustfs-crypto"
-version = "1.0.0-rc.1"
+version = "1.0.0-rc.2"
 dependencies = [
  "aes-gcm",
  "argon2",
@@ -9342,7 +9342,7 @@ dependencies = [
 
 [[package]]
 name = "rustfs-data-usage"
-version = "1.0.0-rc.1"
+version = "1.0.0-rc.2"
 dependencies = [
  "hotpath",
  "rmp-serde",
@@ -9352,7 +9352,7 @@ dependencies = [
 
 [[package]]
 name = "rustfs-ecstore"
-version = "1.0.0-rc.1"
+version = "1.0.0-rc.2"
 dependencies = [
  "arc-swap",
  "async-channel",
@@ -9491,7 +9491,7 @@ dependencies = [
 
 [[package]]
 name = "rustfs-extension-schema"
-version = "1.0.0-rc.1"
+version = "1.0.0-rc.2"
 dependencies = [
  "hotpath",
  "serde",
@@ -9501,7 +9501,7 @@ dependencies = [
 
 [[package]]
 name = "rustfs-filemeta"
-version = "1.0.0-rc.1"
+version = "1.0.0-rc.2"
 dependencies = [
  "arc-swap",
  "byteorder",
@@ -9528,7 +9528,7 @@ dependencies = [
 
 [[package]]
 name = "rustfs-heal"
-version = "1.0.0-rc.1"
+version = "1.0.0-rc.2"
 dependencies = [
  "async-trait",
  "base64 0.23.1",
@@ -9559,7 +9559,7 @@ dependencies = [
 
 [[package]]
 name = "rustfs-iam"
-version = "1.0.0-rc.1"
+version = "1.0.0-rc.2"
 dependencies = [
  "arc-swap",
  "async-trait",
@@ -9600,7 +9600,7 @@ dependencies = [
 
 [[package]]
 name = "rustfs-io-core"
-version = "1.0.0-rc.1"
+version = "1.0.0-rc.2"
 dependencies = [
  "bytes",
  "hotpath",
@@ -9613,7 +9613,7 @@ dependencies = [
 
 [[package]]
 name = "rustfs-io-metrics"
-version = "1.0.0-rc.1"
+version = "1.0.0-rc.2"
 dependencies = [
  "criterion",
  "hotpath",
@@ -9677,7 +9677,7 @@ dependencies = [
 
 [[package]]
 name = "rustfs-keystone"
-version = "1.0.0-rc.1"
+version = "1.0.0-rc.2"
 dependencies = [
  "bytes",
  "futures",
@@ -9704,7 +9704,7 @@ dependencies = [
 
 [[package]]
 name = "rustfs-kms"
-version = "1.0.0-rc.1"
+version = "1.0.0-rc.2"
 dependencies = [
  "aes-gcm",
  "anyhow",
@@ -9753,7 +9753,7 @@ dependencies = [
 
 [[package]]
 name = "rustfs-lifecycle"
-version = "1.0.0-rc.1"
+version = "1.0.0-rc.2"
 dependencies = [
  "async-trait",
  "hotpath",
@@ -9776,7 +9776,7 @@ dependencies = [
 
 [[package]]
 name = "rustfs-lock"
-version = "1.0.0-rc.1"
+version = "1.0.0-rc.2"
 dependencies = [
  "async-trait",
  "compact_str",
@@ -9799,7 +9799,7 @@ dependencies = [
 
 [[package]]
 name = "rustfs-log-analyzer"
-version = "1.0.0-rc.1"
+version = "1.0.0-rc.2"
 dependencies = [
  "chrono",
  "flate2",
@@ -9818,7 +9818,7 @@ dependencies = [
 
 [[package]]
 name = "rustfs-madmin"
-version = "1.0.0-rc.1"
+version = "1.0.0-rc.2"
 dependencies = [
  "hotpath",
  "humantime",
@@ -9833,7 +9833,7 @@ dependencies = [
 
 [[package]]
 name = "rustfs-notify"
-version = "1.0.0-rc.1"
+version = "1.0.0-rc.2"
 dependencies = [
  "arc-swap",
  "async-trait",
@@ -9868,7 +9868,7 @@ dependencies = [
 
 [[package]]
 name = "rustfs-object-capacity"
-version = "1.0.0-rc.1"
+version = "1.0.0-rc.2"
 dependencies = [
  "criterion",
  "futures",
@@ -9888,7 +9888,7 @@ dependencies = [
 
 [[package]]
 name = "rustfs-object-data-cache"
-version = "1.0.0-rc.1"
+version = "1.0.0-rc.2"
 dependencies = [
  "bytes",
  "criterion",
@@ -9905,7 +9905,7 @@ dependencies = [
 
 [[package]]
 name = "rustfs-obs"
-version = "1.0.0-rc.1"
+version = "1.0.0-rc.2"
 dependencies = [
  "chrono",
  "crossbeam-channel",
@@ -9960,7 +9960,7 @@ dependencies = [
 
 [[package]]
 name = "rustfs-policy"
-version = "1.0.0-rc.1"
+version = "1.0.0-rc.2"
 dependencies = [
  "async-trait",
  "base64-simd",
@@ -9991,7 +9991,7 @@ dependencies = [
 
 [[package]]
 name = "rustfs-protocols"
-version = "1.0.0-rc.1"
+version = "1.0.0-rc.2"
 dependencies = [
  "astral-tokio-tar",
  "async-compression",
@@ -10053,7 +10053,7 @@ dependencies = [
 
 [[package]]
 name = "rustfs-protos"
-version = "1.0.0-rc.1"
+version = "1.0.0-rc.2"
 dependencies = [
  "flatbuffers",
  "hotpath",
@@ -10077,7 +10077,7 @@ dependencies = [
 
 [[package]]
 name = "rustfs-replication"
-version = "1.0.0-rc.1"
+version = "1.0.0-rc.2"
 dependencies = [
  "byteorder",
  "bytes",
@@ -10095,7 +10095,7 @@ dependencies = [
 
 [[package]]
 name = "rustfs-rio"
-version = "1.0.0-rc.1"
+version = "1.0.0-rc.2"
 dependencies = [
  "aes-gcm",
  "arc-swap",
@@ -10133,7 +10133,7 @@ dependencies = [
 
 [[package]]
 name = "rustfs-rio-v2"
-version = "1.0.0-rc.1"
+version = "1.0.0-rc.2"
 dependencies = [
  "aes-gcm",
  "bytes",
@@ -10156,7 +10156,7 @@ dependencies = [
 
 [[package]]
 name = "rustfs-s3-ops"
-version = "1.0.0-rc.1"
+version = "1.0.0-rc.2"
 dependencies = [
  "hotpath",
  "rustfs-s3-types",
@@ -10164,7 +10164,7 @@ dependencies = [
 
 [[package]]
 name = "rustfs-s3-types"
-version = "1.0.0-rc.1"
+version = "1.0.0-rc.2"
 dependencies = [
  "hotpath",
  "serde",
@@ -10173,7 +10173,7 @@ dependencies = [
 
 [[package]]
 name = "rustfs-s3select-api"
-version = "1.0.0-rc.1"
+version = "1.0.0-rc.2"
 dependencies = [
  "async-trait",
  "bytes",
@@ -10203,7 +10203,7 @@ dependencies = [
 
 [[package]]
 name = "rustfs-s3select-query"
-version = "1.0.0-rc.1"
+version = "1.0.0-rc.2"
 dependencies = [
  "async-recursion",
  "async-trait",
@@ -10222,7 +10222,7 @@ dependencies = [
 
 [[package]]
 name = "rustfs-scanner"
-version = "1.0.0-rc.1"
+version = "1.0.0-rc.2"
 dependencies = [
  "async-trait",
  "bytes",
@@ -10262,7 +10262,7 @@ dependencies = [
 
 [[package]]
 name = "rustfs-security-governance"
-version = "1.0.0-rc.1"
+version = "1.0.0-rc.2"
 dependencies = [
  "hotpath",
  "thiserror 2.0.20",
@@ -10270,7 +10270,7 @@ dependencies = [
 
 [[package]]
 name = "rustfs-signer"
-version = "1.0.0-rc.1"
+version = "1.0.0-rc.2"
 dependencies = [
  "base64-simd",
  "bytes",
@@ -10288,7 +10288,7 @@ dependencies = [
 
 [[package]]
 name = "rustfs-storage-api"
-version = "1.0.0-rc.1"
+version = "1.0.0-rc.2"
 dependencies = [
  "async-trait",
  "hotpath",
@@ -10303,7 +10303,7 @@ dependencies = [
 
 [[package]]
 name = "rustfs-targets"
-version = "1.0.0-rc.1"
+version = "1.0.0-rc.2"
 dependencies = [
  "arc-swap",
  "async-nats",
@@ -10357,7 +10357,7 @@ dependencies = [
 
 [[package]]
 name = "rustfs-test-utils"
-version = "1.0.0-rc.1"
+version = "1.0.0-rc.2"
 dependencies = [
  "hotpath",
  "rustfs-data-usage",
@@ -10373,7 +10373,7 @@ dependencies = [
 
 [[package]]
 name = "rustfs-tls-runtime"
-version = "1.0.0-rc.1"
+version = "1.0.0-rc.2"
 dependencies = [
  "arc-swap",
  "hotpath",
@@ -10394,7 +10394,7 @@ dependencies = [
 
 [[package]]
 name = "rustfs-trusted-proxies"
-version = "1.0.0-rc.1"
+version = "1.0.0-rc.2"
 dependencies = [
  "async-trait",
  "axum",
@@ -10431,7 +10431,7 @@ dependencies = [
 
 [[package]]
 name = "rustfs-utils"
-version = "1.0.0-rc.1"
+version = "1.0.0-rc.2"
 dependencies = [
  "base64-simd",
  "blake2",
@@ -10473,7 +10473,7 @@ dependencies = [
 
 [[package]]
 name = "rustfs-zip"
-version = "1.0.0-rc.1"
+version = "1.0.0-rc.2"
 dependencies = [
  "astral-tokio-tar",
  "async-compression",

Cargo.toml

@@ -41,7 +41,7 @@ members = [
     "crates/protocols", # Protocol implementations (FTPS, SFTP, etc.)
     "crates/protos", # Protocol buffer definitions
     "crates/rio", # Rust I/O utilities and abstractions
-    "crates/rio-v2", # Next-generation Rust I/O compatibility layer
+    "crates/rio-v2", # MinIO on-disk format compatibility I/O layer (feature-gated, ships in no default build)
     "crates/replication", # Replication contracts and wire formats
     "crates/concurrency", # Concurrency management for RustFS - timeout, locking, backpressure, and I/O scheduling
     "crates/s3-types", # S3 event type definitions
@@ -69,7 +69,7 @@ edition = "2024"
 license = "Apache-2.0"
 repository = "https://github.com/rustfs/rustfs"
 rust-version = "1.97.1"
-version = "1.0.0-rc.1"
+version = "1.0.0-rc.2"
 homepage = "https://rustfs.com"
 description = "RustFS is a high-performance distributed object storage software built using Rust, one of the most popular languages worldwide. "
 keywords = ["RustFS", "Minio", "object-storage", "filesystem", "s3"]
@@ -86,52 +86,52 @@ redundant_clone = "warn"
 
 [workspace.dependencies]
 # RustFS Internal Crates
-rustfs = { path = "./rustfs", version = "1.0.0-rc.1" }
-rustfs-heal = { path = "crates/heal", version = "1.0.0-rc.1" }
-rustfs-audit = { path = "crates/audit", version = "1.0.0-rc.1" }
-rustfs-checksums = { path = "crates/checksums", version = "1.0.0-rc.1" }
-rustfs-common = { path = "crates/common", version = "1.0.0-rc.1" }
-rustfs-data-usage = { path = "crates/data-usage", version = "1.0.0-rc.1" }
-rustfs-config = { path = "./crates/config", version = "1.0.0-rc.1" }
-rustfs-concurrency = { path = "./crates/concurrency", version = "1.0.0-rc.1" }
-rustfs-credentials = { path = "crates/credentials", version = "1.0.0-rc.1" }
-rustfs-crypto = { path = "crates/crypto", version = "1.0.0-rc.1" }
-rustfs-ecstore = { path = "crates/ecstore", version = "1.0.0-rc.1" }
-rustfs-filemeta = { path = "crates/filemeta", version = "1.0.0-rc.1" }
-rustfs-iam = { path = "crates/iam", version = "1.0.0-rc.1" }
-rustfs-keystone = { path = "crates/keystone", version = "1.0.0-rc.1" }
-rustfs-lifecycle = { path = "crates/lifecycle", version = "1.0.0-rc.1" }
-rustfs-kms = { path = "crates/kms", version = "1.0.0-rc.1" }
-rustfs-lock = { path = "crates/lock", version = "1.0.0-rc.1" }
-rustfs-madmin = { path = "crates/madmin", version = "1.0.0-rc.1" }
-rustfs-notify = { path = "crates/notify", version = "1.0.0-rc.1" }
-rustfs-io-metrics = { path = "crates/io-metrics", version = "1.0.0-rc.1" }
-rustfs-io-core = { path = "crates/io-core", version = "1.0.0-rc.1" }
-rustfs-object-capacity = { path = "crates/object-capacity", version = "1.0.0-rc.1" }
-rustfs-object-data-cache = { path = "crates/object-data-cache", version = "1.0.0-rc.1", default-features = false }
-rustfs-log-analyzer = { path = "crates/log-analyzer", version = "1.0.0-rc.1" }
-rustfs-obs = { path = "crates/obs", version = "1.0.0-rc.1" }
-rustfs-policy = { path = "crates/policy", version = "1.0.0-rc.1" }
-rustfs-protos = { path = "crates/protos", version = "1.0.0-rc.1" }
-rustfs-protocols = { path = "crates/protocols", version = "1.0.0-rc.1" }
-rustfs-replication = { path = "crates/replication", version = "1.0.0-rc.1" }
-rustfs-rio = { path = "crates/rio", version = "1.0.0-rc.1" }
-rustfs-rio-v2 = { path = "crates/rio-v2", version = "1.0.0-rc.1" }
-rustfs-s3-types = { path = "crates/s3-types", version = "1.0.0-rc.1" }
-rustfs-s3-ops = { path = "crates/s3-ops", version = "1.0.0-rc.1" }
-rustfs-s3select-api = { path = "crates/s3select-api", version = "1.0.0-rc.1" }
-rustfs-s3select-query = { path = "crates/s3select-query", version = "1.0.0-rc.1" }
-rustfs-scanner = { path = "crates/scanner", version = "1.0.0-rc.1" }
-rustfs-security-governance = { path = "crates/security-governance", version = "1.0.0-rc.1" }
-rustfs-extension-schema = { path = "crates/extension-schema", version = "1.0.0-rc.1" }
-rustfs-signer = { path = "crates/signer", version = "1.0.0-rc.1" }
-rustfs-storage-api = { path = "crates/storage-api", version = "1.0.0-rc.1" }
-rustfs-trusted-proxies = { path = "crates/trusted-proxies", version = "1.0.0-rc.1" }
-rustfs-targets = { path = "crates/targets", version = "1.0.0-rc.1" }
-rustfs-test-utils = { path = "crates/test-utils", version = "1.0.0-rc.1" }
-rustfs-tls-runtime = { path = "crates/tls-runtime", version = "1.0.0-rc.1" }
-rustfs-utils = { path = "crates/utils", version = "1.0.0-rc.1" }
-rustfs-zip = { path = "./crates/zip", version = "1.0.0-rc.1" }
+rustfs = { path = "./rustfs", version = "1.0.0-rc.2" }
+rustfs-heal = { path = "crates/heal", version = "1.0.0-rc.2" }
+rustfs-audit = { path = "crates/audit", version = "1.0.0-rc.2" }
+rustfs-checksums = { path = "crates/checksums", version = "1.0.0-rc.2" }
+rustfs-common = { path = "crates/common", version = "1.0.0-rc.2" }
+rustfs-data-usage = { path = "crates/data-usage", version = "1.0.0-rc.2" }
+rustfs-config = { path = "./crates/config", version = "1.0.0-rc.2" }
+rustfs-concurrency = { path = "./crates/concurrency", version = "1.0.0-rc.2" }
+rustfs-credentials = { path = "crates/credentials", version = "1.0.0-rc.2" }
+rustfs-crypto = { path = "crates/crypto", version = "1.0.0-rc.2" }
+rustfs-ecstore = { path = "crates/ecstore", version = "1.0.0-rc.2" }
+rustfs-filemeta = { path = "crates/filemeta", version = "1.0.0-rc.2" }
+rustfs-iam = { path = "crates/iam", version = "1.0.0-rc.2" }
+rustfs-keystone = { path = "crates/keystone", version = "1.0.0-rc.2" }
+rustfs-lifecycle = { path = "crates/lifecycle", version = "1.0.0-rc.2" }
+rustfs-kms = { path = "crates/kms", version = "1.0.0-rc.2" }
+rustfs-lock = { path = "crates/lock", version = "1.0.0-rc.2" }
+rustfs-madmin = { path = "crates/madmin", version = "1.0.0-rc.2" }
+rustfs-notify = { path = "crates/notify", version = "1.0.0-rc.2" }
+rustfs-io-metrics = { path = "crates/io-metrics", version = "1.0.0-rc.2" }
+rustfs-io-core = { path = "crates/io-core", version = "1.0.0-rc.2" }
+rustfs-object-capacity = { path = "crates/object-capacity", version = "1.0.0-rc.2" }
+rustfs-object-data-cache = { path = "crates/object-data-cache", version = "1.0.0-rc.2", default-features = false }
+rustfs-log-analyzer = { path = "crates/log-analyzer", version = "1.0.0-rc.2" }
+rustfs-obs = { path = "crates/obs", version = "1.0.0-rc.2" }
+rustfs-policy = { path = "crates/policy", version = "1.0.0-rc.2" }
+rustfs-protos = { path = "crates/protos", version = "1.0.0-rc.2" }
+rustfs-protocols = { path = "crates/protocols", version = "1.0.0-rc.2" }
+rustfs-replication = { path = "crates/replication", version = "1.0.0-rc.2" }
+rustfs-rio = { path = "crates/rio", version = "1.0.0-rc.2" }
+rustfs-rio-v2 = { path = "crates/rio-v2", version = "1.0.0-rc.2" }
+rustfs-s3-types = { path = "crates/s3-types", version = "1.0.0-rc.2" }
+rustfs-s3-ops = { path = "crates/s3-ops", version = "1.0.0-rc.2" }
+rustfs-s3select-api = { path = "crates/s3select-api", version = "1.0.0-rc.2" }
+rustfs-s3select-query = { path = "crates/s3select-query", version = "1.0.0-rc.2" }
+rustfs-scanner = { path = "crates/scanner", version = "1.0.0-rc.2" }
+rustfs-security-governance = { path = "crates/security-governance", version = "1.0.0-rc.2" }
+rustfs-extension-schema = { path = "crates/extension-schema", version = "1.0.0-rc.2" }
+rustfs-signer = { path = "crates/signer", version = "1.0.0-rc.2" }
+rustfs-storage-api = { path = "crates/storage-api", version = "1.0.0-rc.2" }
+rustfs-trusted-proxies = { path = "crates/trusted-proxies", version = "1.0.0-rc.2" }
+rustfs-targets = { path = "crates/targets", version = "1.0.0-rc.2" }
+rustfs-test-utils = { path = "crates/test-utils", version = "1.0.0-rc.2" }
+rustfs-tls-runtime = { path = "crates/tls-runtime", version = "1.0.0-rc.2" }
+rustfs-utils = { path = "crates/utils", version = "1.0.0-rc.2" }
+rustfs-zip = { path = "./crates/zip", version = "1.0.0-rc.2" }
 
 # Async Runtime and Networking
 async-channel = "2.5.0"

README.md

@@ -116,7 +116,7 @@ chown -R 10001:10001 data logs
 docker run -d -p 9000:9000 -p 9001:9001 -v $(pwd)/data:/data -v $(pwd)/logs:/logs rustfs/rustfs:latest
 
 # Using specific version
-docker run -d -p 9000:9000 -p 9001:9001 -v $(pwd)/data:/data -v $(pwd)/logs:/logs rustfs/rustfs:1.0.0-rc.1
+docker run -d -p 9000:9000 -p 9001:9001 -v $(pwd)/data:/data -v $(pwd)/logs:/logs rustfs/rustfs:1.0.0-rc.2
 ```
 
 If you use [podman](https://github.com/containers/podman) instead of docker, you can install the RustFS with the below command

README_ZH.md

@@ -113,7 +113,7 @@ chown -R 10001:10001 data logs
 docker run -d -p 9000:9000 -p 9001:9001 -v $(pwd)/data:/data -v $(pwd)/logs:/logs rustfs/rustfs:latest
 
 # 使用指定版本运行
-docker run -d -p 9000:9000 -p 9001:9001 -v $(pwd)/data:/data -v $(pwd)/logs:/logs rustfs/rustfs:1.0.0-rc.1
+docker run -d -p 9000:9000 -p 9001:9001 -v $(pwd)/data:/data -v $(pwd)/logs:/logs rustfs/rustfs:1.0.0-rc.2
 ```
 
 如果您通过绑定挂载启用 TLS 证书目录，也请用同样方式准备该目录：

crates/config/src/constants/object.rs

@@ -137,6 +137,22 @@ pub const DEFAULT_TIER_REMOTE_VERSION_STATE_FLEET_CONFIRMED: bool = false;
 const _: () = assert!(!DEFAULT_TIER_REMOTE_VERSION_STATE_WRITE);
 const _: () = assert!(!DEFAULT_TIER_REMOTE_VERSION_STATE_FLEET_CONFIRMED);
 
+/// Request the object-transaction fencing contract used by storage-owned
+/// cleanup receipts and lock-window optimizations.
+///
+/// This is fail-closed: enabling the writer without a live fleet proof rejects
+/// the commit rather than silently using a legacy-safe path.
+pub const ENV_OBJECT_TRANSACTION_FENCING_WRITE: &str = "RUSTFS_OBJECT_TRANSACTION_FENCING_WRITE";
+pub const DEFAULT_OBJECT_TRANSACTION_FENCING_WRITE: bool = false;
+
+/// Operator-attested confirmation that every serving node understands the
+/// object transaction fencing contract.
+pub const ENV_OBJECT_TRANSACTION_FENCING_FLEET_CONFIRMED: &str = "RUSTFS_OBJECT_TRANSACTION_FENCING_FLEET_CONFIRMED";
+pub const DEFAULT_OBJECT_TRANSACTION_FENCING_FLEET_CONFIRMED: bool = false;
+
+const _: () = assert!(!DEFAULT_OBJECT_TRANSACTION_FENCING_WRITE);
+const _: () = assert!(!DEFAULT_OBJECT_TRANSACTION_FENCING_FLEET_CONFIRMED);
+
 /// Request preserving legacy per-part checksum metadata during data movement.
 ///
 /// This remains ineffective until
@@ -673,4 +689,13 @@ mod remote_version_state_tests {
             "RUSTFS_DATA_MOVEMENT_PART_CHECKSUMS_FLEET_CONFIRMED"
         );
     }
+
+    #[test]
+    fn object_transaction_fencing_gate_uses_stable_environment_names() {
+        assert_eq!(super::ENV_OBJECT_TRANSACTION_FENCING_WRITE, "RUSTFS_OBJECT_TRANSACTION_FENCING_WRITE");
+        assert_eq!(
+            super::ENV_OBJECT_TRANSACTION_FENCING_FLEET_CONFIRMED,
+            "RUSTFS_OBJECT_TRANSACTION_FENCING_FLEET_CONFIRMED"
+        );
+    }
 }

crates/e2e_test/src/common.rs

@@ -67,7 +67,10 @@ fn configured_capture_log_path(temp_dir: &str) -> Option<String> {
     capture_log_path(Path::new(&log_dir), temp_dir).map(|path| path.to_string_lossy().into_owned())
 }
 
-fn capture_command_logs(command: &mut Command, log_path: Option<&str>) -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
+pub(crate) fn capture_command_logs(
+    command: &mut Command,
+    log_path: Option<&str>,
+) -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
     let Some(log_path) = log_path else {
         return Ok(());
     };

crates/e2e_test/src/compression_test.rs

@@ -2,6 +2,7 @@
 
 use crate::common::{RustFSTestEnvironment, init_logging, rustfs_binary_path};
 use aws_sdk_s3::primitives::ByteStream;
+use aws_sdk_s3::types::{CompletedMultipartUpload, CompletedPart};
 use serial_test::serial;
 use std::fs;
 use std::path::PathBuf;
@@ -25,6 +26,15 @@ fn generate_compressible_data(size: usize) -> Vec<u8> {
     data
 }
 
+/// Deterministic 2048-byte-period binary pattern that compresses extremely well: every part
+/// yields many compressed blocks, which is exactly the shape that reproduced the mid-payload
+/// Pending truncation (rustfs/rustfs#5957).
+fn generate_high_ratio_binary_data(size: usize, seed: u8) -> Vec<u8> {
+    (0..size)
+        .map(|i| ((i as u64).wrapping_mul(2_654_435_761).wrapping_add(seed as u64) >> 3) as u8)
+        .collect()
+}
+
 fn find_part_files(temp_dir: &str, bucket: &str, object_key: &str) -> Vec<PathBuf> {
     let bucket_path = PathBuf::from(temp_dir).join(bucket);
     let mut part_files = Vec::new();
@@ -55,9 +65,14 @@ async fn start_rustfs_with_compression(env: &mut RustFSTestEnvironment) -> Resul
     env.cleanup_existing_processes().await?;
 
     let binary_path = rustfs_binary_path();
-    let process = Command::new(&binary_path)
+    // Route the child's stdout/stderr through the shared RUSTFS_E2E_LOG_DIR
+    // capture (survives the temp-dir cleanup on Drop and is uploaded as a CI
+    // artifact); without the env var the child inherits stdio as before.
+    let mut command = Command::new(&binary_path);
+    command
         .env("RUSTFS_CONSOLE_ENABLE", "false")
         .env("RUSTFS_COMPRESSION_ENABLED", "true")
+        .env("RUSTFS_COMPRESSION_MULTIPART_ENABLED", "true")
         .args([
             "--address",
             &env.address,
@@ -66,8 +81,9 @@ async fn start_rustfs_with_compression(env: &mut RustFSTestEnvironment) -> Resul
             "--secret-key",
             &env.secret_key,
             &env.temp_dir,
-        ])
-        .spawn()?;
+        ]);
+    crate::common::capture_command_logs(&mut command, env.capture_log_path.as_deref())?;
+    let process = command.spawn()?;
 
     env.process = Some(process);
 
@@ -154,3 +170,647 @@ async fn test_compression_roundtrip() -> Result<(), Box<dyn std::error::Error +
     env.stop_server();
     Ok(())
 }
+
+const MULTIPART_COMPRESSION_BUCKET: &str = "compression-multipart-bucket";
+const MPU_PART1_SIZE: usize = 5 * 1024 * 1024;
+const MPU_PART2_SIZE: usize = 1024 * 1024;
+
+async fn multipart_upload(
+    client: &aws_sdk_s3::Client,
+    bucket: &str,
+    key: &str,
+    parts: &[&[u8]],
+) -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
+    let create = client.create_multipart_upload().bucket(bucket).key(key).send().await?;
+    let upload_id = create.upload_id().ok_or("missing upload id")?.to_string();
+
+    let mut completed_parts = Vec::with_capacity(parts.len());
+    for (i, part) in parts.iter().enumerate() {
+        let part_number = (i + 1) as i32;
+        let upload = client
+            .upload_part()
+            .bucket(bucket)
+            .key(key)
+            .upload_id(&upload_id)
+            .part_number(part_number)
+            .body(ByteStream::from(part.to_vec()))
+            .send()
+            .await?;
+        completed_parts.push(
+            CompletedPart::builder()
+                .part_number(part_number)
+                .e_tag(upload.e_tag().unwrap_or_default())
+                .build(),
+        );
+    }
+
+    client
+        .complete_multipart_upload()
+        .bucket(bucket)
+        .key(key)
+        .upload_id(&upload_id)
+        .multipart_upload(CompletedMultipartUpload::builder().set_parts(Some(completed_parts)).build())
+        .send()
+        .await?;
+    Ok(())
+}
+
+async fn fetch_range(
+    client: &aws_sdk_s3::Client,
+    bucket: &str,
+    key: &str,
+    range: &str,
+) -> Result<Vec<u8>, Box<dyn std::error::Error + Send + Sync>> {
+    let response = client.get_object().bucket(bucket).key(key).range(range).send().await?;
+    Ok(response.body.collect().await?.into_bytes().to_vec())
+}
+
+/// Multipart disk compression roundtrip: parts are written as independent
+/// compressed streams and every GET shape must reassemble the original bytes
+/// (rustfs/rustfs#5957: multipart uploads previously bypassed disk compression
+/// entirely).
+#[tokio::test]
+#[serial]
+async fn test_compression_multipart_roundtrip() -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
+    init_logging();
+    info!("Starting multipart compression roundtrip test");
+
+    let mut env = RustFSTestEnvironment::new().await?;
+    start_rustfs_with_compression(&mut env).await?;
+
+    let client = env.create_s3_client();
+    env.create_test_bucket(MULTIPART_COMPRESSION_BUCKET).await?;
+
+    let object_key = "multipart-compressible.txt";
+    let part1 = generate_compressible_data(MPU_PART1_SIZE);
+    let part2 = generate_compressible_data(MPU_PART2_SIZE);
+    let mut original_data = part1.clone();
+    original_data.extend_from_slice(&part2);
+    let total_size = original_data.len();
+
+    multipart_upload(&client, MULTIPART_COMPRESSION_BUCKET, object_key, &[&part1, &part2]).await?;
+
+    let head_response = client
+        .head_object()
+        .bucket(MULTIPART_COMPRESSION_BUCKET)
+        .key(object_key)
+        .send()
+        .await?;
+    assert_eq!(
+        head_response.content_length().unwrap_or(0) as usize,
+        total_size,
+        "Content-Length should be the logical object size"
+    );
+
+    let part_files = find_part_files(&env.temp_dir, MULTIPART_COMPRESSION_BUCKET, object_key);
+    assert!(!part_files.is_empty(), "expected on-disk part files for the multipart object");
+    let total_physical_size: u64 = part_files.iter().filter_map(|p| fs::metadata(p).ok()).map(|m| m.len()).sum();
+    assert!(
+        total_physical_size < (total_size / 2) as u64,
+        "Physical size {total_physical_size} should be well below original size {total_size} (multipart compression applied)"
+    );
+    info!("Multipart physical storage size: {total_physical_size} bytes (compressed from {total_size} bytes)");
+
+    // Full GET must reassemble both independently compressed parts.
+    let get_response = client
+        .get_object()
+        .bucket(MULTIPART_COMPRESSION_BUCKET)
+        .key(object_key)
+        .send()
+        .await?;
+    let downloaded = get_response.body.collect().await?.into_bytes();
+    assert_eq!(downloaded.len(), total_size);
+    assert_eq!(&downloaded[..], &original_data[..], "full GET data mismatch");
+
+    // Range fully inside part 1.
+    let range_inside_part1 = fetch_range(&client, MULTIPART_COMPRESSION_BUCKET, object_key, "bytes=1024-999423").await?;
+    assert_eq!(&range_inside_part1[..], &original_data[1024..999424], "part-1 range mismatch");
+
+    // Range crossing the part boundary.
+    let boundary_start = MPU_PART1_SIZE - 128 * 1024;
+    let boundary_end = MPU_PART1_SIZE + 128 * 1024 - 1;
+    let range_crossing = fetch_range(
+        &client,
+        MULTIPART_COMPRESSION_BUCKET,
+        object_key,
+        &format!("bytes={boundary_start}-{boundary_end}"),
+    )
+    .await?;
+    assert_eq!(
+        &range_crossing[..],
+        &original_data[boundary_start..boundary_end + 1],
+        "boundary-crossing range mismatch"
+    );
+
+    // Range fully inside part 2.
+    let part2_start = MPU_PART1_SIZE + 4096;
+    let part2_end = MPU_PART1_SIZE + 256 * 1024 - 1;
+    let range_inside_part2 = fetch_range(
+        &client,
+        MULTIPART_COMPRESSION_BUCKET,
+        object_key,
+        &format!("bytes={part2_start}-{part2_end}"),
+    )
+    .await?;
+    assert_eq!(
+        &range_inside_part2[..],
+        &original_data[part2_start..part2_end + 1],
+        "part-2 range mismatch"
+    );
+
+    // Suffix range (last 128 KiB, entirely in part 2).
+    let suffix_len = 128 * 1024;
+    let suffix = fetch_range(&client, MULTIPART_COMPRESSION_BUCKET, object_key, &format!("bytes=-{suffix_len}")).await?;
+    assert_eq!(&suffix[..], &original_data[total_size - suffix_len..], "suffix range mismatch");
+
+    // partNumber GETs must return each original part.
+    for (part_number, expected) in [(1, &part1), (2, &part2)] {
+        let response = client
+            .get_object()
+            .bucket(MULTIPART_COMPRESSION_BUCKET)
+            .key(object_key)
+            .part_number(part_number)
+            .send()
+            .await?;
+        let body = response.body.collect().await?.into_bytes();
+        assert_eq!(&body[..], &expected[..], "partNumber={part_number} GET mismatch");
+    }
+
+    info!("Multipart compression roundtrip test passed");
+    env.delete_test_bucket(MULTIPART_COMPRESSION_BUCKET).await?;
+    env.stop_server();
+    Ok(())
+}
+
+const MPU_HIGH_RATIO_BUCKET: &str = "compression-mpu-high-ratio-bucket";
+
+/// High-ratio binary multipart payload: the object key is on the compression allow-list, so the
+/// disk-compression path runs and each part is stored as many compressed blocks — the shape that
+/// reproduced the mid-payload Pending truncation (rustfs/rustfs#5957). Every GET shape must return
+/// the exact original bytes, and the stored size must show the data really was compressed.
+#[tokio::test]
+#[serial]
+async fn test_compression_multipart_high_ratio_binary_roundtrip() -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
+    init_logging();
+    info!("Starting multipart high-ratio binary compression roundtrip test");
+
+    let mut env = RustFSTestEnvironment::new().await?;
+    start_rustfs_with_compression(&mut env).await?;
+
+    let client = env.create_s3_client();
+    env.create_test_bucket(MPU_HIGH_RATIO_BUCKET).await?;
+
+    let object_key = "multipart-high-ratio.txt";
+    let part1 = generate_high_ratio_binary_data(MPU_PART1_SIZE, 7);
+    let part2 = generate_high_ratio_binary_data(MPU_PART2_SIZE, 61);
+    let mut original_data = part1.clone();
+    original_data.extend_from_slice(&part2);
+    let total_size = original_data.len();
+
+    multipart_upload(&client, MPU_HIGH_RATIO_BUCKET, object_key, &[&part1, &part2]).await?;
+
+    let head_response = client
+        .head_object()
+        .bucket(MPU_HIGH_RATIO_BUCKET)
+        .key(object_key)
+        .send()
+        .await?;
+    assert_eq!(
+        head_response.content_length().unwrap_or(0) as usize,
+        total_size,
+        "Content-Length should be the logical object size"
+    );
+
+    // This pattern compresses to roughly 1/50 of its logical size, so a comfortably loose 2x
+    // margin still proves the parts were stored compressed rather than raw or double-encoded.
+    let part_files = find_part_files(&env.temp_dir, MPU_HIGH_RATIO_BUCKET, object_key);
+    assert!(!part_files.is_empty(), "expected on-disk part files for the multipart object");
+    let total_physical_size: u64 = part_files.iter().filter_map(|p| fs::metadata(p).ok()).map(|m| m.len()).sum();
+    assert!(
+        total_physical_size < (total_size as u64) / 2,
+        "Physical size {total_physical_size} should be far below the logical size {total_size} for high-ratio data"
+    );
+    info!("High-ratio multipart physical storage size: {total_physical_size} bytes (logical {total_size} bytes)");
+
+    info!("step: full GET");
+    let get_response = client
+        .get_object()
+        .bucket(MPU_HIGH_RATIO_BUCKET)
+        .key(object_key)
+        .send()
+        .await?;
+    let downloaded = get_response.body.collect().await?.into_bytes();
+    assert_eq!(downloaded.len(), total_size);
+    assert_eq!(&downloaded[..], &original_data[..], "full GET data mismatch");
+
+    // Range crossing the part boundary.
+    info!("step: boundary range GET");
+    let boundary_start = MPU_PART1_SIZE - 128 * 1024;
+    let boundary_end = MPU_PART1_SIZE + 128 * 1024 - 1;
+    let range_crossing = fetch_range(
+        &client,
+        MPU_HIGH_RATIO_BUCKET,
+        object_key,
+        &format!("bytes={boundary_start}-{boundary_end}"),
+    )
+    .await?;
+    assert_eq!(
+        &range_crossing[..],
+        &original_data[boundary_start..boundary_end + 1],
+        "boundary-crossing range mismatch"
+    );
+
+    // partNumber GET for the trailing part.
+    info!("step: partNumber GET");
+    let part2_response = client
+        .get_object()
+        .bucket(MPU_HIGH_RATIO_BUCKET)
+        .key(object_key)
+        .part_number(2)
+        .send()
+        .await?;
+    let part2_body = part2_response.body.collect().await?.into_bytes();
+    assert_eq!(&part2_body[..], &part2[..], "partNumber=2 GET mismatch");
+
+    info!("Multipart high-ratio binary compression roundtrip test passed");
+    env.delete_test_bucket(MPU_HIGH_RATIO_BUCKET).await?;
+    env.stop_server();
+    Ok(())
+}
+
+const MPU_COPY_COMPRESSION_BUCKET: &str = "compression-mpu-copy-bucket";
+const MPU_COPY_SOURCE_SIZE: usize = 6 * 1024 * 1024;
+const MPU_COPY_RANGE_LEN: usize = 5 * 1024 * 1024;
+
+/// UploadPartCopy feeds a part from an already stored (and already compressed) object. The copied
+/// range must be decompressed on read and re-compressed into the destination part, so the final
+/// object has to match "source prefix + uploaded tail" byte for byte.
+#[tokio::test]
+#[serial]
+async fn test_compression_multipart_upload_part_copy_roundtrip() -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
+    init_logging();
+    info!("Starting multipart upload-part-copy compression roundtrip test");
+
+    let mut env = RustFSTestEnvironment::new().await?;
+    start_rustfs_with_compression(&mut env).await?;
+
+    let client = env.create_s3_client();
+    env.create_test_bucket(MPU_COPY_COMPRESSION_BUCKET).await?;
+
+    // Source object: a plain PUT that goes through the single-stream compression path.
+    let source_key = "copy-source.txt";
+    let source_data = generate_compressible_data(MPU_COPY_SOURCE_SIZE);
+    client
+        .put_object()
+        .bucket(MPU_COPY_COMPRESSION_BUCKET)
+        .key(source_key)
+        .body(ByteStream::from(source_data.clone()))
+        .send()
+        .await?;
+
+    // Destination object: part 1 copied from the source, part 2 uploaded directly.
+    let target_key = "copy-target.txt";
+    let part2 = generate_compressible_data(MPU_PART2_SIZE);
+    let mut expected_data = source_data[..MPU_COPY_RANGE_LEN].to_vec();
+    expected_data.extend_from_slice(&part2);
+    let total_size = expected_data.len();
+
+    let create = client
+        .create_multipart_upload()
+        .bucket(MPU_COPY_COMPRESSION_BUCKET)
+        .key(target_key)
+        .send()
+        .await?;
+    let upload_id = create.upload_id().ok_or("missing upload id")?.to_string();
+
+    let copy_part = client
+        .upload_part_copy()
+        .bucket(MPU_COPY_COMPRESSION_BUCKET)
+        .key(target_key)
+        .upload_id(&upload_id)
+        .part_number(1)
+        .copy_source(format!("{MPU_COPY_COMPRESSION_BUCKET}/{source_key}"))
+        .copy_source_range(format!("bytes=0-{}", MPU_COPY_RANGE_LEN - 1))
+        .send()
+        .await?;
+    let copy_etag = copy_part
+        .copy_part_result()
+        .and_then(|r| r.e_tag())
+        .ok_or("missing copy part etag")?
+        .to_string();
+
+    let uploaded_part = client
+        .upload_part()
+        .bucket(MPU_COPY_COMPRESSION_BUCKET)
+        .key(target_key)
+        .upload_id(&upload_id)
+        .part_number(2)
+        .body(ByteStream::from(part2.clone()))
+        .send()
+        .await?;
+
+    client
+        .complete_multipart_upload()
+        .bucket(MPU_COPY_COMPRESSION_BUCKET)
+        .key(target_key)
+        .upload_id(&upload_id)
+        .multipart_upload(
+            CompletedMultipartUpload::builder()
+                .parts(CompletedPart::builder().part_number(1).e_tag(copy_etag).build())
+                .parts(
+                    CompletedPart::builder()
+                        .part_number(2)
+                        .e_tag(uploaded_part.e_tag().unwrap_or_default())
+                        .build(),
+                )
+                .build(),
+        )
+        .send()
+        .await?;
+
+    let head_response = client
+        .head_object()
+        .bucket(MPU_COPY_COMPRESSION_BUCKET)
+        .key(target_key)
+        .send()
+        .await?;
+    assert_eq!(
+        head_response.content_length().unwrap_or(0) as usize,
+        total_size,
+        "Content-Length should be the logical object size"
+    );
+
+    let part_files = find_part_files(&env.temp_dir, MPU_COPY_COMPRESSION_BUCKET, target_key);
+    assert!(!part_files.is_empty(), "expected on-disk part files for the copied object");
+    let total_physical_size: u64 = part_files.iter().filter_map(|p| fs::metadata(p).ok()).map(|m| m.len()).sum();
+    assert!(
+        total_physical_size < (total_size / 2) as u64,
+        "Physical size {total_physical_size} should be well below original size {total_size} (copied part compression applied)"
+    );
+
+    let get_response = client
+        .get_object()
+        .bucket(MPU_COPY_COMPRESSION_BUCKET)
+        .key(target_key)
+        .send()
+        .await?;
+    let downloaded = get_response.body.collect().await?.into_bytes();
+    assert_eq!(downloaded.len(), total_size);
+    assert_eq!(&downloaded[..], &expected_data[..], "copied multipart GET data mismatch");
+
+    info!("Multipart upload-part-copy compression roundtrip test passed");
+    env.delete_test_bucket(MPU_COPY_COMPRESSION_BUCKET).await?;
+    env.stop_server();
+    Ok(())
+}
+
+const MPU_THREE_PARTS_BUCKET: &str = "compression-mpu-three-parts-bucket";
+const MPU_THREE_PARTS_TAIL_SIZE: usize = 512 * 1024;
+
+/// Three-part upload with uneven part sizes: each partNumber GET must map back to exactly one
+/// compressed part stream, and a suffix range must resolve inside the trailing part.
+#[tokio::test]
+#[serial]
+async fn test_compression_multipart_three_parts_part_number_gets() -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
+    init_logging();
+    info!("Starting three-part multipart compression partNumber test");
+
+    let mut env = RustFSTestEnvironment::new().await?;
+    start_rustfs_with_compression(&mut env).await?;
+
+    let client = env.create_s3_client();
+    env.create_test_bucket(MPU_THREE_PARTS_BUCKET).await?;
+
+    let object_key = "multipart-three-parts.txt";
+    let part1 = generate_compressible_data(MPU_PART1_SIZE);
+    let part2 = generate_compressible_data(MPU_PART1_SIZE);
+    let part3 = generate_compressible_data(MPU_THREE_PARTS_TAIL_SIZE);
+    let mut original_data = part1.clone();
+    original_data.extend_from_slice(&part2);
+    original_data.extend_from_slice(&part3);
+    let total_size = original_data.len();
+
+    multipart_upload(&client, MPU_THREE_PARTS_BUCKET, object_key, &[&part1, &part2, &part3]).await?;
+
+    let head_response = client
+        .head_object()
+        .bucket(MPU_THREE_PARTS_BUCKET)
+        .key(object_key)
+        .send()
+        .await?;
+    assert_eq!(
+        head_response.content_length().unwrap_or(0) as usize,
+        total_size,
+        "Content-Length should be the logical object size"
+    );
+
+    let part_files = find_part_files(&env.temp_dir, MPU_THREE_PARTS_BUCKET, object_key);
+    assert!(!part_files.is_empty(), "expected on-disk part files for the multipart object");
+    let total_physical_size: u64 = part_files.iter().filter_map(|p| fs::metadata(p).ok()).map(|m| m.len()).sum();
+    assert!(
+        total_physical_size < (total_size / 2) as u64,
+        "Physical size {total_physical_size} should be well below original size {total_size} (multipart compression applied)"
+    );
+
+    // Every partNumber GET must return exactly the bytes of the corresponding uploaded part.
+    for (part_number, expected) in [(1, &part1), (2, &part2), (3, &part3)] {
+        let response = client
+            .get_object()
+            .bucket(MPU_THREE_PARTS_BUCKET)
+            .key(object_key)
+            .part_number(part_number)
+            .send()
+            .await?;
+        let body = response.body.collect().await?.into_bytes();
+        assert_eq!(&body[..], &expected[..], "partNumber={part_number} GET mismatch");
+    }
+
+    // Suffix range (last 64 KiB) resolves inside the trailing part.
+    let suffix_len = 64 * 1024;
+    let suffix = fetch_range(&client, MPU_THREE_PARTS_BUCKET, object_key, &format!("bytes=-{suffix_len}")).await?;
+    assert_eq!(&suffix[..], &original_data[total_size - suffix_len..], "suffix range mismatch");
+
+    info!("Three-part multipart compression partNumber test passed");
+    env.delete_test_bucket(MPU_THREE_PARTS_BUCKET).await?;
+    env.stop_server();
+    Ok(())
+}
+
+const MPU_SSE_COMPRESSION_BUCKET: &str = "compression-mpu-sse-bucket";
+
+async fn start_rustfs_with_compression_and_sse(
+    env: &mut RustFSTestEnvironment,
+) -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
+    use base64::Engine;
+    env.cleanup_existing_processes().await?;
+
+    let binary_path = rustfs_binary_path();
+    let master_key = base64::engine::general_purpose::STANDARD.encode([0x42u8; 32]);
+    // Server output goes to a file inside the per-test temp dir so a failing
+    // run can be diagnosed from the child's logs.
+    let server_log = std::fs::File::create(format!("{}/server.log", env.temp_dir))?;
+    let server_log_err = server_log.try_clone()?;
+    let process = Command::new(&binary_path)
+        .env("RUSTFS_CONSOLE_ENABLE", "false")
+        .env("RUSTFS_COMPRESSION_ENABLED", "true")
+        .env("RUSTFS_COMPRESSION_MULTIPART_ENABLED", "true")
+        .env("RUSTFS_SSE_S3_MASTER_KEY", master_key)
+        .env("RUST_LOG", "rustfs=info,rustfs_ecstore=info")
+        .stdout(std::process::Stdio::from(server_log))
+        .stderr(std::process::Stdio::from(server_log_err))
+        .args([
+            "--address",
+            &env.address,
+            "--access-key",
+            &env.access_key,
+            "--secret-key",
+            &env.secret_key,
+            &env.temp_dir,
+        ])
+        .spawn()?;
+
+    env.process = Some(process);
+
+    info!("Waiting for RustFS server with compression + SSE-S3 enabled on {}", env.address);
+    for i in 0..30 {
+        if TcpStream::connect(&env.address).await.is_ok() {
+            info!("RustFS server is ready after {} attempts", i + 1);
+            return Ok(());
+        }
+        if i == 29 {
+            return Err("RustFS server failed to become ready".into());
+        }
+        sleep(Duration::from_secs(1)).await;
+    }
+    Ok(())
+}
+
+/// SSE-S3 + disk compression multipart: each part is compressed and then encrypted, and every GET
+/// shape must still return the original plaintext bytes. Physical size must shrink because the
+/// compression runs before encryption.
+#[tokio::test]
+#[serial]
+async fn test_compression_multipart_sse_s3_roundtrip() -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
+    use aws_sdk_s3::types::ServerSideEncryption;
+
+    init_logging();
+    info!("Starting SSE-S3 multipart compression roundtrip test");
+
+    let mut env = RustFSTestEnvironment::new().await?;
+    start_rustfs_with_compression_and_sse(&mut env).await?;
+
+    let client = env.create_s3_client();
+    env.create_test_bucket(MPU_SSE_COMPRESSION_BUCKET).await?;
+
+    let object_key = "multipart-sse-compressible.txt";
+    let part1 = generate_compressible_data(MPU_PART1_SIZE);
+    let part2 = generate_compressible_data(MPU_PART2_SIZE);
+    let mut original_data = part1.clone();
+    original_data.extend_from_slice(&part2);
+    let total_size = original_data.len();
+
+    let create = client
+        .create_multipart_upload()
+        .bucket(MPU_SSE_COMPRESSION_BUCKET)
+        .key(object_key)
+        .server_side_encryption(ServerSideEncryption::Aes256)
+        .send()
+        .await?;
+    let upload_id = create.upload_id().ok_or("missing upload id")?.to_string();
+
+    let mut completed_parts = Vec::new();
+    for (i, part) in [&part1, &part2].into_iter().enumerate() {
+        let part_number = (i + 1) as i32;
+        let upload = client
+            .upload_part()
+            .bucket(MPU_SSE_COMPRESSION_BUCKET)
+            .key(object_key)
+            .upload_id(&upload_id)
+            .part_number(part_number)
+            .body(ByteStream::from(part.clone()))
+            .send()
+            .await?;
+        completed_parts.push(
+            CompletedPart::builder()
+                .part_number(part_number)
+                .e_tag(upload.e_tag().unwrap_or_default())
+                .build(),
+        );
+    }
+
+    client
+        .complete_multipart_upload()
+        .bucket(MPU_SSE_COMPRESSION_BUCKET)
+        .key(object_key)
+        .upload_id(&upload_id)
+        .multipart_upload(CompletedMultipartUpload::builder().set_parts(Some(completed_parts)).build())
+        .send()
+        .await?;
+
+    let head_response = client
+        .head_object()
+        .bucket(MPU_SSE_COMPRESSION_BUCKET)
+        .key(object_key)
+        .send()
+        .await?;
+    assert_eq!(
+        head_response.content_length().unwrap_or(0) as usize,
+        total_size,
+        "Content-Length should be the logical object size"
+    );
+    assert_eq!(
+        head_response.server_side_encryption(),
+        Some(&ServerSideEncryption::Aes256),
+        "HEAD must report SSE-S3"
+    );
+
+    let part_files = find_part_files(&env.temp_dir, MPU_SSE_COMPRESSION_BUCKET, object_key);
+    assert!(!part_files.is_empty(), "expected on-disk part files for the multipart object");
+    let total_physical_size: u64 = part_files.iter().filter_map(|p| fs::metadata(p).ok()).map(|m| m.len()).sum();
+    assert!(
+        total_physical_size < (total_size / 2) as u64,
+        "Physical size {total_physical_size} should be well below original size {total_size} (compress-then-encrypt applied)"
+    );
+
+    let get_response = client
+        .get_object()
+        .bucket(MPU_SSE_COMPRESSION_BUCKET)
+        .key(object_key)
+        .send()
+        .await?;
+    let downloaded = get_response.body.collect().await?.into_bytes();
+    assert_eq!(downloaded.len(), total_size);
+    assert_eq!(&downloaded[..], &original_data[..], "SSE-S3 multipart full GET data mismatch");
+
+    // Range crossing the part boundary must decrypt and decompress across parts.
+    let boundary_start = MPU_PART1_SIZE - 64 * 1024;
+    let boundary_end = MPU_PART1_SIZE + 64 * 1024 - 1;
+    let range_crossing = fetch_range(
+        &client,
+        MPU_SSE_COMPRESSION_BUCKET,
+        object_key,
+        &format!("bytes={boundary_start}-{boundary_end}"),
+    )
+    .await?;
+    assert_eq!(
+        &range_crossing[..],
+        &original_data[boundary_start..boundary_end + 1],
+        "SSE-S3 boundary-crossing range mismatch"
+    );
+
+    // partNumber GET for the trailing part.
+    let part2_response = client
+        .get_object()
+        .bucket(MPU_SSE_COMPRESSION_BUCKET)
+        .key(object_key)
+        .part_number(2)
+        .send()
+        .await?;
+    let part2_body = part2_response.body.collect().await?.into_bytes();
+    assert_eq!(&part2_body[..], &part2[..], "SSE-S3 partNumber=2 GET mismatch");
+
+    info!("SSE-S3 multipart compression roundtrip test passed");
+    env.delete_test_bucket(MPU_SSE_COMPRESSION_BUCKET).await?;
+    env.stop_server();
+    Ok(())
+}

crates/e2e_test/src/inline_fast_path_cluster_test.rs

@@ -1828,33 +1828,36 @@ async fn four_node_compressed_inline_fallback() -> TestResult {
     Ok(())
 }
 
+/// Multipart disk compression is live again, so a compression-enabled cluster classifies multipart objects as compressed and the roundtrip (full GET plus partNumber GET) must still return the original bytes.
+/// Reverting the multipart compression fix must fail this test.
 #[tokio::test]
 #[serial]
-async fn four_node_multipart_ignores_disk_compression_fallback() -> TestResult {
+async fn four_node_multipart_disk_compression_roundtrip() -> TestResult {
     init_logging();
 
     let collector = OtlpMetricCollector::start().await?;
     let mut cluster = RustFSTestClusterEnvironment::new(4).await?;
     configure_reader_metric_cluster(&mut cluster, &collector);
     cluster.set_env("RUSTFS_COMPRESSION_ENABLED", "true");
+    cluster.set_env("RUSTFS_COMPRESSION_MULTIPART_ENABLED", "true");
     cluster.start().await?;
 
-    let bucket = "inline-multipart-compression-fallback";
+    let bucket = "inline-multipart-compression-roundtrip";
     cluster.create_test_bucket(bucket).await?;
     let client = cluster.create_s3_client(0)?;
-    let key = "multipart/compression-disabled.txt";
+    let key = "multipart/compressed.txt";
     let (body, second_part, etag) = put_two_part_multipart(&client, bucket, key).await?;
 
     assert_reader_path(
         &collector,
         &client,
-        ReaderPathExpectation::for_class(ReaderObject::new(bucket, key, &body, etag.as_deref(), None), LEGACY_DUPLEX, MULTIPART),
+        ReaderPathExpectation::for_class(ReaderObject::new(bucket, key, &body, etag.as_deref(), None), LEGACY_DUPLEX, COMPRESSED),
     )
     .await?;
     assert_part_number_reader_path(
         &collector,
         &client,
-        PartNumberReaderPathExpectation::new(bucket, key, &second_part, body.len(), MULTIPART, LEGACY_DUPLEX),
+        PartNumberReaderPathExpectation::new(bucket, key, &second_part, body.len(), COMPRESSED, LEGACY_DUPLEX),
     )
     .await?;
 
@@ -1871,6 +1874,7 @@ async fn four_node_mixed_msgpack_compat_mode_preserves_fallback_controls() -> Te
     let sse_master_key = base64::engine::general_purpose::STANDARD.encode([0x42u8; 32]);
     cluster.set_env("RUSTFS_SSE_S3_MASTER_KEY", sse_master_key);
     cluster.set_env("RUSTFS_COMPRESSION_ENABLED", "true");
+    cluster.set_env("RUSTFS_COMPRESSION_MULTIPART_ENABLED", "true");
     configure_mixed_msgpack_cluster(&mut cluster, &collector)?;
     cluster.start().await?;
 
@@ -1890,14 +1894,21 @@ async fn four_node_mixed_msgpack_compat_mode_preserves_fallback_controls() -> Te
         ReaderPathExpectation::for_class(
             ReaderObject::new(bucket, multipart_key, &multipart_body, multipart_etag.as_deref(), None),
             LEGACY_DUPLEX,
-            MULTIPART,
+            COMPRESSED,
         ),
     )
     .await?;
     assert_part_number_reader_path(
         &collector,
         &client,
-        PartNumberReaderPathExpectation::new(bucket, multipart_key, &second_part, multipart_body.len(), MULTIPART, LEGACY_DUPLEX),
+        PartNumberReaderPathExpectation::new(
+            bucket,
+            multipart_key,
+            &second_part,
+            multipart_body.len(),
+            COMPRESSED,
+            LEGACY_DUPLEX,
+        ),
     )
     .await?;
     assert_msgpack_decode_observed(&collector, &decode_before).await?;
@@ -2353,7 +2364,11 @@ async fn four_node_mixed_msgpack_compat_mode_preserves_fallback_controls_during_
     hot_client.create_bucket().bucket(bucket).send().await?;
     put_lifecycle_with_transition_retry(&hot_client, bucket, &tier_name).await?;
 
-    let key = "transition/mixed-multipart.bin";
+    // `.zip` sits on the disk-compression exclusion list: this test pins
+    // msgpack compat controls across ILM transition, and a compressed object
+    // would classify as `compressed` instead of `remote` (and the warm-tier
+    // read path does not decode compression — tracked separately).
+    let key = "transition/mixed-multipart.zip";
     let (body, second_part, etag) = put_two_part_multipart(&hot_client, bucket, key).await?;
     wait_for_transition(&hot_client, bucket, key, &tier_name).await?;
     assert!(

crates/e2e_test/src/kms/kms_ilm_sse_kms_test.rs

@@ -97,7 +97,7 @@ async fn start_enforcing_ilm_server(env: &mut LocalKMSTestEnvironment) -> TestRe
 
     let envs = [
         ("RUSTFS_KMS_ALLOW_INSECURE_DEV_DEFAULTS", "true"),
-        ("RUSTFS_KMS_ENFORCE_SSE_KEY_POLICY", "false"),
+        ("RUSTFS_KMS_ENFORCE_SSE_KEY_POLICY", "true"),
         ("RUSTFS_SCANNER_CYCLE", "1"),
         ("RUSTFS_ILM_PROCESS_TIME", "1"),
         ("RUSTFS_ILM_DEBUG_DAY_SECS", "2"),
@@ -486,7 +486,6 @@ async fn ilm_expiration_on_sse_kms_bucket_under_enforcement() -> TestResult {
 /// depend on scanner scheduling; the 1s scanner cycle stays on as a backstop.
 #[tokio::test]
 #[serial]
-#[ignore = "pins rustfs/rustfs#6025: GET on a transitioned managed-SSE object silently returns corrupt bytes (fails with enforcement on AND off, so it is not an authorization regression); un-ignore with the fix"]
 async fn ilm_transition_on_sse_kms_bucket_under_enforcement_reads_back() -> TestResult {
     init_logging();
 

crates/ecstore/src/api/mod.rs

@@ -131,6 +131,8 @@ pub mod bucket {
     }
 
     pub mod metadata_sys {
+        #[cfg(feature = "test-util")]
+        pub use crate::bucket::metadata_sys::ConfigWriteLockProbe;
         pub use crate::bucket::metadata_sys::{
             BucketMetadataMutationGuard, BucketMetadataSys, ObjectLockConfigState, acquire_bucket_metadata_transaction_lock,
             capture_bucket_metadata_incarnation, delete, delete_if_incarnation, get, get_accelerate_config, get_bucket_policy,
@@ -140,7 +142,7 @@ pub mod bucket {
             get_replication_config, get_request_payment_config, get_sse_config, get_tagging_config, get_versioning_config,
             get_website_config, init_bucket_metadata_sys, list_bucket_targets, reload_bucket_metadata, remove_bucket_metadata,
             set_bucket_metadata, update, update_bucket_targets_under_transaction_lock, update_config_with, update_if_incarnation,
-            update_under_transaction_lock,
+            update_quota_if_incarnation, update_under_transaction_lock,
         };
     }
 
@@ -276,7 +278,9 @@ pub mod cluster {
 }
 
 pub mod compression {
-    pub use crate::io_support::compress::{MIN_DISK_COMPRESSIBLE_SIZE, is_disk_compressible, is_disk_compression_enabled};
+    pub use crate::io_support::compress::{
+        MIN_DISK_COMPRESSIBLE_SIZE, is_disk_compressible, is_disk_compression_enabled, is_multipart_disk_compression_enabled,
+    };
 }
 
 pub mod config {
@@ -316,7 +320,7 @@ pub mod data_usage {
         DATA_USAGE_CACHE_NAME, apply_bucket_usage_memory_overlay, compute_bucket_usage,
         init_compression_total_memory_from_backend, invalidate_admin_data_usage_snapshot_cache,
         invalidate_data_usage_snapshot_cache, live_bucket_usage_computations, load_admin_data_usage_from_backend_cached,
-        load_compression_total_from_memory, load_data_usage_from_backend, load_data_usage_from_backend_cached,
+        load_compression_total_from_memory, load_data_usage_from_backend, load_data_usage_from_backend_cached, quota_object_size,
         record_bucket_delete_marker_memory, record_bucket_object_delete_memory, record_bucket_object_version_write_memory,
         record_bucket_object_write_memory, record_bucket_object_write_unknown_previous_memory, record_compression_total_memory,
         refresh_bucket_usage_from_object_layer, refresh_versioned_bucket_usage_from_object_layer,
@@ -403,8 +407,11 @@ pub mod metrics {
 }
 
 pub mod notification {
+    #[cfg(any(test, feature = "test-util"))]
+    pub use crate::services::notification_sys::rotate_cross_pool_fence_fleet_proof_for_test;
     pub use crate::services::notification_sys::{
-        NotificationPeerErr, NotificationSys, get_global_notification_sys, new_global_notification_sys,
+        CrossPoolFenceFleetProofToken, NotificationPeerErr, NotificationSys, acquire_cross_pool_fence_fleet_proof,
+        cross_pool_fence_fleet_proof_matches, get_global_notification_sys, new_global_notification_sys,
         start_remote_version_state_fleet_probe,
     };
 }
@@ -464,7 +471,8 @@ pub mod set_disk {
 
     #[cfg(feature = "test-util")]
     pub mod test_util {
-        pub use crate::set_disk::{PutObjectCommitBarrier, PutObjectCommitPause};
+        pub use crate::bucket::quota::reservation::fail_next_quota_ledger_save_for_test;
+        pub use crate::set_disk::{MultipartCommitBarrier, MultipartCommitPause, PutObjectCommitBarrier, PutObjectCommitPause};
     }
 }
 

crates/ecstore/src/bucket/lifecycle/bucket_lifecycle_ops.rs

@@ -46,15 +46,13 @@ use crate::bucket::lifecycle::transition_transaction::run_transition_transaction
 use crate::bucket::object_lock::ObjectLockApi;
 use crate::bucket::versioning::VersioningApi as _;
 use crate::bucket::versioning_sys::BucketVersioningSys;
-use crate::client::object_api_utils::new_getobjectreader;
 use crate::disk::error::DiskError;
 use crate::disk::{DeleteOptions, Disk, DiskAPI, RUSTFS_META_BUCKET, RUSTFS_META_MULTIPART_BUCKET, STORAGE_FORMAT_FILE};
 use crate::error::Error;
 use crate::error::StorageError;
-use crate::error::{
-    error_resp_to_object_err, is_err_object_not_found, is_err_read_quorum, is_err_version_not_found, is_network_or_host_down,
-};
+use crate::error::{is_err_object_not_found, is_err_read_quorum, is_err_version_not_found, is_network_or_host_down};
 use crate::object_api::{GetObjectReader, ObjectInfo, ObjectOptions};
+use crate::object_api::{ObjectEncryptionResolver, ReadPlan};
 use crate::services::tier::{
     tier::{TierConfigMgr, TierOperationLease, tier_destination_id_from_metadata},
     warm_backend::WarmBackendGetOpts,
@@ -4400,9 +4398,10 @@ pub async fn get_transitioned_object_reader(
     h: &HeaderMap,
     oi: &ObjectInfo,
     opts: &ObjectOptions,
+    resolver: Option<&dyn ObjectEncryptionResolver>,
 ) -> Result<GetObjectReader, std::io::Error> {
     let tier_config_mgr = runtime_sources::tier_config_mgr_handle();
-    get_transitioned_object_reader_with_tier_manager(bucket, object, rs, h, oi, opts, &tier_config_mgr).await
+    get_transitioned_object_reader_with_tier_manager(bucket, object, rs, h, oi, opts, &tier_config_mgr, resolver).await
 }
 
 fn validate_transition_remote_version(oi: &ObjectInfo) -> Result<bool, std::io::Error> {
@@ -4422,6 +4421,10 @@ fn validate_transition_remote_version(oi: &ObjectInfo) -> Result<bool, std::io::
     }
 }
 
+// The resolver joins the tier manager as the second injected port this read
+// needs; grouping the request half into a struct would churn every call site of
+// a bug fix.
+#[allow(clippy::too_many_arguments)]
 pub(crate) async fn get_transitioned_object_reader_with_tier_manager(
     bucket: &str,
     object: &str,
@@ -4430,6 +4433,7 @@ pub(crate) async fn get_transitioned_object_reader_with_tier_manager(
     oi: &ObjectInfo,
     opts: &ObjectOptions,
     tier_config_mgr: &Arc<RwLock<TierConfigMgr>>,
+    resolver: Option<&dyn ObjectEncryptionResolver>,
 ) -> Result<GetObjectReader, std::io::Error> {
     validate_transition_remote_version(oi)?;
     let expected_identity = tier_destination_id_from_metadata(&oi.user_defined)?;
@@ -4447,11 +4451,16 @@ pub(crate) async fn get_transitioned_object_reader_with_tier_manager(
 
     tgt_client.validate_remote_version_id(&oi.transitioned_object.version_id)?;
 
-    let ret = new_getobjectreader(rs, oi, opts, h);
-    if let Err(err) = ret {
-        return Err(error_resp_to_object_err(err, vec![bucket, object]));
-    }
-    let (get_fn, off, length) = ret.expect("get_transitioned_object_reader should succeed after error check");
+    // The same read plan the local path uses, so the tier fetch is positioned in
+    // the object's *stored* coordinate system and the stream is handed the same
+    // decrypt/decompress transforms. Reading an encrypted object's ciphertext
+    // through a plaintext-coordinate range and skipping the transform is how a
+    // transitioned SSE object used to come back as silently corrupt bytes of the
+    // right length (rustfs/rustfs#6025).
+    let plan = ReadPlan::build_for_request(rs.clone(), oi, opts, h, resolver)
+        .await
+        .map_err(|err| std::io::Error::other(format!("building the read plan for {bucket}/{object} failed: {err}")))?;
+    let (off, length) = (plan.storage_offset() as i64, plan.storage_length());
     let mut gopts = WarmBackendGetOpts::default();
 
     if off >= 0 && length >= 0 {
@@ -4488,7 +4497,10 @@ pub(crate) async fn get_transitioned_object_reader_with_tier_manager(
             );
             e
         })?;
-    Ok(attach_tier_operation_lease(get_fn(reader, h.clone()), tgt_client))
+    let object_reader = plan
+        .into_object_reader(Box::new(reader), oi)
+        .map_err(|err| std::io::Error::other(format!("wrapping the tier stream for {bucket}/{object} failed: {err}")))?;
+    Ok(attach_tier_operation_lease(object_reader, tgt_client))
 }
 
 struct TierOperationLeaseReader {
@@ -5776,6 +5788,7 @@ mod tests {
             &object_info,
             &ObjectOptions::default(),
             &manager,
+            None,
         )
         .await
         .expect("transitioned reader should open");
@@ -5840,6 +5853,7 @@ mod tests {
             &object_info,
             &ObjectOptions::default(),
             &manager,
+            None,
         )
         .await
         {
@@ -5880,6 +5894,7 @@ mod tests {
             &object_info,
             &ObjectOptions::default(),
             &manager,
+            None,
         )
         .await
         {
@@ -6117,6 +6132,7 @@ mod tests {
             &oi,
             &ObjectOptions::default(),
             &manager,
+            None,
         )
         .await
         {
@@ -6140,6 +6156,7 @@ mod tests {
             &oi,
             &ObjectOptions::default(),
             &manager,
+            None,
         )
         .await
         {

crates/ecstore/src/bucket/metadata_sys.rs

@@ -50,6 +50,72 @@ use uuid::Uuid;
 
 const BUCKET_METADATA_REFRESH_INTERVAL: Duration = Duration::from_secs(15 * 60);
 
+#[cfg(any(test, feature = "test-util"))]
+struct ConfigWriteLockProbeState {
+    bucket: String,
+    arrived: tokio::sync::Notify,
+}
+
+#[cfg(any(test, feature = "test-util"))]
+static CONFIG_WRITE_LOCK_PROBES: std::sync::OnceLock<StdMutex<Vec<Arc<ConfigWriteLockProbeState>>>> = std::sync::OnceLock::new();
+
+#[cfg(any(test, feature = "test-util"))]
+pub struct ConfigWriteLockProbe {
+    state: Arc<ConfigWriteLockProbeState>,
+}
+
+#[cfg(any(test, feature = "test-util"))]
+impl ConfigWriteLockProbe {
+    pub fn install(bucket: &str) -> Self {
+        let state = Arc::new(ConfigWriteLockProbeState {
+            bucket: bucket.to_string(),
+            arrived: tokio::sync::Notify::new(),
+        });
+        let mut probes = CONFIG_WRITE_LOCK_PROBES
+            .get_or_init(|| StdMutex::new(Vec::new()))
+            .lock()
+            .expect("config write lock probe mutex should not poison");
+        assert!(
+            !probes.iter().any(|current| current.bucket == state.bucket),
+            "config write lock probe must be unique for a bucket"
+        );
+        probes.push(Arc::clone(&state));
+        drop(probes);
+        Self { state }
+    }
+
+    pub async fn wait_until_attempted(&self) {
+        tokio::time::timeout(Duration::from_secs(30), self.state.arrived.notified())
+            .await
+            .expect("bucket config update should attempt the transaction lock");
+    }
+}
+
+#[cfg(any(test, feature = "test-util"))]
+impl Drop for ConfigWriteLockProbe {
+    fn drop(&mut self) {
+        let mut probes = CONFIG_WRITE_LOCK_PROBES
+            .get_or_init(|| StdMutex::new(Vec::new()))
+            .lock()
+            .expect("config write lock probe mutex should not poison");
+        probes.retain(|state| !Arc::ptr_eq(state, &self.state));
+    }
+}
+
+#[cfg(any(test, feature = "test-util"))]
+fn notify_config_write_lock_attempt(bucket: &str) {
+    let probe = CONFIG_WRITE_LOCK_PROBES
+        .get_or_init(|| StdMutex::new(Vec::new()))
+        .lock()
+        .expect("config write lock probe mutex should not poison")
+        .iter()
+        .find(|probe| probe.bucket == bucket)
+        .cloned();
+    if let Some(probe) = probe {
+        probe.arrived.notify_one();
+    }
+}
+
 #[derive(Clone, Copy)]
 enum MetadataLoadMode {
     Initial,
@@ -590,6 +656,31 @@ pub async fn update_under_transaction_lock(
     update_under_config_write_guard(get_bucket_metadata_sys()?, guard, config_file, data).await
 }
 
+pub async fn update_quota_if_incarnation(
+    bucket: &str,
+    data: Vec<u8>,
+    expected_incarnation_id: Uuid,
+    proof: &crate::services::notification_sys::CrossPoolFenceFleetProofToken,
+) -> Result<OffsetDateTime> {
+    let sys = get_bucket_metadata_sys()?;
+    let guard = Box::pin(acquire_config_write_guard_for_incarnation(
+        sys.clone(),
+        bucket,
+        Some(expected_incarnation_id),
+    ))
+    .await?;
+    if !crate::services::notification_sys::cross_pool_fence_fleet_proof_matches(proof) {
+        return Err(Error::NamespaceLockQuorumUnavailable {
+            mode: "quota_capability",
+            bucket: bucket.to_string(),
+            object: rustfs_config::QUOTA_CONFIG_FILE.to_string(),
+            required: 1,
+            achieved: 0,
+        });
+    }
+    update_under_config_write_guard(sys, &guard, rustfs_config::QUOTA_CONFIG_FILE, data).await
+}
+
 pub async fn update_bucket_targets_under_transaction_lock(
     guard: &BucketMetadataMutationGuard,
     bucket: &str,
@@ -734,7 +825,26 @@ async fn acquire_transaction_lock_with_sys(
     let lock = api
         .new_ns_lock(RUSTFS_META_BUCKET, &bucket_metadata_transaction_lock_key(bucket))
         .await?;
-    Ok(lock.get_write_lock(crate::set_disk::get_lock_acquire_timeout()).await?)
+    let acquire = lock.get_write_lock(crate::set_disk::get_lock_acquire_timeout());
+    #[cfg(any(test, feature = "test-util"))]
+    {
+        tokio::pin!(acquire);
+        let mut notified = false;
+        let guard = futures::future::poll_fn(|cx| match std::future::Future::poll(acquire.as_mut(), cx) {
+            std::task::Poll::Pending => {
+                if !notified {
+                    notify_config_write_lock_attempt(bucket);
+                    notified = true;
+                }
+                std::task::Poll::Pending
+            }
+            std::task::Poll::Ready(result) => std::task::Poll::Ready(result),
+        })
+        .await?;
+        Ok(guard)
+    }
+    #[cfg(not(any(test, feature = "test-util")))]
+    Ok(acquire.await?)
 }
 
 /// The lock resource name is deliberately still the `bucket-targets` one it
@@ -889,6 +999,37 @@ pub(crate) async fn get_object_lock_config_and_incarnation_from_disk_in(
     }
 }
 
+/// Re-read the quota configuration and bucket incarnation from the same
+/// authoritative metadata blob while the caller holds the bucket metadata
+/// transaction read lock.
+pub(crate) async fn get_quota_config_and_incarnation_from_disk_in(
+    ctx: &crate::runtime::instance::InstanceContext,
+    bucket: &str,
+) -> Result<(Option<BucketQuota>, Uuid, OffsetDateTime)> {
+    let bucket_meta_sys_lock = bucket_metadata_sys_of(ctx)?;
+    let bucket_meta_sys = bucket_meta_sys_lock.read().await.clone();
+
+    match bucket_meta_sys
+        .read_authoritative_metadata_from_disk_under_transaction_lock(bucket)
+        .await?
+    {
+        BucketMetadataAuthority::Authoritative(metadata)
+            if metadata.bucket_incarnation_sidecar && !metadata.bucket_incarnation_id.is_nil() =>
+        {
+            Ok((
+                metadata.quota_config.clone(),
+                metadata.bucket_incarnation_id,
+                metadata.quota_config_updated_at,
+            ))
+        }
+        BucketMetadataAuthority::Authoritative(_) => {
+            Err(Error::other(format!("bucket incarnation metadata is not authoritative: {bucket}")))
+        }
+        BucketMetadataAuthority::MissingBucket => Err(Error::BucketNotFound(bucket.to_string())),
+        BucketMetadataAuthority::Fabricated => Err(Error::other(format!("bucket quota metadata is not authoritative: {bucket}"))),
+    }
+}
+
 pub async fn get_replication_config(bucket: &str) -> Result<(ReplicationConfiguration, OffsetDateTime)> {
     let bucket_meta_sys_lock = get_bucket_metadata_sys()?;
     let bucket_meta_sys = bucket_meta_sys_lock.read().await;

crates/ecstore/src/bucket/quota/checker.rs

@@ -52,6 +52,7 @@ impl QuotaChecker {
     ) -> Result<QuotaCheckResult, QuotaError> {
         let start_time = Instant::now();
         let quota_config = self.get_quota_config(bucket).await?;
+        let uses_durable_reservations = quota_config.uses_durable_reservations();
 
         // If no quota limit is set, allow operation
         let quota_limit = match quota_config.quota {
@@ -67,6 +68,7 @@ impl QuotaChecker {
                     quota_limit: None,
                     operation_size,
                     remaining: None,
+                    uses_durable_reservations,
                 });
             }
             Some(q) => q,
@@ -74,14 +76,17 @@ impl QuotaChecker {
 
         let current_usage = self.get_real_time_usage(bucket).await?;
 
+        let admission_size = if uses_durable_reservations { 0 } else { operation_size };
         let expected_usage = match operation {
-            QuotaOperation::PutObject | QuotaOperation::PostObject | QuotaOperation::CopyObject => current_usage + operation_size,
+            QuotaOperation::PutObject | QuotaOperation::PostObject | QuotaOperation::CopyObject => {
+                current_usage.saturating_add(admission_size)
+            }
             QuotaOperation::DeleteObject => current_usage.saturating_sub(operation_size),
         };
 
         let allowed = match operation {
             QuotaOperation::PutObject | QuotaOperation::PostObject | QuotaOperation::CopyObject => {
-                quota_config.check_operation_allowed(current_usage, operation_size)
+                quota_config.check_operation_allowed(current_usage, admission_size)
             }
             QuotaOperation::DeleteObject => true,
         };
@@ -105,6 +110,7 @@ impl QuotaChecker {
             quota_limit: Some(quota_limit),
             operation_size,
             remaining,
+            uses_durable_reservations,
         };
 
         let duration = start_time.elapsed();
@@ -158,6 +164,26 @@ impl QuotaChecker {
             .await
     }
 
+    pub async fn set_durable_quota_config_if_incarnation(
+        &mut self,
+        bucket: &str,
+        quota: BucketQuota,
+        expected_incarnation_id: uuid::Uuid,
+        proof: &crate::services::notification_sys::CrossPoolFenceFleetProofToken,
+    ) -> Result<OffsetDateTime, QuotaError> {
+        let json_data = serde_json::to_vec(&quota).map_err(|e| QuotaError::InvalidConfig {
+            reason: format!("Failed to serialize quota config: {}", e),
+        })?;
+        let start_time = Instant::now();
+        let updated_at =
+            crate::bucket::metadata_sys::update_quota_if_incarnation(bucket, json_data, expected_incarnation_id, proof)
+                .await
+                .map_err(QuotaError::StorageError)?;
+
+        rustfs_common::metrics::Metrics::inc_time(Metric::QuotaSync, start_time.elapsed());
+        Ok(updated_at)
+    }
+
     async fn set_quota_config_for_incarnation(
         &mut self,
         bucket: &str,
@@ -355,6 +381,7 @@ mod tests {
             quota_limit: None,
             operation_size: 1024,
             remaining: None,
+            uses_durable_reservations: false,
         };
 
         assert!(result.allowed);
@@ -378,4 +405,13 @@ mod tests {
         let allowed = quota.check_operation_allowed(512, 1024);
         assert!(!allowed);
     }
+
+    #[test]
+    fn legacy_quota_rejects_full_operation_while_v1_defers_net_growth() {
+        let legacy: BucketQuota = serde_json::from_str(r#"{"quota":5}"#).expect("legacy quota should parse");
+        let durable = BucketQuota::new(Some(5));
+
+        assert!(!legacy.check_operation_allowed(4, 2));
+        assert!(durable.uses_durable_reservations());
+    }
 }

crates/ecstore/src/bucket/quota/mod.rs

@@ -13,40 +13,100 @@
 // limitations under the License.
 
 pub mod checker;
+pub(crate) mod reservation;
 
 use crate::error::Result;
 use rustfs_config::{
     QUOTA_API_PATH, QUOTA_EXCEEDED_ERROR_CODE, QUOTA_INTERNAL_ERROR_CODE, QUOTA_INVALID_CONFIG_ERROR_CODE,
     QUOTA_NOT_FOUND_ERROR_CODE,
 };
-use serde::{Deserialize, Serialize};
+use serde::{Deserialize, Deserializer, Serialize, Serializer, de::Error as _};
 use thiserror::Error;
 use time::OffsetDateTime;
 
 #[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize, Default)]
 pub enum QuotaType {
-    /// Hard quota: reject immediately when exceeded
+    /// Hard quota accounting.
     #[default]
     #[serde(alias = "HARD", alias = "hard")]
     Hard,
 }
 
+pub(crate) const QUOTA_RESERVATION_PROTOCOL_V1: u32 = 1;
+
 /// Bucket quota configuration. quota_type defaults to Hard when omitted.
-#[derive(Debug, Deserialize, Serialize, Default, Clone, PartialEq)]
+#[derive(Debug, Default, Clone, PartialEq)]
 pub struct BucketQuota {
-    #[serde(default)]
     pub quota: Option<u64>,
     /// Defaults to Hard when missing.
-    #[serde(default)]
     pub quota_type: QuotaType,
+    /// Optional durable reservation protocol. The wire format gives older
+    /// nodes a zero hard quota so a mixed-version fleet fails closed.
+    pub reservation_protocol: Option<u32>,
     /// Timestamp when this quota configuration was set (for audit purposes)
-    #[serde(default, with = "time::serde::rfc3339::option")]
     pub created_at: Option<OffsetDateTime>,
     /// Accept updated_at for compatibility; not used.
-    #[serde(default, with = "time::serde::rfc3339::option", skip_serializing_if = "Option::is_none")]
     pub updated_at: Option<OffsetDateTime>,
 }
 
+#[derive(Deserialize, Serialize)]
+struct BucketQuotaWire {
+    #[serde(default)]
+    quota: Option<u64>,
+    #[serde(default)]
+    quota_type: QuotaType,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    reservation_protocol: Option<u32>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    reservation_quota: Option<u64>,
+    #[serde(default, with = "time::serde::rfc3339::option")]
+    created_at: Option<OffsetDateTime>,
+    #[serde(default, with = "time::serde::rfc3339::option", skip_serializing_if = "Option::is_none")]
+    updated_at: Option<OffsetDateTime>,
+}
+
+impl Serialize for BucketQuota {
+    fn serialize<S>(&self, serializer: S) -> std::result::Result<S::Ok, S::Error>
+    where
+        S: Serializer,
+    {
+        let durable = self.uses_durable_reservations();
+        BucketQuotaWire {
+            quota: if durable { Some(0) } else { self.quota },
+            quota_type: self.quota_type.clone(),
+            reservation_protocol: self.reservation_protocol,
+            reservation_quota: if durable { self.quota } else { None },
+            created_at: self.created_at,
+            updated_at: self.updated_at,
+        }
+        .serialize(serializer)
+    }
+}
+
+impl<'de> Deserialize<'de> for BucketQuota {
+    fn deserialize<D>(deserializer: D) -> std::result::Result<Self, D::Error>
+    where
+        D: Deserializer<'de>,
+    {
+        let wire = BucketQuotaWire::deserialize(deserializer)?;
+        let quota = if wire.reservation_protocol == Some(QUOTA_RESERVATION_PROTOCOL_V1) {
+            Some(
+                wire.reservation_quota
+                    .ok_or_else(|| D::Error::custom("reservation_quota is required for reservation protocol v1"))?,
+            )
+        } else {
+            wire.quota
+        };
+        Ok(Self {
+            quota,
+            quota_type: wire.quota_type,
+            reservation_protocol: wire.reservation_protocol,
+            created_at: wire.created_at,
+            updated_at: wire.updated_at,
+        })
+    }
+}
+
 impl BucketQuota {
     /// Serialize to JSON bytes. Same format as parse_all_configs.
     pub fn marshal_msg(&self) -> Result<Vec<u8>> {
@@ -63,6 +123,7 @@ impl BucketQuota {
         Self {
             quota,
             quota_type: QuotaType::Hard,
+            reservation_protocol: quota.map(|_| QUOTA_RESERVATION_PROTOCOL_V1),
             created_at: Some(now),
             updated_at: None,
         }
@@ -72,7 +133,19 @@ impl BucketQuota {
         self.quota
     }
 
+    pub fn uses_durable_reservations(&self) -> bool {
+        self.reservation_protocol == Some(QUOTA_RESERVATION_PROTOCOL_V1)
+    }
+
+    pub fn has_unsupported_reservation_protocol(&self) -> bool {
+        self.reservation_protocol
+            .is_some_and(|version| version != QUOTA_RESERVATION_PROTOCOL_V1)
+    }
+
     pub fn check_operation_allowed(&self, current_usage: u64, operation_size: u64) -> bool {
+        if operation_size == 0 {
+            return true;
+        }
         if let Some(quota_limit) = self.quota {
             current_usage.saturating_add(operation_size) <= quota_limit
         } else {
@@ -94,6 +167,7 @@ pub struct QuotaCheckResult {
     pub quota_limit: Option<u64>,
     pub operation_size: u64,
     pub remaining: Option<u64>,
+    pub uses_durable_reservations: bool,
 }
 
 #[derive(Debug)]
@@ -210,7 +284,59 @@ mod tests {
         let buf = q.marshal_msg().expect("marshal");
         let restored = BucketQuota::unmarshal(&buf).expect("unmarshal");
         assert_eq!(q.quota, restored.quota);
-        assert_eq!(q.quota_type, restored.quota_type);
+        assert_eq!(restored.quota_type, QuotaType::Hard);
+        assert_eq!(restored.reservation_protocol, Some(QUOTA_RESERVATION_PROTOCOL_V1));
+    }
+
+    #[test]
+    fn clearing_quota_keeps_the_legacy_compatible_type() {
+        let quota = BucketQuota::new(None);
+
+        assert_eq!(quota.quota_type, QuotaType::Hard);
+        assert_eq!(quota.reservation_protocol, None);
+        assert!(!quota.uses_durable_reservations());
+    }
+
+    #[test]
+    fn durable_quota_makes_legacy_nodes_fail_closed() {
+        let json = serde_json::to_vec(&BucketQuota::new(Some(2048))).expect("durable quota should serialize");
+        let quota: BucketQuota = serde_json::from_slice(&json).expect("current quota version should parse");
+        assert!(quota.uses_durable_reservations());
+        assert_eq!(quota.quota, Some(2048));
+
+        #[derive(Deserialize)]
+        enum LegacyQuotaType {
+            Hard,
+        }
+        #[derive(Deserialize)]
+        struct LegacyBucketQuota {
+            #[allow(dead_code)]
+            quota: Option<u64>,
+            #[allow(dead_code)]
+            quota_type: LegacyQuotaType,
+        }
+        let legacy = serde_json::from_slice::<LegacyBucketQuota>(&json)
+            .expect("legacy readers should ignore the reservation protocol field");
+        assert_eq!(legacy.quota, Some(0));
+        assert!(matches!(legacy.quota_type, LegacyQuotaType::Hard));
+    }
+
+    #[test]
+    fn unknown_reservation_protocol_does_not_activate_v1() {
+        let quota: BucketQuota =
+            serde_json::from_str(r#"{"quota":0,"quota_type":"Hard","reservation_protocol":2,"reservation_quota":2048}"#)
+                .expect("future protocol should remain parseable");
+
+        assert!(!quota.uses_durable_reservations());
+        assert!(quota.has_unsupported_reservation_protocol());
+    }
+
+    #[test]
+    fn reservation_protocol_v1_requires_reservation_quota() {
+        let err = serde_json::from_str::<BucketQuota>(r#"{"quota":0,"quota_type":"Hard","reservation_protocol":1}"#)
+            .expect_err("v1 without its authoritative quota must fail closed");
+
+        assert!(err.to_string().contains("reservation_quota is required"));
     }
 
     /// unmarshal accepts format without quota_type

crates/ecstore/src/cluster/mod.rs

@@ -13,7 +13,6 @@
 // limitations under the License.
 
 // #730: cluster/RPC migration leaves transport capabilities staged for upcoming owners.
-#![allow(dead_code)]
 
 mod control_plane;
 pub(crate) mod rpc;

crates/ecstore/src/cluster/rpc/client.rs

@@ -256,6 +256,7 @@ impl<S> ReplayScopeChannel<S> {
     }
 }
 
+#[allow(dead_code, reason = "replay-state probe asserted by this file's tests (backlog#1823)")]
 fn peer_replay_state(audience: &str) -> PeerReplayState {
     PEER_REPLAY_STATES
         .lock()

crates/ecstore/src/cluster/rpc/internode_data_transport.rs

@@ -43,6 +43,10 @@ use tokio::io::{AsyncReadExt, AsyncWrite};
 use tokio::sync::OnceCell;
 use uuid::Uuid;
 
+#[allow(
+    dead_code,
+    reason = "live in the cfg(not(test)) half of build_internode_data_transport_from_env (backlog#1823)"
+)]
 static INTERNODE_DATA_TRANSPORT: OnceLock<std::result::Result<Arc<dyn InternodeDataTransport>, String>> = OnceLock::new();
 
 const READ_FILE_STREAM_PATH: &str = "/rustfs/rpc/read_file_stream";
@@ -134,6 +138,10 @@ fn put_file_capability_status_is_legacy(status: u16) -> bool {
 }
 
 #[derive(Debug, Clone, Copy, Eq, PartialEq)]
+#[allow(
+    dead_code,
+    reason = "capability-negotiation seam; constructed only by transport test doubles (backlog#1823)"
+)]
 pub struct InternodeDataTransportCapabilities {
     /// Backend can open a streaming remote disk reader.
     pub streaming_read: bool,
@@ -150,6 +158,10 @@ pub struct InternodeDataTransportCapabilities {
 }
 
 impl InternodeDataTransportCapabilities {
+    #[allow(
+        dead_code,
+        reason = "capability-negotiation seam; used by transport test doubles (backlog#1823)"
+    )]
     pub const fn tcp_http() -> Self {
         Self {
             streaming_read: true,
@@ -234,7 +246,12 @@ pub trait InternodeDataTransport: Send + Sync + std::fmt::Debug {
     async fn probe_ns_scanner(&self, _request: NsScannerCapabilityRequest) -> Result<Uuid> {
         Err(Error::MethodNotAllowed)
     }
+    // Interface facet nobody calls yet: every transport implements both, but no
+    // caller negotiates on them. Kept for the internode transport split
+    // (backlog#1350); deleting them would delete the seam and six impls.
+    #[allow(dead_code, reason = "unused capability-negotiation facet (backlog#1823)")]
     fn name(&self) -> &'static str;
+    #[allow(dead_code, reason = "unused capability-negotiation facet (backlog#1823)")]
     fn capabilities(&self) -> InternodeDataTransportCapabilities;
 }
 
@@ -670,6 +687,10 @@ fn build_internode_data_transport_result(
     }
 }
 
+#[allow(
+    dead_code,
+    reason = "live in the cfg(test) half of build_internode_data_transport_from_env, which bypasses the process static (backlog#1823)"
+)]
 pub fn build_internode_data_transport(configured_transport: Option<&str>) -> Result<Arc<dyn InternodeDataTransport>> {
     build_internode_data_transport_result(configured_transport).map_err(Error::other)
 }

crates/ecstore/src/cluster/rpc/peer_rest_client.rs

@@ -248,6 +248,16 @@ fn decode_remote_version_state_capability(expected_member: &str, result: &[u8])
     Ok(server_epoch)
 }
 
+fn decode_cross_pool_fence_capability(expected_member: &str, result: &[u8]) -> Result<(u32, Uuid)> {
+    let version = result
+        .get(..4)
+        .and_then(|value| value.try_into().ok())
+        .map(u32::from_be_bytes)
+        .ok_or_else(|| Error::other("peer returned an invalid cross-pool fence capability version"))?;
+    let epoch = decode_remote_version_state_capability(expected_member, &result[4..])?;
+    Ok((version, epoch))
+}
+
 #[derive(Clone, Debug)]
 pub struct PeerLiveEventsBatch {
     pub events: Vec<u8>,
@@ -1288,6 +1298,16 @@ impl PeerRestClient {
         Ok((self.topology_member.clone(), epoch))
     }
 
+    pub async fn probe_cross_pool_fence(&self, topology_fingerprint: String) -> Result<(String, u32, Uuid)> {
+        let mut probe = rustfs_protos::CROSS_POOL_FENCE_CAPABILITY_PROBE_PREFIX.to_vec();
+        probe.extend_from_slice(Uuid::new_v4().as_bytes());
+        let result = self
+            .heal_control(rustfs_protos::HEAL_CONTROL_PROTOCOL_VERSION, topology_fingerprint, probe)
+            .await?;
+        let (supported_version, epoch) = decode_cross_pool_fence_capability(&self.topology_member, &result)?;
+        Ok((self.topology_member.clone(), supported_version, epoch))
+    }
+
     pub async fn load_bucket_metadata(&self, bucket: &str, scanner_maintenance_change: bool) -> Result<()> {
         self.finalize_result(
             async {
@@ -2738,6 +2758,24 @@ mod tests {
         assert!(decode_remote_version_state_capability("node-a:9000", &nil).is_err());
     }
 
+    #[test]
+    fn cross_pool_fence_capability_decoder_fails_closed() {
+        let epoch = Uuid::new_v4();
+        let result = rustfs_protos::encode_cross_pool_fence_capability(1, "node-a:9000", epoch.as_bytes())
+            .expect("small capability response should encode");
+        assert_eq!(
+            decode_cross_pool_fence_capability("node-a:9000", &result).expect("valid capability should decode"),
+            (1, epoch)
+        );
+        for malformed in [&[][..], &[0, 0, 0][..], &result[..result.len() - 1]] {
+            assert!(decode_cross_pool_fence_capability("node-a:9000", malformed).is_err());
+        }
+        assert!(decode_cross_pool_fence_capability("node-b:9000", &result).is_err());
+        let nil = rustfs_protos::encode_cross_pool_fence_capability(1, "node-a:9000", Uuid::nil().as_bytes())
+            .expect("small capability response should encode");
+        assert!(decode_cross_pool_fence_capability("node-a:9000", &nil).is_err());
+    }
+
     struct TierMutationResponseFixture<'a> {
         version: u32,
         phase: TierMutationRpcPhase,

crates/ecstore/src/cluster/rpc/peer_s3_client.rs

@@ -854,7 +854,6 @@ impl PeerS3Client for LocalPeerS3Client {
 
 #[derive(Debug)]
 pub struct RemotePeerS3Client {
-    pub node: Option<Node>,
     pub pools: Option<Vec<usize>>,
     addr: String,
     /// Health tracker for connection monitoring
@@ -886,7 +885,6 @@ impl RemotePeerS3Client {
     pub fn new(node: Option<Node>, pools: Option<Vec<usize>>) -> Self {
         let addr = node.as_ref().map(|v| v.url.to_string()).unwrap_or_default();
         let client = Self {
-            node,
             pools,
             addr,
             health: Arc::new(DiskHealthTracker::new()),
@@ -905,10 +903,6 @@ impl RemotePeerS3Client {
             .map_err(|err| Error::other(format!("can not get client, err: {err}")))
     }
 
-    pub fn get_addr(&self) -> String {
-        self.addr.clone()
-    }
-
     /// Start health monitoring for the remote peer
     fn start_health_monitoring(&self) {
         let health = Arc::clone(&self.health);
@@ -1208,6 +1202,10 @@ impl PeerS3Client for RemotePeerS3Client {
     }
 }
 
+#[allow(
+    dead_code,
+    reason = "local bucket-heal path reached only by this file's tests (backlog#1823)"
+)]
 pub async fn heal_bucket_local(bucket: &str, opts: &HealOpts) -> Result<HealResultItem> {
     let disks = clone_drives().await;
     heal_bucket_local_on_disks(bucket, opts, disks).await
@@ -1404,6 +1402,10 @@ pub(crate) async fn heal_bucket_local_on_disks(
     }
 }
 
+#[allow(
+    dead_code,
+    reason = "reached only through heal_bucket_local, which only tests call (backlog#1823)"
+)]
 async fn clone_drives() -> Vec<Option<DiskStore>> {
     runtime_sources::local_disk_entries().await
 }
@@ -1585,15 +1587,7 @@ mod tests {
     }
 
     fn test_remote_peer(addr: &str) -> RemotePeerS3Client {
-        let node = Node {
-            url: url::Url::parse(addr).expect("test peer URL should parse"),
-            pools: vec![0],
-            is_local: false,
-            grid_host: addr.to_string(),
-        };
-
         RemotePeerS3Client {
-            node: Some(node),
             pools: Some(vec![0]),
             addr: addr.to_string(),
             health: Arc::new(DiskHealthTracker::new()),

crates/ecstore/src/cluster/rpc/remote_disk.rs

@@ -1359,6 +1359,71 @@ fn validate_decoded_file_info(file_info: &FileInfo) -> Result<()> {
     file_info.validate_for_metadata_read().map_err(Into::into)
 }
 
+impl RemoteDisk {
+    #[tracing::instrument(level = "trace", skip_all)]
+    pub(crate) async fn rename_data_borrowed(
+        &self,
+        src_volume: &str,
+        src_path: &str,
+        fi: &FileInfo,
+        dst_volume: &str,
+        dst_path: &str,
+    ) -> Result<RenameDataResp> {
+        trace!(
+            event = EVENT_REMOTE_DISK_RPC,
+            component = LOG_COMPONENT_ECSTORE,
+            subsystem = LOG_SUBSYSTEM_REMOTE_DISK,
+            endpoint = %self.endpoint,
+            src_volume,
+            src_path,
+            dst_volume,
+            dst_path,
+            op = "rename_data",
+            state = "started",
+            "Remote disk RPC started"
+        );
+
+        self.execute_with_timeout_for_op(
+            "rename_data",
+            || async {
+                let file_info = compat_json(fi)?;
+                let file_info_bin = encode_file_info_msgpack(fi)?;
+                let mut client = self
+                    .get_client()
+                    .await
+                    .map_err(|err| Error::other(format!("can not get client, err: {err}")))?;
+                let mut request = Request::new(RenameDataRequest {
+                    disk: self.endpoint.to_string(),
+                    src_volume: src_volume.to_string(),
+                    src_path: src_path.to_string(),
+                    file_info,
+                    dst_volume: dst_volume.to_string(),
+                    dst_path: dst_path.to_string(),
+                    file_info_bin: file_info_bin.into(),
+                });
+                let canonical_body = rustfs_protos::canonical_rename_data_request_body(request.get_ref());
+                attach_mutation_body_digest(&mut request, canonical_body, "rename_data")?;
+
+                let response = client.rename_data(request).await?.into_inner();
+
+                if !response.success {
+                    return Err(response.error.unwrap_or_default().into());
+                }
+
+                let rename_data_resp = decode_msgpack_or_json::<RenameDataResp>(
+                    &response.rename_data_resp_bin,
+                    &response.rename_data_resp,
+                    "RenameDataResp",
+                )?;
+
+                Ok(rename_data_resp)
+            },
+            get_max_timeout_duration(),
+        )
+        .await
+    }
+}
+
 #[async_trait::async_trait]
 impl DiskAPI for RemoteDisk {
     #[tracing::instrument(level = "trace", skip_all)]
@@ -2284,58 +2349,8 @@ impl DiskAPI for RemoteDisk {
         dst_volume: &str,
         dst_path: &str,
     ) -> Result<RenameDataResp> {
-        trace!(
-            event = EVENT_REMOTE_DISK_RPC,
-            component = LOG_COMPONENT_ECSTORE,
-            subsystem = LOG_SUBSYSTEM_REMOTE_DISK,
-            endpoint = %self.endpoint,
-            src_volume,
-            src_path,
-            dst_volume,
-            dst_path,
-            op = "rename_data",
-            state = "started",
-            "Remote disk RPC started"
-        );
-
-        self.execute_with_timeout_for_op(
-            "rename_data",
-            || async {
-                let file_info = compat_json(&fi)?;
-                let file_info_bin = encode_file_info_msgpack(&fi)?;
-                let mut client = self
-                    .get_client()
-                    .await
-                    .map_err(|err| Error::other(format!("can not get client, err: {err}")))?;
-                let mut request = Request::new(RenameDataRequest {
-                    disk: self.endpoint.to_string(),
-                    src_volume: src_volume.to_string(),
-                    src_path: src_path.to_string(),
-                    file_info,
-                    dst_volume: dst_volume.to_string(),
-                    dst_path: dst_path.to_string(),
-                    file_info_bin: file_info_bin.into(),
-                });
-                let canonical_body = rustfs_protos::canonical_rename_data_request_body(request.get_ref());
-                attach_mutation_body_digest(&mut request, canonical_body, "rename_data")?;
-
-                let response = client.rename_data(request).await?.into_inner();
-
-                if !response.success {
-                    return Err(response.error.unwrap_or_default().into());
-                }
-
-                let rename_data_resp = decode_msgpack_or_json::<RenameDataResp>(
-                    &response.rename_data_resp_bin,
-                    &response.rename_data_resp,
-                    "RenameDataResp",
-                )?;
-
-                Ok(rename_data_resp)
-            },
-            get_max_timeout_duration(),
-        )
-        .await
+        self.rename_data_borrowed(src_volume, src_path, &fi, dst_volume, dst_path)
+            .await
     }
 
     #[tracing::instrument(level = "trace", skip_all)]

crates/ecstore/src/cluster/rpc/remote_locker.rs

@@ -48,10 +48,6 @@ impl RemoteClient {
         Self { addr: endpoint }
     }
 
-    pub fn from_url(url: url::Url) -> Self {
-        Self { addr: url.to_string() }
-    }
-
     fn build_ping_request() -> PingRequest {
         let mut fbb = flatbuffers::FlatBufferBuilder::new();
         let payload = fbb.create_vector(b"health-check");

crates/ecstore/src/config/com.rs

@@ -46,7 +46,6 @@ use rustfs_config::{
     SCANNER_SUB_SYS,
 };
 use rustfs_filemeta::FileInfo;
-use rustfs_utils::path::SLASH_SEPARATOR;
 use serde_json::{Map, Value};
 use std::collections::{HashMap, HashSet};
 use std::sync::LazyLock;
@@ -200,8 +199,6 @@ pub const STORAGE_CLASS_SUB_SYS: &str = "storage_class";
 
 pub const COMMA_SEPARATED_LISTS: &[&str] = &[rustfs_config::oidc::OIDC_SCOPES, rustfs_config::oidc::OIDC_OTHER_AUDIENCES];
 
-static CONFIG_BUCKET: LazyLock<String> = LazyLock::new(|| format!("{RUSTFS_META_BUCKET}{SLASH_SEPARATOR}{CONFIG_PREFIX}"));
-
 type ServerConfigDecryptFn = crate::bucket::migration::LegacyBlobDecryptFn;
 
 static SERVER_CONFIG_DECRYPT_FN: LazyLock<RwLock<Option<ServerConfigDecryptFn>>> = LazyLock::new(|| RwLock::new(None));

crates/ecstore/src/config/mod.rs

@@ -13,7 +13,6 @@
 // limitations under the License.
 
 // #730: configuration migration keeps legacy subsystem definitions available behind this module.
-#![allow(dead_code)]
 
 mod audit;
 pub mod com;

crates/ecstore/src/config/storageclass.rs

@@ -101,6 +101,7 @@ const DEFAULT_RRS_STORAGE_CLASS: &str = "EC:1";
 const ZERO_SET_DRIVE_COUNT_ERROR: &str = "set drive count must be greater than zero";
 
 pub static DEFAULT_INLINE_BLOCK: usize = 128 * 1024;
+const DEFAULT_INLINE_OBJECT_BUDGET: usize = 2 * DEFAULT_INLINE_BLOCK;
 
 pub static DEFAULT_KVS: LazyLock<KVS> = LazyLock::new(|| {
     let kvs = vec![
@@ -150,6 +151,8 @@ pub struct Config {
     optimize: Option<String>,
     inline_block: usize,
     initialized: bool,
+    #[serde(default, skip_serializing_if = "std::ops::Not::not")]
+    inline_block_explicit: bool,
     #[serde(skip)]
     standard_parities: Vec<PoolParity>,
     #[serde(skip)]
@@ -186,6 +189,10 @@ impl Config {
     /// A topology-bound lookup fails closed for unknown drive counts and for
     /// deserialized legacy configurations that have no pool topology. Legacy
     /// callers retain scalar compatibility through [`Self::get_parity_for_sc`].
+    #[allow(
+        dead_code,
+        reason = "per-set parity resolution asserted by this file's tests (backlog#1823)"
+    )]
     pub(crate) fn parity_for_sc(&self, sc: &str, drives_per_set: usize) -> Option<usize> {
         if !self.initialized {
             return None;
@@ -233,17 +240,19 @@ impl Config {
             .map(|(pool_index, pool)| (pool_index, pool.drives_per_set))
     }
 
-    pub fn should_inline(&self, shard_size: i64, versioned: bool) -> bool {
-        if shard_size < 0 {
+    pub fn should_inline(&self, shard_size: i64, data_shards: usize, versioned: bool) -> bool {
+        if shard_size < 0 || data_shards == 0 {
             return false;
         }
 
         let shard_size = shard_size as usize;
-
-        let mut inline_block = DEFAULT_INLINE_BLOCK;
-        if self.initialized {
-            inline_block = self.inline_block;
-        }
+        // Keep the historical two-data-shard object budget while preventing
+        // wider EC layouts from multiplying the maximum inline object size.
+        let inline_block = if self.initialized && self.inline_block_explicit {
+            self.inline_block
+        } else {
+            (DEFAULT_INLINE_OBJECT_BUDGET / data_shards).min(DEFAULT_INLINE_BLOCK)
+        };
 
         if versioned {
             shard_size <= inline_block / 8
@@ -392,6 +401,7 @@ fn lookup_config_for_pools_with_env(
     }
 
     let optimize = overrides.optimize;
+    let inline_block_explicit = overrides.inline_block.is_some();
     let inline_block = if let Some(value) = overrides.inline_block {
         let block = value
             .parse::<bytesize::ByteSize>()
@@ -424,6 +434,7 @@ fn lookup_config_for_pools_with_env(
         optimize,
         inline_block,
         initialized: true,
+        inline_block_explicit,
         standard_parities,
         rrs_parities,
     })
@@ -541,22 +552,26 @@ mod tests {
     }
 
     #[test]
-    fn should_inline_preserves_exact_default_shard_boundaries() {
-        let config = Config::default();
+    fn should_inline_scales_default_threshold_by_data_shards() {
+        let config = lookup_config_for_pools_with_env(&KVS::new(), &[3, 12], no_env_overrides())
+            .expect("default inline policy should resolve for EC2+1 and EC8+4");
 
-        for (case, shard_size, versioned, expected) in [
-            ("unversioned below", 128 * 1024 - 1, false, true),
-            ("unversioned exact", 128 * 1024, false, true),
-            ("unversioned above", 128 * 1024 + 1, false, false),
-            ("versioned below", 16 * 1024 - 1, true, true),
-            ("versioned exact", 16 * 1024, true, true),
-            ("versioned above", 16 * 1024 + 1, true, false),
-            ("negative", -1, false, false),
+        for (case, shard_size, data_shards, versioned, expected) in [
+            ("EC2+1 unversioned exact", 128 * 1024, 2, false, true),
+            ("EC2+1 unversioned above", 128 * 1024 + 1, 2, false, false),
+            ("EC2+1 versioned exact", 16 * 1024, 2, true, true),
+            ("EC2+1 versioned above", 16 * 1024 + 1, 2, true, false),
+            ("EC8+4 unversioned exact", 32 * 1024, 8, false, true),
+            ("EC8+4 unversioned above", 32 * 1024 + 1, 8, false, false),
+            ("EC8+4 versioned exact", 4 * 1024, 8, true, true),
+            ("EC8+4 versioned above", 4 * 1024 + 1, 8, true, false),
+            ("negative", -1, 2, false, false),
+            ("zero data shards", 0, 0, false, false),
         ] {
             assert_eq!(
-                config.should_inline(shard_size, versioned),
+                config.should_inline(shard_size, data_shards, versioned),
                 expected,
-                "{case}: shard_size={shard_size}, versioned={versioned}"
+                "{case}: shard_size={shard_size}, data_shards={data_shards}, versioned={versioned}"
             );
         }
     }
@@ -577,13 +592,28 @@ mod tests {
             let shard_size = erasure.shard_file_size(object_size);
             assert_eq!(shard_size, expected_shard_size, "{case}: object_size={object_size}");
             assert_eq!(
-                config.should_inline(shard_size, versioned),
+                config.should_inline(shard_size, erasure.data_shards, versioned),
                 expected,
                 "{case}: object_size={object_size}, shard_size={shard_size}, versioned={versioned}"
             );
         }
     }
 
+    #[test]
+    fn explicit_inline_block_preserves_fixed_per_shard_rollback() {
+        let overrides = StorageClassEnvOverrides {
+            inline_block: Some("128KiB".to_string()),
+            ..Default::default()
+        };
+        let config = lookup_config_for_pools_with_env(&KVS::new(), &[12], overrides)
+            .expect("explicit inline block should resolve for EC8+4");
+
+        assert!(config.should_inline(128 * 1024, 8, false));
+        assert!(!config.should_inline(128 * 1024 + 1, 8, false));
+        assert!(config.should_inline(16 * 1024, 8, true));
+        assert!(!config.should_inline(16 * 1024 + 1, 8, true));
+    }
+
     #[test]
     fn write_capability_contract_only_accepts_implemented_layouts() {
         assert_eq!(SUPPORTED_WRITE_CLASSES, [STANDARD, RRS]);
@@ -777,6 +807,7 @@ mod tests {
         let encoded = serde_json::to_string(&cfg).expect("config should serialize");
         assert!(!encoded.contains("standard_parities"));
         assert!(!encoded.contains("rrs_parities"));
+        assert!(!encoded.contains("inline_block_explicit"));
 
         let decoded: Config = serde_json::from_str(&encoded).expect("legacy scalar config should deserialize");
         assert_eq!(decoded.get_parity_for_sc(STANDARD), Some(2));
@@ -786,6 +817,25 @@ mod tests {
         assert!(validate_parity(0, 0).is_err());
     }
 
+    #[test]
+    fn explicit_inline_block_survives_config_round_trip() {
+        let cfg = lookup_config_for_pools_with_env(
+            &KVS::new(),
+            &[12],
+            StorageClassEnvOverrides {
+                inline_block: Some("128KiB".to_string()),
+                ..Default::default()
+            },
+        )
+        .expect("explicit inline block should resolve");
+        assert!(cfg.should_inline(100 * 1024, 8, false));
+
+        let encoded = serde_json::to_string(&cfg).expect("config should serialize");
+        assert!(encoded.contains("\"inline_block_explicit\":true"));
+        let decoded: Config = serde_json::from_str(&encoded).expect("explicit inline config should deserialize");
+        assert!(decoded.should_inline(100 * 1024, 8, false));
+    }
+
     #[test]
     fn lookup_config_reads_rrs_from_class_rrs_key() {
         // Regression: kvs.get(RRS) used RRS="REDUCED_REDUNDANCY" instead of

crates/ecstore/src/core/mod.rs

@@ -13,7 +13,6 @@
 // limitations under the License.
 
 // #730: pool coordination helpers are being migrated behind runtime owners.
-#![allow(dead_code)]
 
 pub(crate) mod pools;
 pub(crate) mod sets;

crates/ecstore/src/core/pools.rs

@@ -226,6 +226,7 @@ fn ensure_decommission_start_rebalance_meta_allowed(meta: Option<&RebalanceMeta>
     ensure_decommission_not_rebalancing(meta.is_some_and(is_rebalance_conflicting_with_decommission))
 }
 
+#[allow(dead_code, reason = "leader precondition asserted by this file's tests (backlog#1823)")]
 fn ensure_local_decommission_pool_leaders(endpoints: &EndpointServerPools, indices: &[usize]) -> Result<()> {
     for idx in indices {
         ensure_local_decommission_pool_leader(endpoints, *idx)?;
@@ -1058,11 +1059,19 @@ fn should_cleanup_decommission_source_entry(decommissioned: usize, total_version
 }
 
 #[derive(Debug, Clone, Copy, PartialEq, Eq)]
+#[allow(
+    dead_code,
+    reason = "terminal-state classification asserted by this file's tests (backlog#1823)"
+)]
 enum DecommissionTerminalState {
     Completed,
     Failed,
 }
 
+#[allow(
+    dead_code,
+    reason = "terminal-state classification asserted by this file's tests (backlog#1823)"
+)]
 fn classify_decommission_terminal_state(failed_items_present: bool) -> DecommissionTerminalState {
     if failed_items_present {
         DecommissionTerminalState::Failed

crates/ecstore/src/data_movement/mod.rs

@@ -13,7 +13,6 @@
 // limitations under the License.
 
 // #730: data-movement migration keeps staged cleanup helpers until copy paths converge.
-#![allow(dead_code)]
 
 pub(crate) mod backpressure;
 
@@ -1019,6 +1018,10 @@ struct SourceCleanupDeleteBarrierState {
 }
 
 #[cfg(test)]
+#[allow(
+    dead_code,
+    reason = "installed by set_disk object tests behind `--features test-util` (backlog#1823)"
+)]
 pub(crate) struct SourceCleanupDeleteBarrier {
     state: Arc<SourceCleanupDeleteBarrierState>,
 }
@@ -1028,6 +1031,10 @@ static SOURCE_CLEANUP_DELETE_BARRIER: std::sync::OnceLock<std::sync::Mutex<Optio
     std::sync::OnceLock::new();
 
 #[cfg(test)]
+#[allow(
+    dead_code,
+    reason = "installed by set_disk object tests behind `--features test-util` (backlog#1823)"
+)]
 impl SourceCleanupDeleteBarrier {
     pub(crate) fn install(bucket: &str, object: &str) -> Self {
         let state = Arc::new(SourceCleanupDeleteBarrierState {
@@ -1166,6 +1173,7 @@ async fn find_data_movement_target_info(
     }
 }
 
+#[allow(dead_code, reason = "resume adjudication asserted by this file's tests (backlog#1823)")]
 fn resolve_data_movement_overwrite_resume_result(
     err: &Error,
     target_result: Result<Option<ObjectInfo>>,

crates/ecstore/src/data_usage/local_snapshot.rs

@@ -12,6 +12,16 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
+//! Per-disk usage snapshots persisted under the metadata bucket.
+//!
+//! **Nothing calls into this module.** It landed complete with tests in #5307
+//! (2026-07-27) and its aggregation entry point,
+//! [`crate::data_usage::aggregate_local_snapshots`], has never had a caller in
+//! the tree's history. The live data-usage path is
+//! `load_data_usage_from_backend` / `store_data_usage_in_backend`. The items
+//! below therefore carry individual `dead_code` allows rather than a module
+//! blanket, so the gap stays greppable until it is either wired up or removed.
+
 use crate::data_usage::BucketUsageInfo;
 use crate::disk::RUSTFS_META_BUCKET;
 use crate::error::{Error, Result};
@@ -26,10 +36,12 @@ pub const DATA_USAGE_DIR: &str = "datausage";
 /// Directory used to store incremental scan state files under the metadata bucket.
 pub const DATA_USAGE_STATE_DIR: &str = "datausage/state";
 /// Snapshot file format version, allows forward compatibility if the structure evolves.
+#[allow(dead_code, reason = "unwired local usage-snapshot feature; see module docs (backlog#1823)")]
 pub const LOCAL_USAGE_SNAPSHOT_VERSION: u32 = 1;
 
 /// Additional metadata describing which disk produced the snapshot.
 #[derive(Debug, Clone, Serialize, Deserialize, Default)]
+#[allow(dead_code, reason = "unwired local usage-snapshot feature; see module docs (backlog#1823)")]
 pub struct LocalUsageSnapshotMeta {
     /// Disk UUID stored as a string for simpler serialization.
     pub disk_id: String,
@@ -43,6 +55,7 @@ pub struct LocalUsageSnapshotMeta {
 
 /// Usage snapshot produced by a single disk.
 #[derive(Debug, Clone, Serialize, Deserialize, Default)]
+#[allow(dead_code, reason = "unwired local usage-snapshot feature; see module docs (backlog#1823)")]
 pub struct LocalUsageSnapshot {
     /// Format version recorded in the snapshot.
     pub format_version: u32,
@@ -64,6 +77,7 @@ pub struct LocalUsageSnapshot {
     pub objects_total_size: u64,
 }
 
+#[allow(dead_code, reason = "unwired local usage-snapshot feature; see module docs (backlog#1823)")]
 impl LocalUsageSnapshot {
     /// Create an empty snapshot with the default format version filled in.
     pub fn new(meta: LocalUsageSnapshotMeta) -> Self {
@@ -99,11 +113,13 @@ impl LocalUsageSnapshot {
 }
 
 /// Build the snapshot file name `<disk-id>.json`.
+#[allow(dead_code, reason = "unwired local usage-snapshot feature; see module docs (backlog#1823)")]
 pub fn snapshot_file_name(disk_id: &str) -> String {
     format!("{disk_id}.json")
 }
 
 /// Build the object path relative to `RUSTFS_META_BUCKET`, e.g. `datausage/<disk-id>.json`.
+#[allow(dead_code, reason = "unwired local usage-snapshot feature; see module docs (backlog#1823)")]
 pub fn snapshot_object_path(disk_id: &str) -> String {
     format!("{}/{}", DATA_USAGE_DIR, snapshot_file_name(disk_id))
 }
@@ -119,11 +135,13 @@ pub fn data_usage_state_dir(root: &Path) -> PathBuf {
 }
 
 /// Build the absolute path to the snapshot file for the provided disk ID.
+#[allow(dead_code, reason = "unwired local usage-snapshot feature; see module docs (backlog#1823)")]
 pub fn snapshot_path(root: &Path, disk_id: &str) -> PathBuf {
     data_usage_dir(root).join(snapshot_file_name(disk_id))
 }
 
 /// Read a snapshot from disk if it exists.
+#[allow(dead_code, reason = "unwired local usage-snapshot feature; see module docs (backlog#1823)")]
 pub async fn read_snapshot(root: &Path, disk_id: &str) -> Result<Option<LocalUsageSnapshot>> {
     let path = snapshot_path(root, disk_id);
     match fs::read(&path).await {
@@ -138,6 +156,7 @@ pub async fn read_snapshot(root: &Path, disk_id: &str) -> Result<Option<LocalUsa
 }
 
 /// Persist a snapshot to disk, creating directories as needed and overwriting any existing file.
+#[allow(dead_code, reason = "unwired local usage-snapshot feature; see module docs (backlog#1823)")]
 pub async fn write_snapshot(root: &Path, disk_id: &str, snapshot: &LocalUsageSnapshot) -> Result<()> {
     let dir = data_usage_dir(root);
     fs::create_dir_all(&dir).await.map_err(Error::other)?;

crates/ecstore/src/data_usage/mod.rs

@@ -13,7 +13,6 @@
 // limitations under the License.
 
 // #730: scanner/data-usage state is partially migrated and still owns staged cache helpers.
-#![allow(dead_code)]
 
 pub mod local_snapshot;
 
@@ -34,8 +33,8 @@ use crate::{
 pub use local_snapshot::{LocalUsageSnapshot, read_snapshot as read_local_snapshot, snapshot_path};
 use rustfs_data_usage::{
     BucketTargetUsageInfo, BucketUsageInfo, CompressionTotalInfo, DATA_USAGE_OBJECT_NAME, DATA_USAGE_OBSERVED_OBJECT_NAME,
-    DataUsageCache, DataUsageEntry, DataUsageInfo, DiskUsageStatus, LEGACY_DATA_USAGE_OBJECT_NAME, SizeHistogram, SizeSummary,
-    VersionsHistogram, observed_data_usage_is_newer,
+    DataUsageCache, DataUsageInfo, DiskUsageStatus, LEGACY_DATA_USAGE_OBJECT_NAME, SizeHistogram, VersionsHistogram,
+    observed_data_usage_is_newer,
 };
 use rustfs_io_metrics::record_system_path_failure;
 use rustfs_utils::path::SLASH_SEPARATOR;
@@ -55,7 +54,6 @@ use tracing::{debug, error, info, instrument};
 // Data usage storage constants
 pub const DATA_USAGE_ROOT: &str = SLASH_SEPARATOR;
 const DATA_COMPRESSION_TOTAL_NAME: &str = ".compression.json";
-const DATA_USAGE_BLOOM_NAME: &str = ".bloomcycle.bin";
 pub const DATA_USAGE_CACHE_NAME: &str = ".usage-cache.bin";
 const DATA_USAGE_CACHE_TTL_SECS: u64 = 30;
 const LIVE_BUCKET_USAGE_MAX_ENTRIES: u64 = 1024;
@@ -313,11 +311,6 @@ lazy_static::lazy_static! {
         LEGACY_DATA_USAGE_OBJECT_NAME
     );
     static ref LEGACY_DATA_USAGE_OBJ_BACKUP_PATH: String = format!("{}.bkp", LEGACY_DATA_USAGE_OBJ_NAME_PATH.as_str());
-    pub static ref DATA_USAGE_BLOOM_NAME_PATH: String = format!("{}{}{}",
-        crate::disk::BUCKET_META_PREFIX,
-        SLASH_SEPARATOR,
-        DATA_USAGE_BLOOM_NAME
-    );
     pub static ref DATA_COMPRESSION_TOTAL_NAME_PATH: String = format!("{}{}{}",
         crate::disk::BUCKET_META_PREFIX,
         SLASH_SEPARATOR,
@@ -858,6 +851,10 @@ async fn resolve_loaded_snapshot_pair_with_source(
     }
 }
 
+#[allow(
+    dead_code,
+    reason = "primary/backup snapshot fallback asserted by this file's tests (backlog#1823)"
+)]
 async fn resolve_loaded_snapshot(
     primary: Result<Vec<u8>, Error>,
     backup: impl Future<Output = Result<Vec<u8>, Error>>,
@@ -1187,6 +1184,10 @@ pub async fn invalidate_admin_data_usage_snapshot_cache() {
 }
 
 /// Aggregate usage information from local disk snapshots.
+#[allow(
+    dead_code,
+    reason = "reached only through aggregate_local_snapshots, which has no caller (backlog#1823)"
+)]
 fn merge_snapshot(aggregated: &mut DataUsageInfo, mut snapshot: LocalUsageSnapshot, latest_update: &mut Option<SystemTime>) {
     if let Some(update) = snapshot.last_update
         && latest_update.is_none_or(|current| update > current)
@@ -1220,6 +1221,10 @@ fn merge_snapshot(aggregated: &mut DataUsageInfo, mut snapshot: LocalUsageSnapsh
     }
 }
 
+#[allow(
+    dead_code,
+    reason = "entry point of the local usage-snapshot feature, which has had no caller since it landed in #5307 (backlog#1823)"
+)]
 pub async fn aggregate_local_snapshots(store: Arc<ECStore>) -> Result<(Vec<DiskUsageStatus>, DataUsageInfo), Error> {
     let mut aggregated = DataUsageInfo::default();
     let mut latest_update: Option<SystemTime> = None;
@@ -1355,7 +1360,7 @@ impl BucketUsageAccumulator {
             return Ok(());
         }
 
-        let object_size = object.size.max(0) as u64;
+        let object_size = quota_object_size(object)?;
         self.current_live_versions = self.current_live_versions.saturating_add(1);
         self.size_histogram.add(object_size);
         self.total_size = self.total_size.saturating_add(object_size);
@@ -1385,6 +1390,31 @@ impl BucketUsageAccumulator {
     }
 }
 
+pub fn quota_object_size(object: &ObjectInfo) -> Result<u64, Error> {
+    let logical_size = u64::try_from(object.get_actual_size().map_err(Error::other)?).map_err(|_| Error::PartMissingOrCorrupt)?;
+    let persisted_part_size = if object.parts.is_empty() {
+        u64::try_from(object.size).map_err(|_| Error::PartMissingOrCorrupt)?
+    } else {
+        object.parts.iter().try_fold(0_u64, |total, part| {
+            // Compressed streaming objects persist -1 when the transformed
+            // part size is unknown. The physical part size remains a valid
+            // quota floor; reject only non-negative values that overflow.
+            let actual_size = if part.actual_size < 0 {
+                if object.is_compressed() {
+                    0
+                } else {
+                    return Err(Error::PartMissingOrCorrupt);
+                }
+            } else {
+                u64::try_from(part.actual_size).map_err(|_| Error::PartMissingOrCorrupt)?
+            };
+            let part_size = actual_size.max(u64::try_from(part.size).map_err(|_| Error::PartMissingOrCorrupt)?);
+            total.checked_add(part_size).ok_or(Error::PartMissingOrCorrupt)
+        })?
+    };
+    Ok(logical_size.max(persisted_part_size))
+}
+
 type UsageVersionPage = StorageListObjectVersionsInfo<ObjectInfo>;
 
 pub async fn compute_bucket_usage(store: Arc<ECStore>, bucket_name: &str) -> Result<BucketUsageInfo, Error> {
@@ -1742,11 +1772,6 @@ pub async fn record_bucket_object_write_unknown_previous_memory(bucket: &str, ne
     entry.pending_scanner_position = None;
 }
 
-/// Fast in-memory increment for immediate quota consistency.
-pub async fn increment_bucket_usage_memory(bucket: &str, size_increment: u64) {
-    record_bucket_object_write_memory(bucket, None, size_increment).await;
-}
-
 /// Fast in-memory update for successful object deletes.
 pub async fn record_bucket_object_delete_memory(bucket: &str, deleted_size: u64, removed_current_object: bool) {
     ensure_bucket_usage_cached(bucket).await;
@@ -1789,11 +1814,6 @@ pub async fn record_bucket_delete_marker_memory(bucket: &str) {
     entry.pending_scanner_position = None;
 }
 
-/// Fast in-memory decrement for immediate quota consistency
-pub async fn decrement_bucket_usage_memory(bucket: &str, size_decrement: u64) {
-    record_bucket_object_delete_memory(bucket, size_decrement, size_decrement > 0).await;
-}
-
 /// Get bucket usage from the authoritative cache for this topology.
 async fn get_persisted_bucket_usage(bucket: &str) -> Option<u64> {
     let store = runtime_sources::object_store_handle()?;
@@ -1988,91 +2008,6 @@ pub async fn apply_bucket_usage_memory_overlay(data_usage_info: &mut DataUsageIn
     apply_bucket_usage_memory_overlay_if_authoritative(data_usage_info, authoritative).await;
 }
 
-/// Sync memory cache with backend data (called by scanner)
-pub async fn sync_memory_cache_with_backend() -> Result<(), Error> {
-    if let Some(store) = runtime_sources::object_store_handle() {
-        match load_data_usage_from_backend(store.clone()).await {
-            Ok(data_usage_info) => {
-                replace_bucket_usage_memory_from_info(&data_usage_info).await;
-            }
-            Err(e) => {
-                debug!("Failed to sync memory cache with backend: {}", e);
-            }
-        }
-    }
-    Ok(())
-}
-
-/// Create a data usage cache entry from size summary
-pub fn create_cache_entry_from_summary(summary: &SizeSummary) -> DataUsageEntry {
-    let mut entry = DataUsageEntry::default();
-    entry.add_sizes(summary);
-    entry
-}
-
-/// Convert data usage cache to DataUsageInfo
-pub fn cache_to_data_usage_info(
-    cache: &DataUsageCache,
-    path: &str,
-    buckets: &[crate::storage_api_contracts::bucket::BucketInfo],
-) -> DataUsageInfo {
-    let e = match cache.find(path) {
-        Some(e) => e,
-        None => return DataUsageInfo::default(),
-    };
-    let flat = cache.flatten(&e);
-
-    let mut buckets_usage = HashMap::new();
-    for bucket in buckets.iter() {
-        let e = match cache.find(&bucket.name) {
-            Some(e) => e,
-            None => continue,
-        };
-        let flat = cache.flatten(&e);
-        let mut bui = BucketUsageInfo {
-            size: flat.size as u64,
-            versions_count: flat.versions as u64,
-            objects_count: flat.objects as u64,
-            delete_markers_count: flat.delete_markers as u64,
-            object_size_histogram: flat.obj_sizes.to_map(),
-            object_versions_histogram: flat.obj_versions.to_map(),
-            ..Default::default()
-        };
-
-        if let Some(rs) = &flat.replication_stats {
-            bui.replica_size = rs.replica_size;
-            bui.replica_count = rs.replica_count;
-
-            for (arn, stat) in rs.targets.iter() {
-                bui.replication_info.insert(
-                    arn.clone(),
-                    BucketTargetUsageInfo {
-                        replication_pending_size: stat.pending_size,
-                        replicated_size: stat.replicated_size,
-                        replication_failed_size: stat.failed_size,
-                        replication_pending_count: stat.pending_count,
-                        replication_failed_count: stat.failed_count,
-                        replicated_count: stat.replicated_count,
-                        ..Default::default()
-                    },
-                );
-            }
-        }
-        buckets_usage.insert(bucket.name.clone(), bui);
-    }
-
-    DataUsageInfo {
-        last_update: cache.info.last_update,
-        objects_total_count: flat.objects as u64,
-        versions_total_count: flat.versions as u64,
-        delete_markers_total_count: flat.delete_markers as u64,
-        objects_total_size: flat.size as u64,
-        buckets_count: e.children.len() as u64,
-        buckets_usage,
-        ..Default::default()
-    }
-}
-
 // Helper functions for DataUsageCache operations
 pub async fn load_data_usage_cache(store: &crate::set_disk::SetDisks, name: &str) -> crate::error::Result<DataUsageCache> {
     use crate::disk::{BUCKET_META_PREFIX, RUSTFS_META_BUCKET};
@@ -3124,6 +3059,102 @@ mod tests {
         assert_eq!(usage.object_versions_histogram.get("BETWEEN_1000_AND_10000"), Some(&1));
     }
 
+    #[test]
+    fn bucket_usage_uses_the_larger_of_logical_and_physical_size() {
+        let mut metadata = HashMap::new();
+        rustfs_utils::http::insert_str(
+            &mut metadata,
+            rustfs_utils::http::SUFFIX_COMPRESSION,
+            "klauspost/compress/s2".to_string(),
+        );
+        rustfs_utils::http::insert_str(&mut metadata, rustfs_utils::http::SUFFIX_ACTUAL_SIZE, "4096".to_string());
+        let object = ObjectInfo {
+            name: "compressed".to_string(),
+            size: 128,
+            user_defined: Arc::new(metadata),
+            ..Default::default()
+        };
+        let mut usage = BucketUsageAccumulator::default();
+        usage
+            .record("bucket", &object)
+            .expect("valid compressed metadata should be counted");
+        assert_eq!(usage.finish().size, 4096);
+
+        let mut framed_metadata = HashMap::new();
+        rustfs_utils::http::insert_str(
+            &mut framed_metadata,
+            rustfs_utils::http::SUFFIX_COMPRESSION,
+            "klauspost/compress/s2".to_string(),
+        );
+        rustfs_utils::http::insert_str(&mut framed_metadata, rustfs_utils::http::SUFFIX_ACTUAL_SIZE, "1".to_string());
+        let framed = ObjectInfo {
+            name: "framed".to_string(),
+            size: 17,
+            user_defined: Arc::new(framed_metadata),
+            ..Default::default()
+        };
+        assert_eq!(quota_object_size(&framed).expect("physical framing must remain quota-accounted"), 17);
+
+        let legacy_compressed_part = ObjectInfo {
+            name: "legacy-compressed-part".to_string(),
+            size: 1,
+            user_defined: Arc::new((*framed.user_defined).clone()),
+            parts: Arc::new(vec![rustfs_filemeta::ObjectPartInfo {
+                size: 1,
+                actual_size: -1,
+                ..Default::default()
+            }]),
+            ..Default::default()
+        };
+        assert_eq!(
+            quota_object_size(&legacy_compressed_part).expect("unknown compressed part size is a valid sentinel"),
+            1
+        );
+
+        let uncompressed_negative_part = ObjectInfo {
+            name: "uncompressed-negative-part".to_string(),
+            size: 1,
+            parts: Arc::new(vec![rustfs_filemeta::ObjectPartInfo {
+                size: 1,
+                actual_size: -1,
+                ..Default::default()
+            }]),
+            ..Default::default()
+        };
+        assert!(matches!(quota_object_size(&uncompressed_negative_part), Err(Error::PartMissingOrCorrupt)));
+
+        let mut corrupt_metadata = (*object.user_defined).clone();
+        rustfs_utils::http::insert_str(&mut corrupt_metadata, rustfs_utils::http::SUFFIX_ACTUAL_SIZE, "-1".to_string());
+        let corrupt = ObjectInfo {
+            user_defined: Arc::new(corrupt_metadata),
+            ..object
+        };
+        assert!(matches!(quota_object_size(&corrupt), Err(Error::PartMissingOrCorrupt)));
+
+        let mut poisoned_metadata = HashMap::new();
+        rustfs_utils::http::insert_str(
+            &mut poisoned_metadata,
+            rustfs_utils::http::SUFFIX_COMPRESSION,
+            "klauspost/compress/s2".to_string(),
+        );
+        rustfs_utils::http::insert_str(&mut poisoned_metadata, rustfs_utils::http::SUFFIX_ACTUAL_SIZE, "1".to_string());
+        let poisoned = ObjectInfo {
+            name: "legacy-swift-metadata".to_string(),
+            size: 4096,
+            user_defined: Arc::new(poisoned_metadata),
+            parts: Arc::new(vec![rustfs_filemeta::ObjectPartInfo {
+                size: 4096,
+                actual_size: 4096,
+                ..Default::default()
+            }]),
+            ..Default::default()
+        };
+        assert_eq!(
+            quota_object_size(&poisoned).expect("persisted part accounting must bound legacy user metadata"),
+            4096
+        );
+    }
+
     #[tokio::test]
     #[serial]
     async fn live_bucket_usage_refreshes_are_coalesced_only_while_in_flight() {

crates/ecstore/src/diagnostics/admin_server_info.rs

@@ -653,6 +653,7 @@ fn reconcile_servers_with_endpoint_topology(
     (added, report)
 }
 
+#[allow(dead_code, reason = "exercised by this file's topology tests (backlog#1823)")]
 fn server_topology_completeness_report(
     servers: &[ServerProperties],
     endpoints: &EndpointServerPools,

crates/ecstore/src/diagnostics/get.rs

@@ -46,21 +46,49 @@ pub(crate) const GET_CODEC_STREAMING_OBJECT_CLASS_MULTIPART: &str = "multipart";
 pub(crate) const GET_STAGE_DECODE: &str = "decode";
 pub(crate) const GET_STAGE_EMIT: &str = "emit";
 pub(crate) const GET_STAGE_FILL: &str = "fill";
+#[allow(
+    dead_code,
+    reason = "GET stage vocabulary; value pinned by this file's tests, no writer yet (backlog#1823)"
+)]
 pub(crate) const GET_STAGE_FIRST_BYTE: &str = "first_byte";
+#[allow(
+    dead_code,
+    reason = "GET stage vocabulary; value pinned by this file's tests, no writer yet (backlog#1823)"
+)]
 pub(crate) const GET_STAGE_FIRST_METADATA_RESPONSE: &str = "first_metadata_response";
+#[allow(
+    dead_code,
+    reason = "GET stage vocabulary; value pinned by this file's tests, no writer yet (backlog#1823)"
+)]
 pub(crate) const GET_STAGE_FIRST_VALID_METADATA_RESPONSE: &str = "first_valid_metadata_response";
+#[allow(
+    dead_code,
+    reason = "GET stage vocabulary; value pinned by this file's tests, no writer yet (backlog#1823)"
+)]
 pub(crate) const GET_STAGE_FIRST_SHARD_READ: &str = "first_shard_read";
+#[allow(
+    dead_code,
+    reason = "GET stage vocabulary; value pinned by this file's tests, no writer yet (backlog#1823)"
+)]
 pub(crate) const GET_STAGE_FULL_BODY: &str = "full_body";
 pub(crate) const GET_STAGE_INLINE_PREPARE: &str = "inline_prepare";
 pub(crate) const GET_STAGE_LOCK_ACQUIRE: &str = "lock_acquire";
 pub(crate) const GET_STAGE_METADATA: &str = "metadata";
 pub(crate) const GET_STAGE_METADATA_CACHE_LOOKUP: &str = "metadata_cache_lookup";
+#[allow(
+    dead_code,
+    reason = "GET stage vocabulary; value pinned by this file's tests, no writer yet (backlog#1823)"
+)]
 pub(crate) const GET_STAGE_METADATA_FANOUT: &str = "metadata_fanout";
 pub(crate) const GET_STAGE_METADATA_RESOLVE: &str = "metadata_resolve";
 pub(crate) const GET_STAGE_OBJECT_INFO: &str = "object_info";
 pub(crate) const GET_STAGE_OUTPUT_LOCK_WAIT: &str = "output_lock_wait";
 pub(crate) const GET_STAGE_OUTPUT_POLL: &str = "output_poll";
 pub(crate) const GET_STAGE_PATH_DECISION: &str = "path_decision";
+#[allow(
+    dead_code,
+    reason = "GET stage vocabulary; value pinned by this file's tests, no writer yet (backlog#1823)"
+)]
 pub(crate) const GET_STAGE_QUORUM_REACHED: &str = "quorum_reached";
 pub(crate) const GET_STAGE_RANGE: &str = "range";
 pub(crate) const GET_STAGE_READER_SETUP: &str = "reader_setup";
@@ -84,12 +112,28 @@ pub(crate) const GET_STAGE_READER_STREAM_FIRST_READ: &str = "reader_stream_first
 pub(crate) const GET_STAGE_READER_TASK_BITROT_READER_INIT: &str = "reader_task_bitrot_reader_init";
 pub(crate) const GET_STAGE_READER_TASK_FILE_OPEN: &str = "reader_task_file_open";
 pub(crate) const GET_STAGE_READER_TASK_READER_CONSTRUCTION: &str = "reader_task_reader_construction";
+pub(crate) const GET_STAGE_READ_VERSION_DECODE: &str = "read_version_decode";
+pub(crate) const GET_STAGE_READ_VERSION_PATH_CHECK: &str = "read_version_path_check";
+pub(crate) const GET_STAGE_READ_VERSION_PATH_RESOLVE: &str = "read_version_path_resolve";
+pub(crate) const GET_STAGE_READ_VERSION_XLMETA_READ: &str = "read_version_xlmeta_read";
 pub(crate) const GET_STAGE_RECONSTRUCT: &str = "reconstruct";
+#[allow(
+    dead_code,
+    reason = "GET stage vocabulary; value pinned by this file's tests, no writer yet (backlog#1823)"
+)]
 pub(crate) const GET_STAGE_RESPONSE_HANDOFF: &str = "response_handoff";
+#[allow(
+    dead_code,
+    reason = "GET stage vocabulary; value pinned by this file's tests, no writer yet (backlog#1823)"
+)]
 pub(crate) const GET_STAGE_SLOWEST_METADATA_RESPONSE: &str = "slowest_metadata_response";
 pub(crate) const GET_STAGE_STRIPE_READ: &str = "stripe_read";
 pub(crate) const GET_STAGE_STRIPE_READ_FIRST_SHARD: &str = "stripe_read_first_shard";
 pub(crate) const GET_STAGE_STRIPE_READ_QUORUM: &str = "stripe_read_quorum";
+#[allow(
+    dead_code,
+    reason = "GET stage vocabulary; value pinned by this file's tests, no writer yet (backlog#1823)"
+)]
 pub(crate) const GET_STAGE_BITROT_VERIFY: &str = "bitrot_verify";
 
 pub(crate) const GET_READER_BUFFER_OUTPUT: &str = "output";
@@ -155,8 +199,20 @@ pub(crate) const GET_METADATA_EARLY_STOP_REASON_VERSION_NOT_FOUND: &str = "versi
 pub(crate) const GET_METADATA_EARLY_STOP_REASON_VERSION_MATCH_QUORUM: &str = "version_match_quorum";
 
 /// Early-stop active state labels
+#[allow(
+    dead_code,
+    reason = "GET stage vocabulary; value pinned by this file's tests, no writer yet (backlog#1823)"
+)]
 pub(crate) const EARLY_STOP_ACTIVE_HIT: &str = "hit";
+#[allow(
+    dead_code,
+    reason = "GET stage vocabulary; value pinned by this file's tests, no writer yet (backlog#1823)"
+)]
 pub(crate) const EARLY_STOP_ACTIVE_MISS: &str = "miss";
+#[allow(
+    dead_code,
+    reason = "GET stage vocabulary; value pinned by this file's tests, no writer yet (backlog#1823)"
+)]
 pub(crate) const EARLY_STOP_ACTIVE_DISABLED: &str = "disabled";
 
 #[derive(Clone, Copy, Debug, Eq, PartialEq)]
@@ -442,6 +498,10 @@ mod tests {
         assert_eq!(GET_STAGE_QUORUM_REACHED, "quorum_reached");
         assert_eq!(GET_STAGE_RANGE, "range");
         assert_eq!(GET_STAGE_READER_SETUP, "reader_setup");
+        assert_eq!(GET_STAGE_READ_VERSION_DECODE, "read_version_decode");
+        assert_eq!(GET_STAGE_READ_VERSION_PATH_CHECK, "read_version_path_check");
+        assert_eq!(GET_STAGE_READ_VERSION_PATH_RESOLVE, "read_version_path_resolve");
+        assert_eq!(GET_STAGE_READ_VERSION_XLMETA_READ, "read_version_xlmeta_read");
         assert_eq!(GET_STAGE_RECONSTRUCT, "reconstruct");
         assert_eq!(GET_STAGE_RESPONSE_HANDOFF, "response_handoff");
         assert_eq!(GET_STAGE_SLOWEST_METADATA_RESPONSE, "slowest_metadata_response");

crates/ecstore/src/diagnostics/mod.rs

@@ -13,8 +13,6 @@
 // limitations under the License.
 
 // #730: diagnostics constants are staged for request-path telemetry migration.
-#![allow(dead_code)]
 
 pub(crate) mod admin_server_info;
 pub(crate) mod get;
-pub(crate) mod pool;

crates/ecstore/src/diagnostics/pool.rs

@@ -1,30 +0,0 @@
-// Copyright 2024 RustFS Team
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-//! BytesPool metric label constants.
-//!
-//! These constants are used when recording pool acquisition and return
-//! metrics to avoid string allocations and ensure label consistency.
-
-/// BytesPool tier labels
-pub const POOL_TIER_SMALL: &str = "small";
-pub const POOL_TIER_MEDIUM: &str = "medium";
-pub const POOL_TIER_LARGE: &str = "large";
-pub const POOL_TIER_XLARGE: &str = "xlarge";
-
-/// BytesPool outcome labels
-pub const POOL_OUTCOME_HIT: &str = "hit";
-pub const POOL_OUTCOME_MISS: &str = "miss";
-pub const POOL_OUTCOME_RECYCLED: &str = "recycled";
-pub const POOL_OUTCOME_DROPPED: &str = "dropped";

crates/ecstore/src/disk/disk_store.rs

@@ -241,6 +241,40 @@ pub fn get_drive_list_dir_timeout() -> Duration {
     )
 }
 
+pub(crate) trait DiskStoreRenameDataExt {
+    async fn rename_data_borrowed(
+        &self,
+        src_volume: &str,
+        src_path: &str,
+        fi: &FileInfo,
+        dst_volume: &str,
+        dst_path: &str,
+    ) -> Result<RenameDataResp>;
+}
+
+impl DiskStoreRenameDataExt for LocalDiskWrapper {
+    async fn rename_data_borrowed(
+        &self,
+        src_volume: &str,
+        src_path: &str,
+        fi: &FileInfo,
+        dst_volume: &str,
+        dst_path: &str,
+    ) -> Result<RenameDataResp> {
+        self.track_disk_health_mutation(
+            "rename_data",
+            DiskMetricMutation::Write,
+            || async {
+                self.disk
+                    .rename_data_borrowed(src_volume, src_path, fi, dst_volume, dst_path)
+                    .await
+            },
+            get_max_timeout_duration(),
+        )
+        .await
+    }
+}
+
 pub fn get_drive_walkdir_timeout() -> Duration {
     get_drive_timeout_duration(
         rustfs_config::ENV_DRIVE_WALKDIR_TIMEOUT_SECS,
@@ -1985,13 +2019,8 @@ impl DiskAPI for LocalDiskWrapper {
         dst_volume: &str,
         dst_path: &str,
     ) -> Result<RenameDataResp> {
-        self.track_disk_health_mutation(
-            "rename_data",
-            DiskMetricMutation::Write,
-            || async { self.disk.rename_data(src_volume, src_path, fi, dst_volume, dst_path).await },
-            get_max_timeout_duration(),
-        )
-        .await
+        self.rename_data_borrowed(src_volume, src_path, &fi, dst_volume, dst_path)
+            .await
     }
 
     async fn list_dir(&self, origvolume: &str, volume: &str, dir_path: &str, count: i32) -> Result<Vec<String>> {

crates/ecstore/src/disk/local.rs

@@ -15,6 +15,11 @@
 use crate::config::storageclass::DEFAULT_INLINE_BLOCK;
 use crate::crash_inject::{self, CrashPoint};
 use crate::data_usage::local_snapshot::ensure_data_usage_layout;
+use crate::diagnostics::get::{
+    GET_OBJECT_PATH_INTERNAL_META, GET_OBJECT_PATH_LEGACY_DUPLEX, GET_STAGE_READ_VERSION_DECODE,
+    GET_STAGE_READ_VERSION_PATH_CHECK, GET_STAGE_READ_VERSION_PATH_RESOLVE, GET_STAGE_READ_VERSION_XLMETA_READ,
+    get_stage_timer_if_enabled, record_get_stage_duration_if_enabled,
+};
 #[cfg(test)]
 use crate::disk::HEALING_MARKER_PATH;
 use crate::disk::disk_store::{get_drive_walkdir_stall_timeout, get_object_disk_read_timeout};
@@ -22,17 +27,18 @@ use crate::disk::{
     BUCKET_META_PREFIX, CHECK_PART_FILE_CORRUPT, CHECK_PART_FILE_NOT_FOUND, CHECK_PART_SUCCESS, CHECK_PART_UNKNOWN,
     CHECK_PART_VOLUME_NOT_FOUND, CheckPartsResp, ConditionalFileUpdate, DataDirDeleteStatus, DeleteOptions, DiskAPI, DiskInfo,
     DiskInfoOptions, DiskLocation, DiskMetrics, FileInfoVersions, FileReader, FileWriter, MmapCopyStageMetrics, OldCurrentSize,
-    PART_TRANSACTION_NEW_META, PART_TRANSACTION_OLD_META, PART_TRANSACTION_ROLLBACK, PartTransactionAction, RUSTFS_META_BUCKET,
-    RUSTFS_META_TMP_BUCKET, RUSTFS_META_TMP_DELETED_BUCKET, ReadMultipleReq, ReadMultipleResp, ReadOptions, RenameDataResp,
-    STORAGE_FORMAT_FILE, STORAGE_FORMAT_FILE_BACKUP, SnapshotLeaseToken, UpdateMetadataOpts, VolumeInfo, WalkDirOptions,
-    conv_part_err_to_int,
+    PART_TRANSACTION_NEW_META, PART_TRANSACTION_OLD_META, PART_TRANSACTION_ROLLBACK, PartTransactionAction,
+    QUOTA_MUTATION_FENCE_METADATA_SUFFIX, RUSTFS_META_BUCKET, RUSTFS_META_TMP_BUCKET, RUSTFS_META_TMP_DELETED_BUCKET,
+    ReadMultipleReq, ReadMultipleResp, ReadOptions, RenameDataResp, STORAGE_FORMAT_FILE, STORAGE_FORMAT_FILE_BACKUP,
+    SnapshotLeaseToken, UpdateMetadataOpts, VolumeInfo, WalkDirOptions, conv_part_err_to_int,
     endpoint::Endpoint,
     error::{DiskError, Error, FileAccessDeniedWithContext, Result},
     error_conv::{to_access_error, to_file_error, to_unformatted_disk_error, to_volume_error},
     format::FormatV3,
     fs::{O_APPEND, O_CREATE, O_RDONLY, O_TRUNC, O_WRONLY, access, lstat, lstat_std, remove, remove_all_std, remove_std, rename},
-    os,
+    is_quota_mutation_fence_path, os,
     os::{check_path_length, is_dir_not_empty_error, is_empty_dir, is_root_disk, rename_all, rename_all_ignore_missing_source},
+    quota_mutation_fence_path,
 };
 use crate::erasure::coding::{self, bitrot_verify};
 use crate::runtime::sources as runtime_sources;
@@ -55,9 +61,7 @@ use std::collections::HashMap;
 use std::collections::HashSet;
 use std::fmt::Debug;
 use std::io::{Error as IoError, SeekFrom};
-#[cfg(target_os = "linux")]
-use std::sync::atomic::AtomicBool;
-use std::sync::atomic::{AtomicU32, Ordering};
+use std::sync::atomic::{AtomicBool, AtomicU32, AtomicUsize, Ordering};
 use std::sync::{Arc, OnceLock};
 use std::time::Duration;
 use std::{
@@ -2024,14 +2028,17 @@ static RENAME_DATA_REMOVE_DST_BASE_BEFORE_COMMIT: std::sync::Mutex<Option<(Strin
 #[cfg(test)]
 type InlinePreparationHook = Box<dyn FnOnce() + Send>;
 #[cfg(test)]
+type RenameDataPublicationHookKey = (PathBuf, String, String);
+#[cfg(test)]
 static INLINE_PREPARATION_BEFORE_BACKUP: std::sync::LazyLock<std::sync::Mutex<HashMap<String, InlinePreparationHook>>> =
     std::sync::LazyLock::new(|| std::sync::Mutex::new(HashMap::new()));
 #[cfg(test)]
 static INLINE_BEFORE_FILE_SYNC_ADMISSION: std::sync::LazyLock<std::sync::Mutex<HashMap<String, InlinePreparationHook>>> =
     std::sync::LazyLock::new(|| std::sync::Mutex::new(HashMap::new()));
 #[cfg(test)]
-static RENAME_DATA_AFTER_FIRST_PUBLICATION: std::sync::LazyLock<std::sync::Mutex<HashMap<String, InlinePreparationHook>>> =
-    std::sync::LazyLock::new(|| std::sync::Mutex::new(HashMap::new()));
+static RENAME_DATA_AFTER_FIRST_PUBLICATION: std::sync::LazyLock<
+    std::sync::Mutex<HashMap<RenameDataPublicationHookKey, InlinePreparationHook>>,
+> = std::sync::LazyLock::new(|| std::sync::Mutex::new(HashMap::new()));
 #[cfg(test)]
 static OWNED_FILE_WRITE_BEFORE_OPEN: std::sync::LazyLock<std::sync::Mutex<HashMap<PathBuf, InlinePreparationHook>>> =
     std::sync::LazyLock::new(|| std::sync::Mutex::new(HashMap::new()));
@@ -2103,11 +2110,11 @@ fn set_inline_before_file_sync_admission(dst_path: &str, hook: impl FnOnce() + S
 }
 
 #[cfg(test)]
-fn set_rename_data_after_first_publication(dst_path: &str, hook: impl FnOnce() + Send + 'static) {
+fn set_rename_data_after_first_publication(root: &Path, dst_volume: &str, dst_path: &str, hook: impl FnOnce() + Send + 'static) {
     RENAME_DATA_AFTER_FIRST_PUBLICATION
         .lock()
         .expect("test publication hook lock should not be poisoned")
-        .insert(dst_path.to_string(), Box::new(hook));
+        .insert((root.to_path_buf(), dst_volume.to_string(), dst_path.to_string()), Box::new(hook));
 }
 
 #[cfg(test)]
@@ -2259,11 +2266,11 @@ fn run_inline_before_file_sync_admission(dst_path: &str) {
 }
 
 #[cfg(test)]
-fn run_rename_data_after_first_publication(dst_path: &str) {
+fn run_rename_data_after_first_publication(root: &Path, dst_volume: &str, dst_path: &str) {
     let hook = RENAME_DATA_AFTER_FIRST_PUBLICATION
         .lock()
         .expect("test publication hook lock should not be poisoned")
-        .remove(dst_path);
+        .remove(&(root.to_path_buf(), dst_volume.to_string(), dst_path.to_string()));
     if let Some(hook) = hook {
         hook();
     }
@@ -2361,9 +2368,6 @@ async fn remove_dst_base_before_commit(
 #[cfg(not(test))]
 fn run_inline_preparation_before_backup(_dst_path: &str) {}
 
-#[cfg(not(test))]
-fn run_rename_data_after_first_publication(_dst_path: &str) {}
-
 #[cfg(not(test))]
 fn should_fail_after_delete_data_staged(_path: &str) -> bool {
     false
@@ -4751,6 +4755,25 @@ struct SnapshotLeaseEntry {
     tokens: HashSet<SnapshotLeaseToken>,
     pending_delete: Option<DeleteOptions>,
     deleting: bool,
+    mutation_fence: Option<Arc<QuotaMutationFenceState>>,
+}
+
+#[derive(Default)]
+struct QuotaMutationFenceState {
+    revoked: AtomicBool,
+    running: AtomicUsize,
+    notify: Notify,
+}
+
+struct QuotaMutationFenceClaim {
+    state: Arc<QuotaMutationFenceState>,
+}
+
+impl Drop for QuotaMutationFenceClaim {
+    fn drop(&mut self) {
+        self.state.running.fetch_sub(1, Ordering::AcqRel);
+        self.state.notify.notify_waiters();
+    }
 }
 
 #[derive(Default)]
@@ -7315,6 +7338,34 @@ fn normalize_path_components(path: impl AsRef<Path>) -> PathBuf {
 }
 
 impl LocalDisk {
+    async fn claim_quota_mutation_fence(
+        &self,
+        volume: &str,
+        path: &str,
+        token: SnapshotLeaseToken,
+    ) -> Result<Arc<QuotaMutationFenceClaim>> {
+        let key = SnapshotLeaseKey {
+            volume: RUSTFS_META_BUCKET.to_string(),
+            path: quota_mutation_fence_path(volume, path),
+        };
+        let state = {
+            let registry = self.snapshot_leases.lock().await;
+            let entry = registry.entries.get(&key).ok_or(DiskError::FileNotFound)?;
+            let state = entry.mutation_fence.as_ref().ok_or(DiskError::FileNotFound)?;
+            if !entry.tokens.contains(&token) || state.revoked.load(Ordering::Acquire) {
+                return Err(DiskError::FileNotFound);
+            }
+            state.running.fetch_add(1, Ordering::AcqRel);
+            Arc::clone(state)
+        };
+        if state.revoked.load(Ordering::Acquire) {
+            state.running.fetch_sub(1, Ordering::AcqRel);
+            state.notify.notify_waiters();
+            return Err(DiskError::FileNotFound);
+        }
+        Ok(Arc::new(QuotaMutationFenceClaim { state }))
+    }
+
     async fn reserve_version_delete(&self, volume: &str, object: &str, data_dir: Uuid, rollback_dir: Uuid) -> Result<bool> {
         let path = format!("{object}/{data_dir}");
         let data_path = self.io_get_object_path(volume, &path)?;
@@ -8638,17 +8689,41 @@ impl DiskAPI for LocalDisk {
         &self,
         src_volume: &str,
         src_path: &str,
-        mut fi: FileInfo,
+        fi: FileInfo,
         dst_volume: &str,
         dst_path: &str,
     ) -> Result<RenameDataResp> {
         crate::hp_guard!("LocalDisk::rename_data");
+        let mut fi = fi;
         // A non-force DeleteBucket must not remove a directory while a local
         // object commit is publishing into it. The peer's empty scan remains
         // optimistic; this lease establishes the local commit/delete order and
         // remains owned by any blocking syscall that outlives async cancellation.
         let destination_object_path = self.io_get_object_path(dst_volume, dst_path)?;
+        let quota_fence_token =
+            match rustfs_utils::http::metadata_compat::get_consistent_str(&fi.metadata, QUOTA_MUTATION_FENCE_METADATA_SUFFIX) {
+                Some(value) => {
+                    let token = Uuid::parse_str(value).map_err(|_| DiskError::FileCorrupt)?;
+                    Some(SnapshotLeaseToken::from_slice(token.as_bytes())?)
+                }
+                None if rustfs_utils::http::metadata_compat::contains_key_str(
+                    &fi.metadata,
+                    QUOTA_MUTATION_FENCE_METADATA_SUFFIX,
+                ) =>
+                {
+                    return Err(DiskError::FileCorrupt);
+                }
+                None => None,
+            };
+        rustfs_utils::http::metadata_compat::remove_str(&mut fi.metadata, QUOTA_MUTATION_FENCE_METADATA_SUFFIX);
+        let quota_fence_claim = match quota_fence_token {
+            Some(token) => Some(self.claim_quota_mutation_fence(dst_volume, dst_path, token).await?),
+            None => None,
+        };
         let mutation_lease = os::acquire_rename_data_mutation_lease(&self.root, dst_volume, &destination_object_path).await;
+        if let Some(claim) = quota_fence_claim {
+            mutation_lease.attach_external_guard(claim);
+        }
         if fi.is_legacy_indexed_delete_marker() {
             fi.erasure.index = 0;
         }
@@ -8941,8 +9016,9 @@ impl DiskAPI for LocalDisk {
                 .await?;
                 return Err(err);
             }
+            #[cfg(test)]
             if has_data_dir_path.is_some() {
-                run_rename_data_after_first_publication(dst_path);
+                run_rename_data_after_first_publication(&self.root, dst_volume, dst_path);
             }
 
             // Crash-consistency injection: hard power loss after the data dir
@@ -9375,7 +9451,8 @@ impl DiskAPI for LocalDisk {
                     let _ = remove_file_if_exists(staged_backup);
                     return Err(err);
                 }
-                run_rename_data_after_first_publication(dst_path);
+                #[cfg(test)]
+                run_rename_data_after_first_publication(&self.root, dst_volume, dst_path);
                 if sync {
                     file_sync_admission = Some(
                         os::acquire_file_sync_admission(self.file_sync_permits.clone())
@@ -9638,11 +9715,26 @@ impl DiskAPI for LocalDisk {
     }
 
     async fn acquire_snapshot_lease(&self, volume: &str, path: &str) -> Result<SnapshotLeaseToken> {
-        let file_path = self.io_get_object_path(volume, path)?;
         let key = SnapshotLeaseKey {
             volume: volume.to_string(),
             path: path.to_string(),
         };
+        if volume == RUSTFS_META_BUCKET && is_quota_mutation_fence_path(path) {
+            let mut registry = self.snapshot_leases.lock().await;
+            let entry = registry.entries.entry(key).or_default();
+            let state = entry
+                .mutation_fence
+                .get_or_insert_with(|| Arc::new(QuotaMutationFenceState::default()));
+            if state.revoked.load(Ordering::Acquire) {
+                return Err(DiskError::FileNotFound);
+            }
+            let token = SnapshotLeaseToken::new();
+            entry.tokens.insert(token);
+            return Ok(token);
+        }
+
+        let file_path = self.io_get_object_path(volume, path)?;
+        let _mutation_lease = os::acquire_rename_data_mutation_lease(&self.root, volume, &file_path).await;
         let token = {
             let mut registry = self.snapshot_leases.lock().await;
             if registry.entries.get(&key).is_some_and(|entry| entry.deleting) {
@@ -9670,6 +9762,48 @@ impl DiskAPI for LocalDisk {
             volume: volume.to_string(),
             path: path.to_string(),
         };
+        if volume == RUSTFS_META_BUCKET && is_quota_mutation_fence_path(path) {
+            if !token.is_revoke_all() {
+                let mut registry = self.snapshot_leases.lock().await;
+                let Some(entry) = registry.entries.get_mut(&key) else {
+                    return Ok(());
+                };
+                entry.tokens.remove(&token);
+                let removable = entry.tokens.is_empty()
+                    && entry
+                        .mutation_fence
+                        .as_ref()
+                        .is_none_or(|state| state.running.load(Ordering::Acquire) == 0);
+                if removable {
+                    registry.entries.remove(&key);
+                }
+                return Ok(());
+            }
+            let state = {
+                let mut registry = self.snapshot_leases.lock().await;
+                let Some(entry) = registry.entries.get_mut(&key) else {
+                    return Ok(());
+                };
+                let Some(state) = entry.mutation_fence.as_ref().cloned() else {
+                    registry.entries.remove(&key);
+                    return Ok(());
+                };
+                state.revoked.store(true, Ordering::Release);
+                entry.tokens.clear();
+                state
+            };
+            loop {
+                let notified = state.notify.notified();
+                tokio::pin!(notified);
+                notified.as_mut().enable();
+                if state.running.load(Ordering::Acquire) == 0 {
+                    break;
+                }
+                notified.await;
+            }
+            self.snapshot_leases.lock().await.entries.remove(&key);
+            return Ok(());
+        }
         let opts = {
             let mut registry = self.snapshot_leases.lock().await;
             let Some(entry) = registry.entries.get_mut(&key) else {
@@ -9840,6 +9974,12 @@ impl DiskAPI for LocalDisk {
         opts: &ReadOptions,
     ) -> Result<FileInfo> {
         crate::hp_guard!("LocalDisk::read_version");
+        let stage_metrics_enabled = rustfs_io_metrics::get_stage_metrics_enabled();
+        let metrics_path = if stage_metrics_enabled && crate::bucket::utils::is_meta_bucketname(volume) {
+            GET_OBJECT_PATH_INTERNAL_META
+        } else {
+            GET_OBJECT_PATH_LEGACY_DUPLEX
+        };
         if !org_volume.is_empty() {
             let org_volume_path = self.io_get_bucket_path(org_volume)?;
             if !skip_access_checks(org_volume) {
@@ -9849,37 +9989,46 @@ impl DiskAPI for LocalDisk {
             }
         }
 
+        let path_resolve_start = get_stage_timer_if_enabled(stage_metrics_enabled);
         let file_path = self.io_get_object_path(volume, path)?;
         let volume_dir = self.io_get_bucket_path(volume)?;
+        record_get_stage_duration_if_enabled(metrics_path, GET_STAGE_READ_VERSION_PATH_RESOLVE, path_resolve_start);
 
+        let path_check_start = get_stage_timer_if_enabled(stage_metrics_enabled);
         check_path_length(file_path.to_string_lossy().as_ref())?;
+        record_get_stage_duration_if_enabled(metrics_path, GET_STAGE_READ_VERSION_PATH_CHECK, path_check_start);
 
         let read_data = opts.read_data;
 
-        let (data, _) = self
-            .read_raw(volume, volume_dir.clone(), file_path, read_data)
-            .await
-            .map_err(|e| {
-                if e == DiskError::FileNotFound && !version_id.is_empty() {
-                    DiskError::FileVersionNotFound
-                } else {
-                    e
-                }
-            })?;
+        let xlmeta_read_start = get_stage_timer_if_enabled(stage_metrics_enabled);
+        let raw_read_result = self.read_raw(volume, volume_dir.clone(), file_path, read_data).await;
+        record_get_stage_duration_if_enabled(metrics_path, GET_STAGE_READ_VERSION_XLMETA_READ, xlmeta_read_start);
+        let (data, _) = raw_read_result.map_err(|e| {
+            if e == DiskError::FileNotFound && !version_id.is_empty() {
+                DiskError::FileVersionNotFound
+            } else {
+                e
+            }
+        })?;
 
-        let mut fi = get_file_info(
-            &data,
-            volume,
-            path,
-            version_id,
-            FileInfoOpts {
-                data: read_data,
-                include_free_versions: opts.incl_free_versions,
-                include_part_checksums: false,
-            },
-        )?;
-
-        fi.validate_for_metadata_read()?;
+        let decode_start = get_stage_timer_if_enabled(stage_metrics_enabled);
+        let file_info_result: Result<FileInfo> = (|| {
+            let fi = get_file_info(
+                &data,
+                volume,
+                path,
+                version_id,
+                FileInfoOpts {
+                    data: read_data,
+                    include_free_versions: opts.incl_free_versions,
+                    include_part_checksums: false,
+                },
+            )?;
+            fi.validate_for_metadata_read()?;
+            Ok(fi)
+        })();
+        record_get_stage_duration_if_enabled(metrics_path, GET_STAGE_READ_VERSION_DECODE, decode_start);
+        let mut fi = file_info_result?;
         if fi.is_canonical_delete_marker() {
             return Ok(fi);
         }
@@ -10433,6 +10582,19 @@ impl DiskAPI for LocalDisk {
     }
 }
 
+impl LocalDisk {
+    pub(crate) async fn rename_data_borrowed(
+        &self,
+        src_volume: &str,
+        src_path: &str,
+        fi: &FileInfo,
+        dst_volume: &str,
+        dst_path: &str,
+    ) -> Result<RenameDataResp> {
+        <Self as DiskAPI>::rename_data(self, src_volume, src_path, fi.clone(), dst_volume, dst_path).await
+    }
+}
+
 async fn wait_for_startup_cleanup_signal(
     startup_cleanup_ready: &AtomicU32,
     startup_cleanup_notify: &Notify,
@@ -10562,6 +10724,108 @@ mod test {
         meta.marshal_msg().expect("test metadata should encode")
     }
 
+    #[test]
+    #[serial_test::serial]
+    fn read_version_records_local_metadata_stage_breakdown() {
+        let runtime = tokio::runtime::Builder::new_current_thread()
+            .enable_all()
+            .build()
+            .expect("test runtime should be created");
+        let recorder = crate::test_metrics::CapturingRecorder::default();
+        let previous_gate = rustfs_io_metrics::get_stage_metrics_enabled();
+        rustfs_io_metrics::set_get_stage_metrics_enabled(true);
+
+        metrics::with_local_recorder(&recorder, || {
+            runtime.block_on(async {
+                let dir = tempfile::tempdir().expect("temp dir should be created");
+                let endpoint =
+                    Endpoint::try_from(dir.path().to_str().expect("temp dir should be utf8")).expect("endpoint should parse");
+                let disk = LocalDisk::new(&endpoint, false).await.expect("local disk should be created");
+                let bucket = "bucket";
+                let object = "stage-breakdown";
+                ensure_test_volume(&disk, bucket).await;
+
+                let object_dir = dir.path().join(bucket).join(object);
+                fs::create_dir_all(&object_dir)
+                    .await
+                    .expect("object directory should be created");
+                fs::write(
+                    object_dir.join(STORAGE_FORMAT_FILE),
+                    test_meta(test_file_info(object, Uuid::new_v4(), None, Some(Bytes::from_static(b"inline")))),
+                )
+                .await
+                .expect("object metadata should be written");
+
+                disk.read_version(
+                    "",
+                    bucket,
+                    object,
+                    "",
+                    &ReadOptions {
+                        read_data: true,
+                        ..Default::default()
+                    },
+                )
+                .await
+                .expect("read_version should succeed");
+
+                let meta_object = "stage-breakdown-meta";
+                let meta_object_dir = dir.path().join(RUSTFS_META_BUCKET).join(meta_object);
+                fs::create_dir_all(&meta_object_dir)
+                    .await
+                    .expect("internal metadata object directory should be created");
+                fs::write(
+                    meta_object_dir.join(STORAGE_FORMAT_FILE),
+                    test_meta(test_file_info(meta_object, Uuid::new_v4(), None, Some(Bytes::from_static(b"meta")))),
+                )
+                .await
+                .expect("internal metadata should be written");
+
+                disk.read_version(
+                    "",
+                    RUSTFS_META_BUCKET,
+                    meta_object,
+                    "",
+                    &ReadOptions {
+                        read_data: true,
+                        ..Default::default()
+                    },
+                )
+                .await
+                .expect("internal metadata read_version should succeed");
+            });
+        });
+        rustfs_io_metrics::set_get_stage_metrics_enabled(previous_gate);
+
+        for stage in [
+            GET_STAGE_READ_VERSION_PATH_RESOLVE,
+            GET_STAGE_READ_VERSION_PATH_CHECK,
+            GET_STAGE_READ_VERSION_XLMETA_READ,
+            GET_STAGE_READ_VERSION_DECODE,
+        ] {
+            assert_eq!(
+                recorder
+                    .histogram_values(
+                        "rustfs_io_get_object_stage_duration_seconds",
+                        &[("path", GET_OBJECT_PATH_LEGACY_DUPLEX), ("stage", stage)]
+                    )
+                    .len(),
+                1,
+                "{stage} should be recorded once for user-bucket LocalDisk::read_version"
+            );
+            assert_eq!(
+                recorder
+                    .histogram_values(
+                        "rustfs_io_get_object_stage_duration_seconds",
+                        &[("path", GET_OBJECT_PATH_INTERNAL_META), ("stage", stage)]
+                    )
+                    .len(),
+                1,
+                "{stage} should be recorded once for internal-meta LocalDisk::read_version"
+            );
+        }
+    }
+
     #[test]
     fn inline_metadata_rollback_dir_avoids_real_data_dir_collision() {
         let target_version = Uuid::parse_str("11111111-2222-3333-4444-555555555555").expect("version id should parse");
@@ -12885,7 +13149,7 @@ mod test {
         let replacement_staging_parent_for_hook = replacement_staging_parent.clone();
         let staged_metadata_for_hook = staged_metadata.clone();
         let replacement_staged_metadata_for_hook = replacement_staged_metadata.clone();
-        set_rename_data_after_first_publication(object, move || {
+        set_rename_data_after_first_publication(&disk.root, bucket, object, move || {
             std::fs::rename(&object_dir_for_hook, &replacement_dir_for_hook)
                 .expect_err("the destination object identity must remain pinned until xl.meta commits");
             std::fs::rename(&staging_parent_for_hook, &replacement_staging_parent_for_hook)
@@ -13152,7 +13416,7 @@ mod test {
         let replacement_dir_for_hook = replacement_dir.clone();
         let staged_metadata_for_hook = staged_metadata.clone();
         let replacement_staged_metadata_for_hook = replacement_staged_metadata.clone();
-        set_rename_data_after_first_publication(object, move || {
+        set_rename_data_after_first_publication(&disk.root, bucket, object, move || {
             std::fs::rename(&object_dir_for_hook, &replacement_dir_for_hook)
                 .expect_err("the destination object identity must remain pinned after publishing its rollback backup");
             std::fs::rename(&staged_metadata_for_hook, &replacement_staged_metadata_for_hook)
@@ -13518,7 +13782,7 @@ mod test {
 
         let (entered_tx, entered_rx) = mpsc::channel();
         let (release_tx, release_rx) = mpsc::channel();
-        set_rename_data_after_first_publication(object, move || {
+        set_rename_data_after_first_publication(&disk.root, bucket, object, move || {
             entered_tx.send(()).expect("signal first publication");
             release_rx.recv().expect("wait while delete_volume is blocked");
         });
@@ -14112,7 +14376,7 @@ mod test {
 
         let (published_tx, published_rx) = mpsc::channel();
         let (release_tx, release_rx) = mpsc::channel();
-        set_rename_data_after_first_publication(object, move || {
+        set_rename_data_after_first_publication(&disk.root, bucket, object, move || {
             published_tx.send(()).expect("signal backup publication");
             release_rx.recv().expect("wait for lock-order assertion");
         });
@@ -18767,6 +19031,48 @@ mod test {
         assert!(matches!(disk.read_all(volume, &first_part).await, Err(DiskError::FileNotFound)));
     }
 
+    #[tokio::test]
+    async fn quota_mutation_fence_revoke_waits_for_active_claim_and_rejects_late_claims() {
+        use tempfile::tempdir;
+
+        let root_dir = tempdir().expect("temp dir should be created");
+        let endpoint = Endpoint::try_from(root_dir.path().to_string_lossy().as_ref()).expect("endpoint should parse");
+        let disk = Arc::new(LocalDisk::new(&endpoint, false).await.expect("local disk should be created"));
+        let bucket = "quota-fence-volume";
+        let object = "object";
+        let fence_path = quota_mutation_fence_path(bucket, object);
+        let token = disk
+            .acquire_snapshot_lease(RUSTFS_META_BUCKET, &fence_path)
+            .await
+            .expect("quota mutation token should be prepared");
+        let claim = disk
+            .claim_quota_mutation_fence(bucket, object, token)
+            .await
+            .expect("prepared token should be claimable");
+
+        let release_disk = Arc::clone(&disk);
+        let mut release = tokio::spawn(async move {
+            release_disk
+                .release_snapshot_lease(RUSTFS_META_BUCKET, &fence_path, SnapshotLeaseToken::revoke_all())
+                .await
+        });
+        assert!(
+            tokio::time::timeout(Duration::from_millis(50), &mut release).await.is_err(),
+            "revoke must wait until an already claimed mutation has finished"
+        );
+
+        drop(claim);
+        tokio::time::timeout(Duration::from_secs(1), release)
+            .await
+            .expect("revoke should wake after the final claim drops")
+            .expect("revoke task should not panic")
+            .expect("revoke should succeed");
+        assert!(matches!(
+            disk.claim_quota_mutation_fence(bucket, object, token).await,
+            Err(DiskError::FileNotFound)
+        ));
+    }
+
     #[tokio::test]
     async fn delete_version_keeps_later_part_until_snapshot_release() {
         use tempfile::tempdir;

crates/ecstore/src/disk/mod.rs

@@ -55,6 +55,7 @@ pub fn part_transaction_path(part_path: &str) -> String {
 
 use crate::cluster::rpc::RemoteDisk;
 use crate::cluster::rpc::build_internode_data_transport_from_env;
+use crate::disk::disk_store::DiskStoreRenameDataExt;
 use crate::disk::disk_store::LocalDiskWrapper;
 use crate::disk::health_state::RuntimeDriveHealthState;
 use crate::disk::local::ScanGuard;
@@ -72,6 +73,28 @@ use time::OffsetDateTime;
 use tokio::io::{AsyncRead, AsyncWrite};
 use uuid::Uuid;
 
+const QUOTA_MUTATION_FENCE_PREFIX: &str = "tmp/quota-mutation-fences/";
+pub(crate) const QUOTA_MUTATION_FENCE_METADATA_SUFFIX: &str = "quota-mutation-fence-token";
+
+pub(crate) fn quota_mutation_fence_path(bucket: &str, object: &str) -> String {
+    use sha2::{Digest, Sha256};
+
+    let mut input = Vec::with_capacity(bucket.len() + object.len() + 1);
+    input.extend_from_slice(bucket.as_bytes());
+    input.push(0);
+    input.extend_from_slice(object.as_bytes());
+    let digest = Sha256::digest(input);
+    format!(
+        "{QUOTA_MUTATION_FENCE_PREFIX}{}",
+        hex_simd::encode_to_string(digest, hex_simd::AsciiCase::Lower)
+    )
+}
+
+pub(crate) fn is_quota_mutation_fence_path(path: &str) -> bool {
+    path.strip_prefix(QUOTA_MUTATION_FENCE_PREFIX)
+        .is_some_and(|digest| digest.len() == 64 && digest.bytes().all(|byte| byte.is_ascii_hexdigit()))
+}
+
 pub type DiskStore = Arc<Disk>;
 
 pub type FileReader = Box<dyn AsyncRead + Send + Sync + Unpin>;
@@ -96,6 +119,20 @@ impl SnapshotLeaseToken {
     pub fn as_bytes(&self) -> &[u8; 16] {
         self.0.as_bytes()
     }
+
+    pub(crate) fn as_uuid(self) -> Uuid {
+        self.0
+    }
+
+    #[doc(hidden)]
+    pub fn revoke_all() -> Self {
+        Self(Uuid::nil())
+    }
+
+    #[doc(hidden)]
+    pub fn is_revoke_all(self) -> bool {
+        self.0.is_nil()
+    }
 }
 
 impl Default for SnapshotLeaseToken {
@@ -398,10 +435,8 @@ impl DiskAPI for Disk {
         dst_volume: &str,
         dst_path: &str,
     ) -> Result<RenameDataResp> {
-        match self {
-            Disk::Local(local_disk) => local_disk.rename_data(src_volume, src_path, fi, dst_volume, dst_path).await,
-            Disk::Remote(remote_disk) => remote_disk.rename_data(src_volume, src_path, fi, dst_volume, dst_path).await,
-        }
+        self.rename_data_borrowed(src_volume, src_path, &fi, dst_volume, dst_path)
+            .await
     }
 
     #[tracing::instrument(level = "trace", skip_all)]
@@ -631,6 +666,30 @@ impl DiskAPI for Disk {
     }
 }
 
+impl Disk {
+    pub(crate) async fn rename_data_borrowed(
+        &self,
+        src_volume: &str,
+        src_path: &str,
+        fi: &FileInfo,
+        dst_volume: &str,
+        dst_path: &str,
+    ) -> Result<RenameDataResp> {
+        match self {
+            Disk::Local(local_disk) => {
+                local_disk
+                    .rename_data_borrowed(src_volume, src_path, fi, dst_volume, dst_path)
+                    .await
+            }
+            Disk::Remote(remote_disk) => {
+                remote_disk
+                    .rename_data_borrowed(src_volume, src_path, fi, dst_volume, dst_path)
+                    .await
+            }
+        }
+    }
+}
+
 impl Disk {
     pub async fn ns_scanner_server_epoch(&self) -> Result<Option<Uuid>> {
         match self {

crates/ecstore/src/disk/os.rs

@@ -306,12 +306,20 @@ fn disk_namespace_mutation_lock(path: &Path) -> Arc<NamespaceMutationLock> {
 pub(crate) struct NamespaceMutationLease {
     _namespace_guard: OwnedMutexGuard<()>,
     _volume_guard: Option<OwnedRwLockReadGuard<()>>,
+    external_guard: Mutex<Option<Arc<dyn Send + Sync>>>,
+}
+
+impl NamespaceMutationLease {
+    pub(crate) fn attach_external_guard(&self, guard: Arc<dyn Send + Sync>) {
+        *self.external_guard.lock() = Some(guard);
+    }
 }
 
 async fn acquire_namespace_mutation_lease(path: &Path) -> Arc<NamespaceMutationLease> {
     Arc::new(NamespaceMutationLease {
         _namespace_guard: disk_namespace_mutation_lock(path).lock_owned().await,
         _volume_guard: None,
+        external_guard: Mutex::new(None),
     })
 }
 
@@ -327,6 +335,7 @@ pub(crate) async fn acquire_rename_data_mutation_lease(
     Arc::new(NamespaceMutationLease {
         _namespace_guard: namespace_guard,
         _volume_guard: Some(volume_guard),
+        external_guard: Mutex::new(None),
     })
 }
 

crates/ecstore/src/erasure/codec/bridge.rs

@@ -26,6 +26,7 @@ pub(crate) const GET_RECONSTRUCT_OUTCOME_SKIP_DATA_COMPLETE: &str = "skip_data_c
 pub(crate) const GET_RECONSTRUCT_OUTCOME_SKIP_EMPTY_PAYLOAD: &str = "skip_empty_payload";
 
 pub(crate) trait DecodeWorkspace: Send + Sync + 'static {
+    #[allow(dead_code, reason = "workspace width asserted by decode_reader tests (backlog#1823)")]
     fn shard_len(&self) -> usize;
 }
 
@@ -33,11 +34,14 @@ pub(crate) trait ErasureDecodeEngine: Send + Sync + 'static {
     type Workspace: DecodeWorkspace;
 
     fn data_shards(&self) -> usize;
+    #[allow(dead_code, reason = "engine trait facet asserted by decode_reader tests (backlog#1823)")]
     fn parity_shards(&self) -> usize;
     fn block_size(&self) -> usize;
     fn engine_name(&self) -> &'static str;
 
+    #[allow(dead_code, reason = "engine trait facet asserted by decode_reader tests (backlog#1823)")]
     fn supports_progressive_decode(&self) -> bool;
+    #[allow(dead_code, reason = "engine trait facet asserted by decode_reader tests (backlog#1823)")]
     fn supports_aligned_shards(&self) -> bool;
 
     fn prepare_workspace(&self, shard_len: usize) -> io::Result<Self::Workspace>;

crates/ecstore/src/erasure/codec/workspace.rs

@@ -24,6 +24,7 @@ impl RustfsCodecDecodeWorkspace {
     }
 
     #[inline]
+    #[allow(dead_code, reason = "workspace width asserted by decode_reader tests (backlog#1823)")]
     pub(crate) fn shard_len(&self) -> usize {
         self.shard_len
     }

crates/ecstore/src/erasure/coding/decode.rs

@@ -213,6 +213,7 @@ fn shard_read_launch_rank(cost: ShardReadCost) -> u8 {
     }
 }
 
+#[allow(dead_code, reason = "launch ordering asserted by this file's tests (backlog#1823)")]
 fn shard_read_launch_order(read_costs: &[ShardReadCost], num_readers: usize, locality_preference_enabled: bool) -> Vec<usize> {
     let mut order: Vec<usize> = (0..num_readers).collect();
     if locality_preference_enabled {
@@ -408,6 +409,10 @@ where
     R: crate::erasure::coding::ShardSource,
 {
     // Readers should handle disk errors before being passed in, ensuring each reader reaches the available number of BitrotReaders
+    #[allow(
+        dead_code,
+        reason = "ParallelReader constructor used only by this file's tests (backlog#1823)"
+    )]
     pub fn new(readers: Vec<Option<BitrotReader<R>>>, e: Erasure, offset: usize, total_length: usize) -> Self {
         Self::new_with_metrics_path_read_timeout_and_reconstruction_verification(
             readers,
@@ -420,6 +425,7 @@ where
         )
     }
 
+    #[allow(dead_code, reason = "constructor used only by this file's tests (backlog#1823)")]
     pub fn new_with_metrics_path(
         readers: Vec<Option<BitrotReader<R>>>,
         e: Erasure,
@@ -438,6 +444,7 @@ where
         )
     }
 
+    #[allow(dead_code, reason = "constructor used only by this file's tests (backlog#1823)")]
     pub fn new_with_metrics_path_and_read_costs(
         readers: Vec<Option<BitrotReader<R>>>,
         e: Erasure,
@@ -514,6 +521,7 @@ where
         )
     }
 
+    #[allow(dead_code, reason = "constructor used only by this file's tests (backlog#1823)")]
     fn new_with_read_timeout(
         readers: Vec<Option<BitrotReader<R>>>,
         e: Erasure,
@@ -1330,10 +1338,6 @@ where
             }
         }
     }
-
-    pub fn can_decode(&self, shards: &[Option<Vec<u8>>]) -> bool {
-        shards.iter().filter(|s| s.is_some()).count() >= self.data_shards
-    }
 }
 
 #[async_trait::async_trait]
@@ -1539,6 +1543,7 @@ impl Erasure {
             .await
     }
 
+    #[allow(dead_code, reason = "read-cost decode path asserted by this file's tests (backlog#1823)")]
     pub(crate) async fn decode_with_read_costs<W, R>(
         &self,
         writer: &mut W,
@@ -1609,9 +1614,9 @@ impl Erasure {
             *ret_err = Some(err.into());
         }
 
-        // Equivalent to `ParallelReader::can_decode`; inlined so this helper does
-        // not need to borrow the reader, leaving the reader free for the
-        // concurrent next-stripe read under prefetch.
+        // Shard-availability check, written out here rather than called on the
+        // reader so this helper does not need to borrow it, leaving the reader
+        // free for the concurrent next-stripe read under prefetch.
         let available_shards = shards.iter().filter(|shard| shard.is_some()).count();
         if available_shards < self.data_shards {
             let reason = GetObjectFailureReason::ReadQuorum;

crates/ecstore/src/erasure/coding/decode_reader.rs

@@ -138,6 +138,10 @@ where
     S: ShardStripeSource + Send + 'static,
     E: ErasureDecodeEngine + Clone + Send + Sync + 'static,
 {
+    #[allow(
+        dead_code,
+        reason = "default-metrics-path constructor used only by this file's tests (backlog#1823)"
+    )]
     pub(crate) fn new(source: S, engine: E, total_length: usize) -> io::Result<Self> {
         Self::new_with_metrics_path(source, engine, total_length, GET_OBJECT_PATH_CODEC_STREAMING)
     }
@@ -679,6 +683,10 @@ pub(crate) struct SyncErasureDecodeReader<R> {
 }
 
 impl<R> SyncErasureDecodeReader<R> {
+    #[allow(
+        dead_code,
+        reason = "default-metrics-path constructor used only by this file's tests (backlog#1823)"
+    )]
     pub(crate) fn new(inner: R) -> Self {
         Self::new_with_metrics_path(inner, GET_OBJECT_PATH_CODEC_STREAMING)
     }
@@ -805,6 +813,7 @@ where
     Ok(true)
 }
 
+#[allow(dead_code, reason = "shard emission asserted by this file's tests (backlog#1823)")]
 fn emit_data_shards(state: &StripeReadState, data_shards: usize, block_size: usize, remaining: usize) -> io::Result<Vec<u8>> {
     let mut output = Vec::new();
     emit_data_shards_into(state, data_shards, block_size, remaining, &mut output)?;

crates/ecstore/src/erasure/coding/encode.rs

@@ -166,6 +166,7 @@ where
     if total == 0 { Ok(None) } else { Ok(Some(total)) }
 }
 
+#[allow(dead_code, reason = "byte accounting asserted by this file's tests (backlog#1823)")]
 fn queued_block_bytes(block: &[Bytes]) -> usize {
     block.iter().map(Bytes::len).sum()
 }

crates/ecstore/src/erasure/coding/erasure.rs

@@ -71,10 +71,16 @@ impl EncodedBlock {
 
 const MODERN_MAX_TOTAL_SHARDS: usize = <reed_solomon_erasure::galois_8::Field as reed_solomon_erasure::Field>::ORDER;
 const MODERN_REED_SOLOMON_CACHE_MAX_ENTRIES: usize = 64;
+const LEGACY_REED_SOLOMON_CACHE_MAX_ENTRIES: usize = 16;
+// Vec growth may retain twice the requested logical length. Keeping the logical
+// workspace at half the budget bounds each cached workspace's shard allocation to 1 MiB.
+const LEGACY_REED_SOLOMON_CACHE_MAX_LOGICAL_SHARD_BYTES_PER_WORKSPACE: usize = 512 * 1024;
 
 type ModernReedSolomonCache = RwLock<HashMap<(usize, usize), Arc<ReedSolomon>>>;
+type LegacyReedSolomonCache = RwLock<HashMap<(usize, usize), Arc<LegacyReedSolomonEncoder>>>;
 
 static MODERN_REED_SOLOMON_CACHE: OnceLock<ModernReedSolomonCache> = OnceLock::new();
+static LEGACY_REED_SOLOMON_CACHE: OnceLock<LegacyReedSolomonCache> = OnceLock::new();
 
 /// Errors returned when constructing an [`Erasure`] codec.
 #[derive(Debug, thiserror::Error)]
@@ -141,43 +147,61 @@ pub fn calc_shard_size_legacy(block_size: usize, data_shards: usize) -> usize {
 struct LegacyReedSolomonEncoder {
     data_shards: usize,
     parity_shards: usize,
-    encoder_cache: std::sync::RwLock<Option<reed_solomon_simd::ReedSolomonEncoder>>,
-    decoder_cache: std::sync::RwLock<Option<reed_solomon_simd::ReedSolomonDecoder>>,
-}
-
-impl Clone for LegacyReedSolomonEncoder {
-    fn clone(&self) -> Self {
-        Self {
-            data_shards: self.data_shards,
-            parity_shards: self.parity_shards,
-            encoder_cache: std::sync::RwLock::new(None),
-            decoder_cache: std::sync::RwLock::new(None),
-        }
-    }
+    cache_workspaces: bool,
+    encoder_cache: RwLock<Option<reed_solomon_simd::ReedSolomonEncoder>>,
+    decoder_cache: RwLock<Option<reed_solomon_simd::ReedSolomonDecoder>>,
 }
 
 impl LegacyReedSolomonEncoder {
-    fn new(_data_shards: usize, _parity_shards: usize) -> io::Result<Self> {
+    fn new(data_shards: usize, parity_shards: usize) -> io::Result<Self> {
+        Self::with_workspace_cache(data_shards, parity_shards, false)
+    }
+
+    fn with_workspace_cache(data_shards: usize, parity_shards: usize, cache_workspaces: bool) -> io::Result<Self> {
         Ok(Self {
-            data_shards: _data_shards,
-            parity_shards: _parity_shards,
-            encoder_cache: std::sync::RwLock::new(None),
-            decoder_cache: std::sync::RwLock::new(None),
+            data_shards,
+            parity_shards,
+            cache_workspaces,
+            encoder_cache: RwLock::new(None),
+            decoder_cache: RwLock::new(None),
         })
     }
 
+    fn logical_shard_bytes_upper_bound(&self, shard_len: usize) -> Option<usize> {
+        let aligned_shard_len = shard_len.checked_add(63)?.checked_div(64)?.checked_mul(64)?;
+        let high_rate_decoder_work_count = self
+            .parity_shards
+            .checked_next_power_of_two()?
+            .checked_add(self.data_shards)?
+            .checked_next_power_of_two()?;
+        let low_rate_decoder_work_count = self
+            .data_shards
+            .checked_next_power_of_two()?
+            .checked_add(self.parity_shards)?
+            .checked_next_power_of_two()?;
+        aligned_shard_len.checked_mul(high_rate_decoder_work_count.max(low_rate_decoder_work_count))
+    }
+
+    fn should_cache_workspace(&self, shard_len: usize) -> bool {
+        self.cache_workspaces
+            && self
+                .logical_shard_bytes_upper_bound(shard_len)
+                .is_some_and(|bytes| bytes <= LEGACY_REED_SOLOMON_CACHE_MAX_LOGICAL_SHARD_BYTES_PER_WORKSPACE)
+    }
+
     fn encode(&self, shards: SmallVec<[&mut [u8]; 16]>) -> io::Result<()> {
         let mut shards_vec: Vec<&mut [u8]> = shards.into_vec();
         if shards_vec.is_empty() {
             return Ok(());
         }
         let shard_len = shards_vec[0].len();
+        let cached_encoder = self
+            .encoder_cache
+            .write()
+            .map_err(|_| io::Error::other("Failed to acquire encoder cache lock"))?
+            .take();
         let mut encoder = {
-            let mut cache_guard = self
-                .encoder_cache
-                .write()
-                .map_err(|_| io::Error::other("Failed to acquire encoder cache lock"))?;
-            match cache_guard.take() {
+            match cached_encoder {
                 Some(mut cached) => {
                     if cached.reset(self.data_shards, self.parity_shards, shard_len).is_err() {
                         reed_solomon_simd::ReedSolomonEncoder::new(self.data_shards, self.parity_shards, shard_len)
@@ -204,10 +228,15 @@ impl LegacyReedSolomonEncoder {
             }
         }
         drop(result);
-        *self
-            .encoder_cache
-            .write()
-            .map_err(|_| io::Error::other("Failed to return encoder to cache"))? = Some(encoder);
+        if self.should_cache_workspace(shard_len) {
+            let mut cache = self
+                .encoder_cache
+                .write()
+                .map_err(|_| io::Error::other("Failed to return encoder to cache"))?;
+            if cache.is_none() {
+                *cache = Some(encoder);
+            }
+        }
         Ok(())
     }
 
@@ -221,13 +250,13 @@ impl LegacyReedSolomonEncoder {
             .find_map(|s| s.as_ref().map(|v| v.len()))
             .ok_or_else(|| io::Error::other("No valid shards found for reconstruction"))?;
 
+        let cached_decoder = self
+            .decoder_cache
+            .write()
+            .map_err(|_| io::Error::other("Failed to acquire decoder cache lock"))?
+            .take();
         let mut decoder = {
-            let mut cache_guard = self
-                .decoder_cache
-                .write()
-                .map_err(|_| io::Error::other("Failed to acquire decoder cache lock"))?;
-
-            match cache_guard.take() {
+            match cached_decoder {
                 Some(mut cached_decoder) => {
                     if let Err(e) = cached_decoder.reset(self.data_shards, self.parity_shards, shard_len) {
                         warn!("Failed to reset SIMD decoder: {:?}, creating new one", e);
@@ -274,10 +303,15 @@ impl LegacyReedSolomonEncoder {
 
         drop(result);
 
-        *self
-            .decoder_cache
-            .write()
-            .map_err(|_| io::Error::other("Failed to return decoder to cache"))? = Some(decoder);
+        if self.should_cache_workspace(shard_len) {
+            let mut cache = self
+                .decoder_cache
+                .write()
+                .map_err(|_| io::Error::other("Failed to return decoder to cache"))?;
+            if cache.is_none() {
+                *cache = Some(decoder);
+            }
+        }
 
         Ok(())
     }
@@ -435,6 +469,39 @@ fn cached_modern_reed_solomon(data_shards: usize, parity_shards: usize) -> Resul
     Ok(encoder)
 }
 
+fn cached_legacy_reed_solomon(data_shards: usize, parity_shards: usize) -> io::Result<Arc<LegacyReedSolomonEncoder>> {
+    let cache = LEGACY_REED_SOLOMON_CACHE.get_or_init(|| RwLock::new(HashMap::new()));
+    cached_legacy_reed_solomon_in(cache, data_shards, parity_shards)
+}
+
+fn cached_legacy_reed_solomon_in(
+    cache: &LegacyReedSolomonCache,
+    data_shards: usize,
+    parity_shards: usize,
+) -> io::Result<Arc<LegacyReedSolomonEncoder>> {
+    let key = (data_shards, parity_shards);
+    if let Some(encoder) = cache
+        .read()
+        .unwrap_or_else(|poisoned| poisoned.into_inner())
+        .get(&key)
+        .cloned()
+    {
+        return Ok(encoder);
+    }
+
+    let mut cache = cache.write().unwrap_or_else(|poisoned| poisoned.into_inner());
+    if let Some(existing) = cache.get(&key) {
+        return Ok(Arc::clone(existing));
+    }
+    if cache.len() < LEGACY_REED_SOLOMON_CACHE_MAX_ENTRIES {
+        let encoder = Arc::new(LegacyReedSolomonEncoder::with_workspace_cache(data_shards, parity_shards, true)?);
+        cache.insert(key, Arc::clone(&encoder));
+        return Ok(encoder);
+    }
+    drop(cache);
+    Ok(Arc::new(LegacyReedSolomonEncoder::new(data_shards, parity_shards)?))
+}
+
 fn encode_parity_shards<F>(shards: &mut [Option<Vec<u8>>], data_shards: usize, parity_shards: usize, encode: F) -> io::Result<()>
 where
     F: FnOnce(SmallVec<[&mut [u8]; 16]>) -> io::Result<()>,
@@ -551,7 +618,7 @@ pub struct Erasure {
     pub data_shards: usize,
     pub parity_shards: usize,
     encoder: Option<ReedSolomonEncoder>,
-    legacy_encoder: Option<LegacyReedSolomonEncoder>,
+    legacy_encoder: Option<Arc<LegacyReedSolomonEncoder>>,
     pub block_size: usize,
     uses_legacy: bool,
     _id: Uuid,
@@ -687,7 +754,7 @@ impl Erasure {
 
         let legacy_encoder = if uses_legacy && parity_shards > 0 {
             Some(
-                LegacyReedSolomonEncoder::new(data_shards, parity_shards)
+                cached_legacy_reed_solomon(data_shards, parity_shards)
                     .map_err(|source| ErasureConstructionError::LegacyEncoder { source })?,
             )
         } else {
@@ -1043,6 +1110,10 @@ impl Erasure {
     ///
     /// # Errors
     /// Returns error if reading from reader fails or if callback returns error
+    #[allow(
+        dead_code,
+        reason = "callback encode path exercised only by this file's tests (backlog#1823)"
+    )]
     pub(crate) async fn encode_stream_callback_async<F, Fut, E, R>(
         self: std::sync::Arc<Self>,
         reader: &mut R,
@@ -1405,7 +1476,7 @@ mod tests {
         assert_eq!(cloned.block_size, legacy.block_size);
         assert!(cloned.uses_legacy);
 
-        let data = b"legacy clone should keep independent SIMD caches";
+        let data = b"legacy clone should preserve SIMD codec behavior";
         let encoded = cloned.encode_data(data).expect("legacy clone should encode");
         let mut shards = optional_shards(&encoded);
         shards[0] = None;
@@ -1413,6 +1484,93 @@ mod tests {
         assert_eq!(recover_data(&shards, cloned.data_shards, data.len()), data);
     }
 
+    #[test]
+    fn legacy_codecs_share_process_cache_across_erasure_instances() {
+        let first = Erasure::new_with_options(6, 3, 64, true)
+            .legacy_encoder
+            .expect("legacy codec should be initialized");
+        let second = Erasure::new_with_options(6, 3, 128, true)
+            .legacy_encoder
+            .expect("same legacy shard layout should be initialized");
+
+        assert!(Arc::ptr_eq(&first, &second));
+    }
+
+    #[test]
+    fn legacy_workspace_cache_rejects_oversize_buffers_and_isolates_layouts() {
+        let four_plus_two = Erasure::new_with_options(4, 2, 64, true)
+            .legacy_encoder
+            .expect("legacy codec should be initialized");
+        let four_plus_one = Erasure::new_with_options(4, 1, 64, true)
+            .legacy_encoder
+            .expect("distinct parity layout should be initialized");
+        let three_plus_two = Erasure::new_with_options(3, 2, 64, true)
+            .legacy_encoder
+            .expect("distinct data layout should be initialized");
+
+        assert!(!Arc::ptr_eq(&four_plus_two, &four_plus_one));
+        assert!(!Arc::ptr_eq(&four_plus_two, &three_plus_two));
+        assert_eq!(four_plus_two.logical_shard_bytes_upper_bound(64 * 1024), Some(512 * 1024));
+        assert!(four_plus_two.should_cache_workspace(64 * 1024));
+        assert!(!four_plus_two.should_cache_workspace(64 * 1024 + 1));
+
+        let nine_plus_seven =
+            LegacyReedSolomonEncoder::with_workspace_cache(9, 7, true).expect("9+7 legacy codec should construct");
+        assert_eq!(nine_plus_seven.logical_shard_bytes_upper_bound(16 * 1024), Some(512 * 1024));
+        assert!(nine_plus_seven.should_cache_workspace(16 * 1024));
+        assert!(!nine_plus_seven.should_cache_workspace(16 * 1024 + 1));
+
+        let uncached = LegacyReedSolomonEncoder::new(4, 2).expect("uncached legacy codec should construct");
+        assert!(!uncached.should_cache_workspace(64));
+    }
+
+    #[test]
+    fn saturated_legacy_codec_cache_does_not_retain_more_workspaces() {
+        let cache = RwLock::new(HashMap::new());
+        for parity_shards in 1..=LEGACY_REED_SOLOMON_CACHE_MAX_ENTRIES {
+            let cached =
+                cached_legacy_reed_solomon_in(&cache, 32, parity_shards).expect("cacheable legacy codec should construct");
+            assert!(cached.cache_workspaces);
+        }
+
+        let uncached =
+            cached_legacy_reed_solomon_in(&cache, 31, 1).expect("uncached legacy codec should construct after saturation");
+        assert!(!uncached.cache_workspaces);
+        assert_eq!(
+            cache.read().expect("cache lock should remain healthy").len(),
+            LEGACY_REED_SOLOMON_CACHE_MAX_ENTRIES
+        );
+    }
+
+    #[test]
+    fn concurrent_legacy_codecs_preserve_byte_exact_results() {
+        let barrier = Arc::new(std::sync::Barrier::new(2));
+        let payloads = [vec![0x35; 257], vec![0xca; 1025]];
+
+        std::thread::scope(|scope| {
+            let handles = payloads.each_ref().map(|payload| {
+                let barrier = Arc::clone(&barrier);
+                scope.spawn(move || {
+                    let erasure = Erasure::new_with_options(6, 3, 2048, true);
+                    barrier.wait();
+                    let encoded = erasure.encode_data(payload).expect("concurrent legacy encode should succeed");
+                    barrier.wait();
+
+                    let mut shards = optional_shards(&encoded);
+                    shards[0] = None;
+                    erasure
+                        .decode_data(&mut shards)
+                        .expect("concurrent legacy decode should reconstruct the missing shard");
+                    recover_data(&shards, erasure.data_shards, payload.len())
+                })
+            });
+
+            for (handle, payload) in handles.into_iter().zip(payloads.iter()) {
+                assert_eq!(handle.join().expect("concurrent legacy codec worker should not panic"), *payload);
+            }
+        });
+    }
+
     #[test]
     fn legacy_verify_reports_invalid_empty_valid_and_corrupt_parity_sets() {
         let legacy = LegacyReedSolomonEncoder::new(2, 2).expect("legacy encoder should construct");

crates/ecstore/src/erasure/mod.rs

@@ -13,7 +13,6 @@
 // limitations under the License.
 
 // #730: erasure codec migration keeps staged streaming decode paths in this module.
-#![allow(dead_code)]
 
 pub(crate) mod codec;
 pub(crate) mod coding;

crates/ecstore/src/error/mod.rs

@@ -13,13 +13,12 @@
 // limitations under the License.
 
 // #730: error taxonomy still exposes compatibility variants while callers move to contracts.
-#![allow(dead_code)]
 
 use crate::bucket::error::BucketMetadataError;
 use crate::disk::error::DiskError;
 use crate::storage_api_contracts::{error::StorageErrorCode, range::HTTPRangeError};
 use rustfs_utils::path::decode_dir_object;
-use s3s::{S3Error, S3ErrorCode};
+use s3s::S3ErrorCode;
 
 pub type Error = StorageError;
 pub type Result<T> = core::result::Result<T, Error>;
@@ -902,6 +901,7 @@ pub fn is_err_decommission_running(err: &Error) -> bool {
     matches!(err, &StorageError::DecommissionAlreadyRunning)
 }
 
+#[allow(dead_code, reason = "predicate asserted by this file's tests (backlog#1823)")]
 pub fn is_err_rebalance_running(err: &Error) -> bool {
     matches!(err, &StorageError::RebalanceAlreadyRunning)
 }
@@ -910,14 +910,11 @@ pub fn is_err_operation_canceled(err: &Error) -> bool {
     matches!(err, &StorageError::OperationCanceled)
 }
 
+#[allow(dead_code, reason = "predicate asserted by this file's tests (backlog#1823)")]
 pub fn is_err_not_initialized(err: &Error) -> bool {
     err.to_string().contains("errServerNotInitialized") || err.to_string().contains("ServerNotInitialized")
 }
 
-pub fn is_err_io(err: &Error) -> bool {
-    matches!(err, &StorageError::Io(_))
-}
-
 /// Strict "not found" predicate that only matches genuine object/version/volume
 /// absence errors: `FileNotFound`/`VolumeNotFound`/`FileVersionNotFound`/
 /// `ObjectNotFound`/`VersionNotFound`.
@@ -1078,21 +1075,6 @@ pub struct GenericError {
 
 #[derive(Debug, thiserror::Error, PartialEq, Eq)]
 pub enum ObjectApiError {
-    #[error("Operation timed out")]
-    OperationTimedOut,
-
-    #[error("etag of the object has changed")]
-    InvalidETag,
-
-    #[error("BackendDown")]
-    BackendDown(String),
-
-    #[error("Unsupported headers in Metadata")]
-    UnsupportedMetadata,
-
-    #[error("Method not allowed: {}/{}", .0.bucket, .0.object)]
-    MethodNotAllowed(GenericError),
-
     #[error("The operation is not valid for the current state of the object {}/{}({})", .0.bucket, .0.object, .0.version_id)]
     InvalidObjectState(GenericError),
 }
@@ -1109,96 +1091,6 @@ pub struct ErrorResponse {
     pub host_id: String,
 }
 
-pub fn error_resp_to_object_err(err: ErrorResponse, params: Vec<&str>) -> std::io::Error {
-    let mut bucket = "";
-    let mut object = "";
-    let mut version_id = "";
-    if !params.is_empty() {
-        bucket = params[0];
-    }
-    if params.len() >= 2 {
-        object = params[1];
-    }
-    if params.len() >= 3 {
-        version_id = params[2];
-    }
-
-    if is_network_or_host_down(&err.to_string(), false) {
-        return std::io::Error::other(ObjectApiError::BackendDown(format!("{err}")));
-    }
-
-    let err_ = std::io::Error::other(err.to_string());
-    let r_err = err;
-    let err;
-    let bucket = bucket.to_string();
-    let object = object.to_string();
-    let version_id = version_id.to_string();
-
-    match r_err.code {
-        S3ErrorCode::BucketNotEmpty => {
-            err = std::io::Error::other(StorageError::BucketNotEmpty("".to_string()).to_string());
-        }
-        S3ErrorCode::InvalidBucketName => {
-            err = std::io::Error::other(StorageError::BucketNameInvalid(bucket));
-        }
-        S3ErrorCode::InvalidPart => {
-            err = std::io::Error::other(StorageError::InvalidPart(0, bucket, object /* , version_id */));
-        }
-        S3ErrorCode::NoSuchBucket => {
-            err = std::io::Error::other(StorageError::BucketNotFound(bucket));
-        }
-        S3ErrorCode::NoSuchKey => {
-            if !object.is_empty() {
-                err = std::io::Error::other(StorageError::ObjectNotFound(bucket, object));
-            } else {
-                err = std::io::Error::other(StorageError::BucketNotFound(bucket));
-            }
-        }
-        S3ErrorCode::NoSuchVersion => {
-            if !object.is_empty() {
-                err = std::io::Error::other(StorageError::ObjectNotFound(bucket, object)); //, version_id);
-            } else {
-                err = std::io::Error::other(StorageError::BucketNotFound(bucket));
-            }
-        }
-        S3ErrorCode::AccessDenied => {
-            err = std::io::Error::other(StorageError::PrefixAccessDenied(bucket, object));
-        }
-        S3ErrorCode::NoSuchUpload => {
-            err = std::io::Error::other(StorageError::InvalidUploadID(bucket, object, version_id));
-        }
-        _ => {
-            err = err_;
-        }
-    }
-
-    err
-}
-
-pub fn storage_to_object_err(err: Error, params: Vec<&str>) -> S3Error {
-    let storage_err = &err;
-    let mut bucket: String = "".to_string();
-    let mut object: String = "".to_string();
-    if !params.is_empty() {
-        bucket = params[0].to_string();
-    }
-    if params.len() >= 2 {
-        object = decode_dir_object(params[1]);
-    }
-    match storage_err {
-        StorageError::MethodNotAllowed => S3Error::with_message(
-            S3ErrorCode::MethodNotAllowed,
-            ObjectApiError::MethodNotAllowed(GenericError {
-                bucket,
-                object,
-                ..Default::default()
-            })
-            .to_string(),
-        ),
-        _ => s3s::S3Error::with_message(S3ErrorCode::Custom("err".into()), err.to_string()),
-    }
-}
-
 #[cfg(test)]
 mod tests {
     use super::*;

crates/ecstore/src/event/mod.rs

@@ -13,8 +13,6 @@
 // limitations under the License.
 
 // #730: event target types are retained for notification owner migration.
-#![allow(dead_code)]
 
 pub mod name;
-pub mod targetid;
 pub mod targetlist;

crates/ecstore/src/event/targetid.rs

@@ -1,25 +0,0 @@
-#![allow(clippy::all)]
-// Copyright 2024 RustFS Team
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-pub struct TargetID {
-    id: String,
-    name: String,
-}
-
-impl TargetID {
-    fn to_string(&self) -> String {
-        format!("{}:{}", self.id, self.name)
-    }
-}

crates/ecstore/src/event/targetlist.rs

@@ -12,18 +12,20 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
-use crate::event::targetid::TargetID;
 use std::sync::atomic::AtomicI64;
 
+/// Placeholder notification target list held by `EventNotifier`.
+///
+/// The working notification stack lives in `rustfs-notify` / `rustfs-targets`;
+/// this type never grew past its counter. `total_events` is read by the
+/// notifier's log line but nothing increments it, so that field reports zero.
 #[derive(Default)]
+#[allow(
+    dead_code,
+    reason = "held only by the dead ecstore EventNotifier; see services/event_notification.rs (backlog#1823)"
+)]
 pub struct TargetList {
-    pub current_send_calls: AtomicI64,
     pub total_events: AtomicI64,
-    pub events_skipped: AtomicI64,
-    pub events_errors_total: AtomicI64,
-    //pub targets: HashMap<TargetID, Target>,
-    //pub queue:   AsyncEvent,
-    //pub targetStats: HashMap<TargetID, TargetStat>,
 }
 
 impl TargetList {
@@ -31,14 +33,3 @@ impl TargetList {
         TargetList::default()
     }
 }
-
-struct TargetStat {
-    current_send_calls: i64,
-    total_events: i64,
-    failed_events: i64,
-}
-
-struct TargetIDResult {
-    id: TargetID,
-    err: std::io::Error,
-}

crates/ecstore/src/io_support/compress.rs

@@ -31,6 +31,13 @@ pub const ENV_DISK_COMPRESSION_MIME_TYPES: &str = "RUSTFS_COMPRESSION_MIME_TYPES
 // Environment variable for additional extensions to exclude from compression (comma-separated, e.g. ".foo,.bar")
 pub const ENV_ADDED_EXCLUDE_COMPRESS_EXTENSIONS: &str = "RUSTFS_ADDED_EXCLUDE_COMPRESS_EXTENSIONS";
 
+// Environment variable to additionally enable disk compression for multipart uploads.
+// Default off: nodes from before the resumable decompressor fix fail transient reads of
+// compressed objects, so multipart compression stays dark until the operator confirms the
+// fleet has converged on a fixed build.
+// RUSTFS_COMPAT_TODO(multipart-compression-default-off-window): staged rollout switch for restored multipart compression, flipping the default to enabled on retirement. Remove after the minimum supported direct-upgrade release ships the resumable DecompressReader.
+pub const ENV_DISK_COMPRESSION_MULTIPART_ENABLED: &str = "RUSTFS_COMPRESSION_MULTIPART_ENABLED";
+
 pub const DEFAULT_DISK_COMPRESS_EXTENSIONS: &str = ".txt,.log,.csv,.json,.tar,.xml,.bin";
 pub const DEFAULT_DISK_COMPRESS_MIME_TYPES: &str = "text/*,application/json,application/xml,binary/octet-stream";
 
@@ -171,6 +178,21 @@ pub fn is_disk_compression_enabled() -> bool {
     DISK_COMPRESSION_CONFIG.get_or_init(parse_disk_compression_config).enabled
 }
 
+// Parsed once at first use, mirroring DISK_COMPRESSION_CONFIG.
+static MULTIPART_DISK_COMPRESSION_ENABLED: OnceLock<bool> = OnceLock::new();
+
+/// Whether multipart uploads may advertise disk compression. Requires the
+/// regular disk-compression gates to pass as well; this is the staged-rollout
+/// switch that keeps multipart compression dark during rolling upgrades from
+/// builds whose decompressor was not yet resumable.
+pub fn is_multipart_disk_compression_enabled() -> bool {
+    *MULTIPART_DISK_COMPRESSION_ENABLED.get_or_init(|| {
+        env::var(ENV_DISK_COMPRESSION_MULTIPART_ENABLED)
+            .map(|s| matches!(s.to_ascii_lowercase().as_str(), "true" | "on" | "1"))
+            .unwrap_or(false)
+    })
+}
+
 fn is_disk_compressible_with_config(headers: &http::HeaderMap, object_name: &str, config: &DiskCompressionConfig) -> bool {
     // Check if disk compression is enabled (read once at first use, then fixed for process lifetime)
     if !config.enabled {

crates/ecstore/src/io_support/mod.rs

@@ -13,7 +13,6 @@
 // limitations under the License.
 
 // #730: I/O backend selection keeps test-only and staged rio helpers scoped here.
-#![allow(dead_code)]
 
 pub(crate) mod bitrot;
 pub(crate) mod compress;

crates/ecstore/src/io_support/rio.rs

@@ -25,9 +25,20 @@ use tokio::io::AsyncRead;
 
 #[cfg(feature = "rio-v2")]
 const MINIO_S2_COMPRESSION_SCHEME: &str = "klauspost/compress/s2";
+// The S2 padding multiple rio-v2 pads compressed streams to before
+// encryption. Only the padding test asserts it today, so the lib target sees
+// it as unused (backlog#1823).
 #[cfg(feature = "rio-v2")]
+#[allow(dead_code, reason = "on-disk contract asserted by the rio-v2 padding test (backlog#1823)")]
 const ENCRYPTED_S2_PADDING_MULTIPLE: usize = 256;
 
+/// Which rio implementation this build compiled in. Only the feature-seam
+/// guard test in lib.rs reads it, so the lib target sees it as unused
+/// (backlog#1823).
+#[allow(
+    dead_code,
+    reason = "asserted by the rio backend feature-seam test in lib.rs (backlog#1823)"
+)]
 pub const fn backend_name() -> &'static str {
     #[cfg(feature = "rio-v2")]
     {
@@ -53,17 +64,6 @@ pub fn compression_metadata_value(algorithm: CompressionAlgorithm) -> String {
     }
 }
 
-pub fn compression_scheme_to_algorithm(scheme: &str) -> std::io::Result<CompressionAlgorithm> {
-    #[cfg(feature = "rio-v2")]
-    if scheme.eq_ignore_ascii_case(MINIO_S2_COMPRESSION_SCHEME) {
-        // rio_v2 currently routes all compressed-object handling through the S2
-        // reader implementation, so the enum is only a placeholder token here.
-        return Ok(CompressionAlgorithm::default());
-    }
-
-    CompressionAlgorithm::from_str(scheme)
-}
-
 #[derive(Debug, Clone, Copy, PartialEq, Eq)]
 pub enum ReadCompressionBackend {
     Legacy,
@@ -82,6 +82,11 @@ pub fn compression_scheme_to_read_plan(scheme: &str) -> std::io::Result<(Compres
 #[derive(Debug, Clone, Copy, PartialEq, Eq)]
 pub enum ReadEncryptionBackend {
     Legacy,
+    // Never constructed today — every read still selects Legacy — but the
+    // decrypt paths below carry live match arms for it. This is the rio-v2
+    // read seam (backlog#1638 / #1835), not dead code: deleting the variant
+    // would delete those arms with it.
+    #[allow(dead_code, reason = "rio-v2 read seam; match arms below are live (backlog#1823)")]
     V2,
 }
 

crates/ecstore/src/layout/endpoints.rs

@@ -209,15 +209,12 @@ impl AsMut<Vec<Endpoints>> for PoolEndpointList {
 }
 
 impl PoolEndpointList {
-    /// creates a list of endpoints per pool, resolves their relevant
-    /// hostnames and discovers those are local or remote.
-    async fn create_pool_endpoints(server_addr: &str, disks_layout: &DisksLayout) -> Result<Self> {
-        Self::create_pool_endpoints_with(server_addr, disks_layout, None, None).await
-    }
-
-    /// Same as [`create_pool_endpoints`] but lets tests inject an explicit
-    /// startup topology convergence policy and local endpoint host instead of
-    /// resolving them from the environment.
+    /// Creates a list of endpoints per pool, resolves their relevant hostnames
+    /// and discovers whether those are local or remote.
+    ///
+    /// The policy and host overrides let tests inject an explicit startup
+    /// topology convergence policy and local endpoint host instead of
+    /// resolving them from the environment; production passes `None` for both.
     async fn create_pool_endpoints_with(
         server_addr: &str,
         disks_layout: &DisksLayout,
@@ -594,6 +591,10 @@ impl PoolEndpointList {
 }
 
 const DNS_RETRY_BASE_DELAY: Duration = Duration::from_millis(500);
+#[allow(
+    dead_code,
+    reason = "retry-cap bound asserted by this file's dns_retry_delay tests (backlog#1823)"
+)]
 const DNS_RETRY_MAX_DELAY: Duration = Duration::from_secs(8);
 const DNS_RETRY_JITTER_PERCENT: u64 = 20;
 /// Minimum spacing between "still retrying" warnings so a long orchestrated

crates/ecstore/src/layout/mod.rs

@@ -13,7 +13,6 @@
 // limitations under the License.
 
 // #730: set-layout contracts are staged while ECStore ownership boundaries shrink.
-#![allow(dead_code)]
 
 //! Static ECStore layout boundaries.
 //!

crates/ecstore/src/layout/set_layout.rs

@@ -4,6 +4,7 @@ use std::io::{Error, Result};
 use uuid::Uuid;
 
 #[derive(Debug, Clone, PartialEq, Eq)]
+#[allow(dead_code, reason = "ESET-001 layout model; exercised by this file's tests (backlog#1823)")]
 pub(crate) struct StaticSetLayoutSnapshot {
     pub(crate) deployment_id: Uuid,
     pub(crate) set_count: usize,
@@ -12,6 +13,7 @@ pub(crate) struct StaticSetLayoutSnapshot {
     pub(crate) distribution_algo: DistributionAlgoVersion,
 }
 
+#[allow(dead_code, reason = "ESET-001 layout model; exercised by this file's tests (backlog#1823)")]
 impl StaticSetLayoutSnapshot {
     pub(crate) fn from_format(format: &FormatV3) -> Self {
         let disk_ids = format.erasure.sets.clone();
@@ -39,17 +41,20 @@ impl StaticSetLayoutSnapshot {
 }
 
 #[derive(Debug, Clone, Copy, PartialEq, Eq)]
+#[allow(dead_code, reason = "ESET-001 layout model; exercised by this file's tests (backlog#1823)")]
 pub(crate) struct SetDiskPosition {
     pub(crate) set_index: usize,
     pub(crate) disk_index: usize,
 }
 
 #[derive(Debug, Clone, PartialEq, Eq)]
+#[allow(dead_code, reason = "ESET-001 layout model; exercised by this file's tests (backlog#1823)")]
 pub(crate) struct RuntimeSetLayoutPlan {
     pub(crate) sets: Vec<Vec<RuntimeSetDrivePlan>>,
     lock_hosts_by_set: Vec<Vec<String>>,
 }
 
+#[allow(dead_code, reason = "ESET-001 layout model; exercised by this file's tests (backlog#1823)")]
 impl RuntimeSetLayoutPlan {
     pub(crate) fn from_endpoint_hosts<S>(set_count: usize, drives_per_set: usize, endpoint_hosts: &[S]) -> Result<Self>
     where
@@ -108,6 +113,7 @@ impl RuntimeSetLayoutPlan {
 }
 
 #[derive(Debug, Clone, PartialEq, Eq)]
+#[allow(dead_code, reason = "ESET-001 layout model; exercised by this file's tests (backlog#1823)")]
 pub(crate) struct RuntimeSetDrivePlan {
     pub(crate) set_index: usize,
     pub(crate) disk_index: usize,

crates/ecstore/src/object_api/mod.rs

@@ -13,7 +13,6 @@
 // limitations under the License.
 
 // #730: object API readers keep staged compatibility paths during facade migration.
-#![allow(dead_code)]
 
 use crate::bucket::metadata_sys::get_versioning_config;
 use crate::bucket::replication::{
@@ -23,7 +22,7 @@ use crate::bucket::replication::{
 use crate::bucket::versioning::VersioningApi as _;
 use crate::config::storageclass;
 use crate::error::{Error, Result};
-use crate::io_support::rio::{HashReader, LimitReader};
+use crate::io_support::rio::{HardLimitReader, HashReader};
 use crate::storage_api_contracts::{
     lifecycle::{ExpirationOptions, TransitionedObject},
     range::HTTPRangeSpec,

crates/ecstore/src/object_api/readers.rs

@@ -15,6 +15,7 @@
 use super::*;
 
 use crate::io_support::rio::Index;
+use std::mem::MaybeUninit;
 
 #[cfg(feature = "rio-v2")]
 const DARE_PAYLOAD_SIZE: i64 = 64 * 1024;
@@ -448,10 +449,16 @@ impl GetObjectReader {
 }
 
 enum ReadTransform {
-    Plain {
-        visible_offset: usize,
-        visible_length: i64,
-    },
+    // Written but never read by production code: the enclosing struct already
+    // carries the same pair as `storage_offset`/`storage_length`. They survive
+    // as the read plan's test-visible record — four tests assert them by
+    // literal pattern (`Plain { visible_offset: 6, visible_length: 4 }`), which
+    // rustc does not count as a read.
+    #[allow(
+        dead_code,
+        reason = "asserted by literal pattern in this file's read-plan tests (backlog#1823)"
+    )]
+    Plain { visible_offset: usize, visible_length: i64 },
     Compressed {
         algorithm: CompressionAlgorithm,
         backend: crate::io_support::rio::ReadCompressionBackend,
@@ -472,7 +479,15 @@ enum ReadTransform {
     },
 }
 
-struct ReadPlan {
+/// How an object's stored bytes must be fetched and transformed to serve a
+/// request.
+///
+/// Public so callers that fetch the stored bytes from somewhere other than the
+/// local erasure set — the remote-tier read path — can position their own fetch
+/// with [`ReadPlan::storage_offset`] / [`ReadPlan::storage_length`] and then
+/// hand the resulting stream to [`ReadPlan::into_object_reader`], instead of
+/// reimplementing the transform decisions (rustfs/rustfs#6025).
+pub struct ReadPlan {
     storage_offset: usize,
     storage_length: i64,
     object_size: i64,
@@ -480,6 +495,43 @@ struct ReadPlan {
 }
 
 impl ReadPlan {
+    /// Byte offset into the object's **stored** bytes where the fetch must
+    /// start. Encrypted and compressed objects address their storage in a
+    /// different coordinate system than the plaintext range the caller asked
+    /// for, which is exactly the distinction this plan resolves.
+    pub fn storage_offset(&self) -> usize {
+        self.storage_offset
+    }
+
+    /// Number of **stored** bytes the fetch must deliver, in the same
+    /// coordinate system as [`Self::storage_offset`].
+    pub fn storage_length(&self) -> i64 {
+        self.storage_length
+    }
+
+    /// Build the plan for a request without consuming a stream, so a caller
+    /// that has to issue its own positioned fetch can read the offsets first.
+    pub async fn build_for_request(
+        rs: Option<HTTPRangeSpec>,
+        oi: &ObjectInfo,
+        opts: &ObjectOptions,
+        h: &HeaderMap<HeaderValue>,
+        resolver: Option<&dyn ObjectEncryptionResolver>,
+    ) -> Result<Self> {
+        Self::build_with_resolver(rs, oi, opts, h, resolver).await
+    }
+
+    /// Wrap `reader` — the stored bytes this plan asked for, already positioned
+    /// at [`Self::storage_offset`] — in the transforms that turn them into the
+    /// bytes the caller requested.
+    pub fn into_object_reader(
+        self,
+        reader: Box<dyn AsyncRead + Unpin + Send + Sync>,
+        oi: &ObjectInfo,
+    ) -> Result<GetObjectReader> {
+        self.into_reader(reader, oi).map(|(reader, _, _)| reader)
+    }
+
     #[cfg(test)]
     async fn build(rs: Option<HTTPRangeSpec>, oi: &ObjectInfo, opts: &ObjectOptions, h: &HeaderMap<HeaderValue>) -> Result<Self> {
         Self::build_with_resolver(rs, oi, opts, h, Some(&tests::TEST_RESOLVER)).await
@@ -493,8 +545,17 @@ impl ReadPlan {
         resolver: Option<&dyn ObjectEncryptionResolver>,
     ) -> Result<Self> {
         let mut rs = rs;
+        // A part number addresses the object's PLAINTEXT bytes. A restore read
+        // serves the stored representation instead (see
+        // [`restore_request_active`]), where that synthesized range would be
+        // reinterpreted as a storage range and truncate an encrypted or
+        // compressed payload by exactly its encoding overhead — the copy-back
+        // then fails its length check partway through
+        // (rustfs/rustfs#6025). An explicit caller range is already in storage
+        // coordinates on that path and is still honored.
         if let Some(part_number) = opts.part_number
             && rs.is_none()
+            && !restore_request_active(opts)
         {
             rs = http_range_spec_from_object_info(oi, part_number);
         }
@@ -747,7 +808,7 @@ impl ReadPlan {
                         }
                     }
                 } else {
-                    Box::new(LimitReader::new(dec_reader, total_plaintext_size))
+                    Box::new(HardLimitReader::new(dec_reader, decompressed_length))
                 };
 
                 let mut object_info = oi.clone();
@@ -839,7 +900,7 @@ impl ReadPlan {
                             )?;
                             Box::new(ranged_reader)
                         } else {
-                            Box::new(LimitReader::new(decompressed_reader, total_plaintext_size))
+                            Box::new(HardLimitReader::new(decompressed_reader, total_plaintext_size_i64))
                         }
                     } else if plaintext_offset > 0 || plaintext_length != total_plaintext_size_i64 {
                         Box::new(RangedDecompressReader::new(
@@ -849,7 +910,7 @@ impl ReadPlan {
                             total_plaintext_size,
                         )?)
                     } else {
-                        Box::new(LimitReader::new(decrypted_reader, total_plaintext_size))
+                        Box::new(HardLimitReader::new(decrypted_reader, total_plaintext_size_i64))
                     };
 
                 let mut object_info = oi.clone();
@@ -922,7 +983,7 @@ struct SkipReader<R> {
     inner: R,
     bytes_to_skip: usize,
     bytes_skipped: usize,
-    scratch: Vec<u8>,
+    scratch: Box<[MaybeUninit<u8>]>,
 }
 
 impl<R: AsyncRead + Unpin + Send + Sync> SkipReader<R> {
@@ -931,7 +992,7 @@ impl<R: AsyncRead + Unpin + Send + Sync> SkipReader<R> {
             inner,
             bytes_to_skip,
             bytes_skipped: 0,
-            scratch: vec![0u8; 8192],
+            scratch: Box::<[u8]>::new_uninit_slice(8192),
         }
     }
 }
@@ -943,7 +1004,7 @@ impl<R: AsyncRead + Unpin + Send + Sync> AsyncRead for SkipReader<R> {
         while this.bytes_skipped < this.bytes_to_skip {
             let remaining = this.bytes_to_skip - this.bytes_skipped;
             let scratch_len = remaining.min(this.scratch.len());
-            let mut scratch_buf = ReadBuf::new(&mut this.scratch[..scratch_len]);
+            let mut scratch_buf = ReadBuf::uninit(&mut this.scratch[..scratch_len]);
             match Pin::new(&mut this.inner).poll_read(cx, &mut scratch_buf) {
                 Poll::Pending => return Poll::Pending,
                 Poll::Ready(Err(err)) => return Poll::Ready(Err(err)),
@@ -974,7 +1035,7 @@ pub struct RangedDecompressReader<R: AsyncRead + Unpin + Send + Sync + 'static>
     target_length: usize,
     current_offset: usize,
     bytes_returned: usize,
-    scratch: Vec<u8>,
+    scratch: Box<[MaybeUninit<u8>]>,
     drain_on_done: bool,
     drain_task: Option<tokio::task::JoinHandle<()>>,
 }
@@ -1012,7 +1073,7 @@ impl<R: AsyncRead + Unpin + Send + Sync + 'static> RangedDecompressReader<R> {
             target_length: actual_length,
             current_offset: 0,
             bytes_returned: 0,
-            scratch: vec![0u8; 8192],
+            scratch: Box::<[u8]>::new_uninit_slice(8192),
             drain_on_done,
             drain_task: None,
         })
@@ -1062,7 +1123,7 @@ impl<R: AsyncRead + Unpin + Send + Sync + 'static> AsyncRead for RangedDecompres
             }
 
             let scratch_len = std::cmp::min(this.scratch.len(), std::cmp::max(buf_capacity, 1));
-            let mut temp_read_buf = ReadBuf::new(&mut this.scratch[..scratch_len]);
+            let mut temp_read_buf = ReadBuf::uninit(&mut this.scratch[..scratch_len]);
 
             let Some(inner) = this.inner.as_mut() else {
                 return Poll::Ready(Ok(()));
@@ -1114,7 +1175,8 @@ impl<R: AsyncRead + Unpin + Send + Sync + 'static> AsyncRead for RangedDecompres
                             );
 
                             if bytes_to_return > 0 {
-                                let data_slice = &this.scratch[data_start_in_buffer..data_start_in_buffer + bytes_to_return];
+                                let data_slice =
+                                    &temp_read_buf.filled()[data_start_in_buffer..data_start_in_buffer + bytes_to_return];
                                 buf.put_slice(data_slice);
                                 this.bytes_returned += bytes_to_return;
 
@@ -1133,7 +1195,7 @@ impl<R: AsyncRead + Unpin + Send + Sync + 'static> AsyncRead for RangedDecompres
                             std::cmp::min(n, std::cmp::min(buf.remaining(), this.target_length - this.bytes_returned));
 
                         if bytes_to_return > 0 {
-                            buf.put_slice(&this.scratch[..bytes_to_return]);
+                            buf.put_slice(&temp_read_buf.filled()[..bytes_to_return]);
                             this.bytes_returned += bytes_to_return;
 
                             tracing::trace!("Returned {} bytes at offset {}", bytes_to_return, old_offset);
@@ -1203,20 +1265,7 @@ impl<R: AsyncRead + Unpin + Send + 'static> AsyncRead for StreamConsumer<R> {
 
 impl<R: AsyncRead + Unpin + Send + 'static> Drop for StreamConsumer<R> {
     fn drop(&mut self) {
-        if self.consumer_task.is_none() && self.inner.is_some() {
-            let mut inner = self.inner.take().unwrap();
-            let task = tokio::spawn(async move {
-                let mut buf = [0u8; 8192];
-                loop {
-                    match inner.read(&mut buf).await {
-                        Ok(0) => break,    // EOF
-                        Ok(_) => continue, // Keep consuming
-                        Err(_) => break,   // Error, stop consuming
-                    }
-                }
-            });
-            self.consumer_task = Some(task);
-        }
+        self.ensure_consumer_started();
     }
 }
 
@@ -1263,6 +1312,43 @@ mod tests {
     use temp_env::async_with_vars;
     use tokio::io::AsyncReadExt;
 
+    #[derive(Debug)]
+    struct PendingPartialReader {
+        data: &'static [u8],
+        position: usize,
+        pending: bool,
+    }
+
+    impl PendingPartialReader {
+        fn new(data: &'static [u8]) -> Self {
+            Self {
+                data,
+                position: 0,
+                pending: true,
+            }
+        }
+    }
+
+    impl AsyncRead for PendingPartialReader {
+        fn poll_read(mut self: Pin<&mut Self>, cx: &mut Context<'_>, buf: &mut ReadBuf<'_>) -> Poll<std::io::Result<()>> {
+            if self.pending {
+                self.pending = false;
+                cx.waker().wake_by_ref();
+                return Poll::Pending;
+            }
+            if self.position == self.data.len() {
+                return Poll::Ready(Ok(()));
+            }
+
+            let length = buf.remaining().min(3).min(self.data.len() - self.position);
+            let end = self.position + length;
+            buf.put_slice(&self.data[self.position..end]);
+            self.position = end;
+            self.pending = true;
+            Poll::Ready(Ok(()))
+        }
+    }
+
     const TEST_DIRECT_KEY_HEADER: &str = "x-rustfs-test-direct-key";
     const TEST_OBJECT_KEY_HEADER: &str = "x-rustfs-test-object-key";
     const TEST_NONCE_HEADER: &str = "x-rustfs-test-nonce";
@@ -1400,6 +1486,36 @@ mod tests {
         assert_eq!(result, b"World");
     }
 
+    #[tokio::test]
+    async fn uninitialized_scratch_preserves_partial_pending_and_eof_reads() {
+        let mut skipped = SkipReader::new(PendingPartialReader::new(b"0123456789abcdef"), 5);
+        let mut skipped_output = Vec::new();
+        skipped
+            .read_to_end(&mut skipped_output)
+            .await
+            .expect("skip reader should survive partial pending reads through EOF");
+        assert_eq!(skipped_output, b"56789abcdef");
+
+        let mut ranged = RangedDecompressReader::new(PendingPartialReader::new(b"0123456789abcdef"), 5, 7, 16)
+            .expect("valid range should construct");
+        let mut ranged_output = Vec::new();
+        ranged
+            .read_to_end(&mut ranged_output)
+            .await
+            .expect("range reader should survive partial pending reads through EOF");
+        assert_eq!(ranged_output, b"56789ab");
+    }
+
+    #[tokio::test]
+    async fn uninitialized_skip_scratch_reports_early_eof() {
+        let mut reader = SkipReader::new(PendingPartialReader::new(b"short"), 6);
+        let error = reader
+            .read_to_end(&mut Vec::new())
+            .await
+            .expect_err("EOF before the skip boundary must remain visible");
+        assert_eq!(error.kind(), std::io::ErrorKind::UnexpectedEof);
+    }
+
     #[tokio::test]
     async fn test_ranged_decompress_reader_from_start() {
         let original_data = b"Hello, World! This is a test.";
@@ -1665,6 +1781,423 @@ mod tests {
         assert_eq!(actual, b"fghijkl");
     }
 
+    /// Compresses one multipart part exactly like the write path does
+    /// (`WritePlan::with_compression` wraps each part in its own
+    /// `compression_reader`), returning the on-disk bytes and the storage-format
+    /// compression index.
+    async fn compressed_part_fixture(data: &[u8]) -> (Vec<u8>, Option<Bytes>) {
+        use crate::io_support::rio::TryGetIndex as _;
+        let mut compressor =
+            crate::io_support::rio::compression_reader(Cursor::new(data.to_vec()), CompressionAlgorithm::default(), false);
+        let mut compressed = Vec::new();
+        compressor.read_to_end(&mut compressed).await.expect("compress part stream");
+        let index = compressor
+            .try_get_index()
+            .map(crate::io_support::rio::compression_index_storage_bytes);
+        (compressed, index)
+    }
+
+    struct CompressedMultipartFixture {
+        object_info: ObjectInfo,
+        stored: Vec<u8>,
+        plaintext: Vec<u8>,
+    }
+
+    /// Builds the on-disk representation of a compressed multipart object: each
+    /// part is an independent compressed stream and the storage layer serves
+    /// their concatenation.
+    async fn compressed_multipart_fixture(part_sizes: &[usize]) -> CompressedMultipartFixture {
+        let pattern = b"compressed multipart read path fixture data ";
+        let mut plaintext = Vec::new();
+        let mut stored = Vec::new();
+        let mut parts = Vec::with_capacity(part_sizes.len());
+
+        for (i, part_size) in part_sizes.iter().enumerate() {
+            let mut part_plaintext = Vec::with_capacity(*part_size);
+            while part_plaintext.len() < *part_size {
+                part_plaintext.extend_from_slice(pattern);
+                part_plaintext.push(i as u8);
+            }
+            part_plaintext.truncate(*part_size);
+
+            let (compressed, index) = compressed_part_fixture(&part_plaintext).await;
+            parts.push(ObjectPartInfo {
+                number: i + 1,
+                size: compressed.len(),
+                actual_size: *part_size as i64,
+                index,
+                ..Default::default()
+            });
+            stored.extend_from_slice(&compressed);
+            plaintext.extend_from_slice(&part_plaintext);
+        }
+
+        let mut user_defined = HashMap::new();
+        rustfs_utils::http::insert_str(
+            &mut user_defined,
+            rustfs_utils::http::SUFFIX_COMPRESSION,
+            crate::io_support::rio::compression_metadata_value(CompressionAlgorithm::default()),
+        );
+        rustfs_utils::http::insert_str(&mut user_defined, rustfs_utils::http::SUFFIX_ACTUAL_SIZE, plaintext.len().to_string());
+
+        let object_info = ObjectInfo {
+            bucket: "test-bucket".to_string(),
+            name: "compressed-multipart".to_string(),
+            size: stored.len() as i64,
+            etag: Some(format!("6bcf86bed8807b8e78f0fc6e0a53079d-{}", part_sizes.len())),
+            parts: Arc::new(parts),
+            user_defined: Arc::new(user_defined),
+            ..Default::default()
+        };
+
+        CompressedMultipartFixture {
+            object_info,
+            stored,
+            plaintext,
+        }
+    }
+
+    /// Plans the read once to learn the storage window, then serves exactly that
+    /// window — mirroring how `set_disk` feeds the erasure read into the
+    /// returned reader.
+    async fn read_compressed_multipart(
+        fixture: &CompressedMultipartFixture,
+        rs: Option<HTTPRangeSpec>,
+        opts: &ObjectOptions,
+    ) -> Vec<u8> {
+        let headers = HeaderMap::new();
+        let (_, offset, length) =
+            GetObjectReader::new(Box::new(Cursor::new(Vec::new())), rs.clone(), &fixture.object_info, opts, &headers)
+                .await
+                .expect("plan compressed multipart read");
+
+        let end = offset + usize::try_from(length).expect("storage window length must be non-negative");
+        assert!(
+            end <= fixture.stored.len(),
+            "planned storage window {offset}..{end} exceeds stored stream of {} bytes",
+            fixture.stored.len()
+        );
+        let window = fixture.stored[offset..end].to_vec();
+
+        let (mut reader, replay_offset, replay_length) =
+            GetObjectReader::new(Box::new(Cursor::new(window)), rs, &fixture.object_info, opts, &headers)
+                .await
+                .expect("build compressed multipart reader");
+        assert_eq!((replay_offset, replay_length), (offset, length), "read plan must be deterministic");
+
+        reader.read_all().await.expect("read compressed multipart stream")
+    }
+
+    /// Byte pattern with a 2 KiB period: it compresses extremely well while
+    /// looking nothing like ASCII fixtures. Mirrors the e2e generator that
+    /// exposed a truncated full GET on high-ratio multipart payloads.
+    fn high_ratio_binary_payload(size: usize, seed: u8) -> Vec<u8> {
+        (0..size)
+            .map(|i| ((i as u64).wrapping_mul(2_654_435_761).wrapping_add(seed as u64) >> 3) as u8)
+            .collect()
+    }
+
+    #[tokio::test]
+    async fn compressed_multipart_full_get_handles_high_ratio_binary_payload() {
+        let part_sizes = [5 * 1024 * 1024_usize, 1024 * 1024];
+        let mut plaintext = Vec::new();
+        let mut stored = Vec::new();
+        let mut parts = Vec::with_capacity(part_sizes.len());
+
+        for (i, part_size) in part_sizes.iter().enumerate() {
+            let part_plaintext = high_ratio_binary_payload(*part_size, if i == 0 { 7 } else { 61 });
+            let (compressed, index) = compressed_part_fixture(&part_plaintext).await;
+            parts.push(ObjectPartInfo {
+                number: i + 1,
+                size: compressed.len(),
+                actual_size: *part_size as i64,
+                index,
+                ..Default::default()
+            });
+            stored.extend_from_slice(&compressed);
+            plaintext.extend_from_slice(&part_plaintext);
+        }
+
+        let mut user_defined = HashMap::new();
+        rustfs_utils::http::insert_str(
+            &mut user_defined,
+            rustfs_utils::http::SUFFIX_COMPRESSION,
+            crate::io_support::rio::compression_metadata_value(CompressionAlgorithm::default()),
+        );
+        rustfs_utils::http::insert_str(&mut user_defined, rustfs_utils::http::SUFFIX_ACTUAL_SIZE, plaintext.len().to_string());
+        let fixture = CompressedMultipartFixture {
+            object_info: ObjectInfo {
+                bucket: "test-bucket".to_string(),
+                name: "high-ratio-multipart".to_string(),
+                size: stored.len() as i64,
+                etag: Some("6bcf86bed8807b8e78f0fc6e0a53079d-2".to_string()),
+                parts: Arc::new(parts),
+                user_defined: Arc::new(user_defined),
+                ..Default::default()
+            },
+            stored,
+            plaintext,
+        };
+
+        let read = read_compressed_multipart(&fixture, None, &ObjectOptions::default()).await;
+
+        assert_eq!(read.len(), fixture.plaintext.len(), "full GET must return the logical size");
+        assert_eq!(read, fixture.plaintext, "high-ratio multipart payload must survive the roundtrip");
+    }
+
+    /// Full GET over a compressed multipart object must decode across part
+    /// boundaries: every part is an independent compressed stream (this is also
+    /// the on-disk shape written by builds before rustfs/rustfs#5169 disabled
+    /// multipart compression, so this pins legacy-object readability).
+    #[tokio::test]
+    async fn compressed_multipart_full_get_decodes_across_part_boundaries() {
+        let fixture = compressed_multipart_fixture(&[3 * 1024 * 1024, 2 * 1024 * 1024, 512 * 1024]).await;
+
+        let read = read_compressed_multipart(&fixture, None, &ObjectOptions::default()).await;
+
+        assert_eq!(read.len(), fixture.plaintext.len(), "full GET must return the logical size");
+        assert_eq!(read, fixture.plaintext, "full GET must reassemble all parts");
+    }
+
+    #[tokio::test]
+    async fn compressed_multipart_range_get_crosses_part_boundary() {
+        let fixture = compressed_multipart_fixture(&[3 * 1024 * 1024, 2 * 1024 * 1024]).await;
+        let boundary = 3 * 1024 * 1024_i64;
+        let rs = HTTPRangeSpec {
+            is_suffix_length: false,
+            start: boundary - 100_000,
+            end: boundary + 100_000 - 1,
+        };
+
+        let read = read_compressed_multipart(&fixture, Some(rs), &ObjectOptions::default()).await;
+
+        let expected = &fixture.plaintext[(boundary - 100_000) as usize..(boundary + 100_000) as usize];
+        assert_eq!(read, expected, "boundary-crossing range must splice both parts");
+    }
+
+    #[tokio::test]
+    async fn compressed_multipart_range_get_seeks_into_later_part() {
+        let fixture = compressed_multipart_fixture(&[3 * 1024 * 1024, 4 * 1024 * 1024]).await;
+        // Deep inside part 2 so the plan skips part 1 entirely and (when the
+        // part carries an index) seeks within part 2.
+        let start = 3 * 1024 * 1024_i64 + 2 * 1024 * 1024_i64 + 137;
+        let rs = HTTPRangeSpec {
+            is_suffix_length: false,
+            start,
+            end: start + 64 * 1024 - 1,
+        };
+
+        let read = read_compressed_multipart(&fixture, Some(rs), &ObjectOptions::default()).await;
+
+        let expected = &fixture.plaintext[start as usize..(start + 64 * 1024) as usize];
+        assert_eq!(read, expected, "range inside a later part must decode from that part");
+    }
+
+    /// Parts written without a compression index (small parts skip the index in
+    /// the rio-v2 backend) must still be rangeable: the plan starts at the part
+    /// boundary and skips decompressed bytes.
+    #[tokio::test]
+    async fn compressed_multipart_range_get_works_without_part_indexes() {
+        let mut fixture = compressed_multipart_fixture(&[1024 * 1024, 1024 * 1024]).await;
+        let parts = fixture
+            .object_info
+            .parts
+            .iter()
+            .map(|part| ObjectPartInfo {
+                index: None,
+                ..part.clone()
+            })
+            .collect::<Vec<_>>();
+        fixture.object_info.parts = Arc::new(parts);
+
+        let start = 1024 * 1024_i64 + 4096;
+        let rs = HTTPRangeSpec {
+            is_suffix_length: false,
+            start,
+            end: start + 32 * 1024 - 1,
+        };
+
+        let read = read_compressed_multipart(&fixture, Some(rs), &ObjectOptions::default()).await;
+
+        let expected = &fixture.plaintext[start as usize..(start + 32 * 1024) as usize];
+        assert_eq!(read, expected, "index-less parts must fall back to part-boundary skip");
+    }
+
+    #[tokio::test]
+    async fn compressed_multipart_part_number_get_returns_single_part() {
+        let part_sizes = [3 * 1024 * 1024, 2 * 1024 * 1024, 512 * 1024];
+        let fixture = compressed_multipart_fixture(&part_sizes).await;
+
+        let mut logical_offset = 0_usize;
+        for (i, part_size) in part_sizes.iter().enumerate() {
+            let opts = ObjectOptions {
+                part_number: Some(i + 1),
+                ..Default::default()
+            };
+
+            let read = read_compressed_multipart(&fixture, None, &opts).await;
+
+            let expected = &fixture.plaintext[logical_offset..logical_offset + part_size];
+            assert_eq!(read.len(), *part_size, "partNumber={} GET must return the part's logical size", i + 1);
+            assert_eq!(read, expected, "partNumber={} GET must return the original part bytes", i + 1);
+            logical_offset += part_size;
+        }
+    }
+
+    #[tokio::test]
+    async fn compressed_multipart_suffix_range_reads_tail() {
+        let fixture = compressed_multipart_fixture(&[3 * 1024 * 1024, 1024 * 1024]).await;
+        let suffix_len = 128 * 1024_i64;
+        let rs = HTTPRangeSpec {
+            is_suffix_length: true,
+            start: suffix_len,
+            end: -1,
+        };
+
+        let read = read_compressed_multipart(&fixture, Some(rs), &ObjectOptions::default()).await;
+
+        let expected = &fixture.plaintext[fixture.plaintext.len() - suffix_len as usize..];
+        assert_eq!(read, expected, "suffix range must return the tail of the last part");
+    }
+
+    /// Builds an SSE-C + disk-compression multipart object exactly like the
+    /// write path: each part is compressed into its own stream and then
+    /// encrypted with the per-part key schedule. The fixture is
+    /// legacy-encryption-specific (`rustfs_rio::EncryptReader`), matching the
+    /// pre-existing `build_legacy_ssec_multipart_fixture` shape, while the
+    /// compression layer follows the active backend feature.
+    async fn compressed_encrypted_multipart_fixture(key_bytes: [u8; 32], part_sizes: &[usize]) -> CompressedMultipartFixture {
+        let pattern = b"compressed encrypted multipart fixture data ";
+        let mut plaintext = Vec::new();
+        let mut stored = Vec::new();
+        let mut parts = Vec::with_capacity(part_sizes.len());
+
+        for (i, part_size) in part_sizes.iter().enumerate() {
+            let part_number = i + 1;
+            let mut part_plaintext = Vec::with_capacity(*part_size);
+            while part_plaintext.len() < *part_size {
+                part_plaintext.extend_from_slice(pattern);
+                part_plaintext.push(part_number as u8);
+            }
+            part_plaintext.truncate(*part_size);
+
+            let (compressed, index) = compressed_part_fixture(&part_plaintext).await;
+            let mut part_cipher = Vec::new();
+            rustfs_rio::EncryptReader::new_multipart(Cursor::new(compressed), key_bytes, LEGACY_FIXTURE_BASE_NONCE, part_number)
+                .read_to_end(&mut part_cipher)
+                .await
+                .expect("encrypt compressed fixture part");
+
+            parts.push(ObjectPartInfo {
+                number: part_number,
+                size: part_cipher.len(),
+                actual_size: *part_size as i64,
+                index,
+                ..Default::default()
+            });
+            stored.extend_from_slice(&part_cipher);
+            plaintext.extend_from_slice(&part_plaintext);
+        }
+
+        let mut user_defined = legacy_ssec_multipart_metadata(key_bytes, plaintext.len());
+        rustfs_utils::http::insert_str(
+            &mut user_defined,
+            rustfs_utils::http::SUFFIX_COMPRESSION,
+            crate::io_support::rio::compression_metadata_value(CompressionAlgorithm::default()),
+        );
+        rustfs_utils::http::insert_str(&mut user_defined, rustfs_utils::http::SUFFIX_ACTUAL_SIZE, plaintext.len().to_string());
+
+        let object_info = ObjectInfo {
+            bucket: "test-bucket".to_string(),
+            name: "compressed-encrypted-multipart".to_string(),
+            size: stored.len() as i64,
+            etag: Some(format!("6bcf86bed8807b8e78f0fc6e0a53079d-{}", part_sizes.len())),
+            parts: Arc::new(parts),
+            user_defined: Arc::new(user_defined),
+            ..Default::default()
+        };
+
+        CompressedMultipartFixture {
+            object_info,
+            stored,
+            plaintext,
+        }
+    }
+
+    async fn read_compressed_encrypted_multipart(
+        fixture: &CompressedMultipartFixture,
+        key_bytes: [u8; 32],
+        rs: Option<HTTPRangeSpec>,
+        opts: &ObjectOptions,
+    ) -> Vec<u8> {
+        let headers = ssec_headers_from_key(key_bytes);
+        let (_, offset, length) =
+            GetObjectReader::new(Box::new(Cursor::new(Vec::new())), rs.clone(), &fixture.object_info, opts, &headers)
+                .await
+                .expect("plan compressed encrypted multipart read");
+
+        let end = offset + usize::try_from(length).expect("storage window length must be non-negative");
+        assert!(
+            end <= fixture.stored.len(),
+            "planned storage window {offset}..{end} exceeds stored stream of {} bytes",
+            fixture.stored.len()
+        );
+        let window = fixture.stored[offset..end].to_vec();
+
+        let (mut reader, replay_offset, replay_length) =
+            GetObjectReader::new(Box::new(Cursor::new(window)), rs, &fixture.object_info, opts, &headers)
+                .await
+                .expect("build compressed encrypted multipart reader");
+        assert_eq!((replay_offset, replay_length), (offset, length), "read plan must be deterministic");
+
+        reader.read_all().await.expect("read compressed encrypted multipart stream")
+    }
+
+    #[tokio::test]
+    async fn compressed_encrypted_multipart_full_get_roundtrip() {
+        let key_bytes = [0x6Eu8; 32];
+        let fixture = compressed_encrypted_multipart_fixture(key_bytes, &[3 * 1024 * 1024, 1024 * 1024]).await;
+
+        let read = read_compressed_encrypted_multipart(&fixture, key_bytes, None, &ObjectOptions::default()).await;
+
+        assert_eq!(read.len(), fixture.plaintext.len(), "full GET must return the logical size");
+        assert_eq!(read, fixture.plaintext, "SSE-C + compression full GET must reassemble all parts");
+    }
+
+    #[tokio::test]
+    async fn compressed_encrypted_multipart_range_crosses_part_boundary() {
+        let key_bytes = [0x6Eu8; 32];
+        let fixture = compressed_encrypted_multipart_fixture(key_bytes, &[3 * 1024 * 1024, 1024 * 1024]).await;
+        let boundary = 3 * 1024 * 1024_i64;
+        let rs = HTTPRangeSpec {
+            is_suffix_length: false,
+            start: boundary - 65_536,
+            end: boundary + 65_536 - 1,
+        };
+
+        let read = read_compressed_encrypted_multipart(&fixture, key_bytes, Some(rs), &ObjectOptions::default()).await;
+
+        let expected = &fixture.plaintext[(boundary - 65_536) as usize..(boundary + 65_536) as usize];
+        assert_eq!(read, expected, "SSE-C + compression boundary-crossing range must splice both parts");
+    }
+
+    #[tokio::test]
+    async fn compressed_encrypted_multipart_part_number_get_returns_single_part() {
+        let key_bytes = [0x6Eu8; 32];
+        let part_sizes = [3 * 1024 * 1024, 1024 * 1024];
+        let fixture = compressed_encrypted_multipart_fixture(key_bytes, &part_sizes).await;
+
+        let opts = ObjectOptions {
+            part_number: Some(2),
+            ..Default::default()
+        };
+        let read = read_compressed_encrypted_multipart(&fixture, key_bytes, None, &opts).await;
+
+        let expected = &fixture.plaintext[part_sizes[0]..];
+        assert_eq!(read.len(), part_sizes[1], "partNumber=2 GET must return the part's logical size");
+        assert_eq!(read, expected, "partNumber=2 GET must return the original part bytes");
+    }
+
     #[tokio::test]
     async fn test_get_object_reader_rejects_ssec_read_without_headers() {
         let object_info = ObjectInfo {

crates/ecstore/src/object_api/types.rs

@@ -172,6 +172,7 @@ impl ObjectLockConfigSnapshot {
         }
     }
 
+    #[allow(dead_code, reason = "snapshot-scope predicate asserted by this file's tests (backlog#1823)")]
     pub(crate) fn is_for_store_bucket(
         &self,
         store_id: Uuid,

crates/ecstore/src/runtime/global.rs

@@ -31,7 +31,6 @@ use std::{
 use tokio::sync::{OnceCell, RwLock};
 use tokio_util::sync::CancellationToken;
 use tracing::warn;
-use uuid::Uuid;
 
 pub const DISK_ASSUME_UNKNOWN_SIZE: u64 = 1 << 30;
 pub const DISK_MIN_INODES: u64 = 1000;
@@ -109,18 +108,6 @@ pub fn set_global_rustfs_port(value: u16) {
     }
 }
 
-/// Set the global deployment id
-///
-/// # Arguments
-/// * `id` - The Uuid to set as the global deployment id
-///
-/// # Returns
-/// * None
-///
-pub fn set_global_deployment_id(id: Uuid) {
-    current_ctx().set_deployment_id(id);
-}
-
 /// Get the global deployment id
 ///
 /// # Returns
@@ -288,19 +275,6 @@ pub fn get_global_region() -> Option<s3s::region::Region> {
     current_ctx().region()
 }
 
-/// Initialize the global background services cancellation token
-///
-/// # Arguments
-/// * `cancel_token` - The CancellationToken instance to set globally
-///
-/// # Returns
-/// * `Ok(())` if successful
-/// * `Err(CancellationToken)` if setting fails
-///
-pub fn init_background_services_cancel_token(cancel_token: CancellationToken) -> Result<(), CancellationToken> {
-    current_ctx().init_background_cancel_token(cancel_token)
-}
-
 /// Get the global background services cancellation token
 ///
 /// # Returns
@@ -310,18 +284,6 @@ pub fn get_background_services_cancel_token() -> Option<CancellationToken> {
     current_ctx().background_cancel_token()
 }
 
-/// Create and initialize the global background services cancellation token
-///
-/// # Returns
-/// * `CancellationToken` - The newly created global cancellation token
-///
-pub fn create_background_services_cancel_token() -> CancellationToken {
-    let cancel_token = CancellationToken::new();
-    init_background_services_cancel_token(cancel_token.clone())
-        .expect("background services cancel token should be initialized once during startup");
-    cancel_token
-}
-
 /// Shutdown all background services gracefully
 ///
 /// # Returns

crates/ecstore/src/runtime/instance.rs

@@ -402,6 +402,10 @@ impl InstanceContext {
     }
 
     #[cfg(test)]
+    #[allow(
+        dead_code,
+        reason = "driven by the tier-delete-journal recovery test behind `--features test-util` (backlog#1823)"
+    )]
     pub(crate) fn wake_tier_delete_journal_recovery(&self) {
         self.tier_delete_journal_recovery_wakeup.notify_one();
     }

crates/ecstore/src/runtime/mod.rs

@@ -13,7 +13,6 @@
 // limitations under the License.
 
 // #730: runtime source migration keeps fallback handles until all owners inject state.
-#![allow(dead_code)]
 
 pub(crate) mod global;
 pub(crate) mod instance;

crates/ecstore/src/runtime/sources.rs

@@ -38,7 +38,6 @@ use crate::{
         set_object_layer, update_erasure_type,
     },
     services::batch_processor::{GlobalBatchProcessors, get_global_processors},
-    services::event_notification::EventNotifier,
     services::notification_sys::{NotificationSys, get_global_notification_sys},
     services::tier::tier::TierConfigMgr,
     store::ECStore,
@@ -143,6 +142,10 @@ pub async fn setup_is_erasure_sd() -> bool {
     is_erasure_sd().await
 }
 
+#[allow(
+    dead_code,
+    reason = "setup-type override used only by tests across this crate (backlog#1823)"
+)]
 pub(crate) async fn current_setup_type() -> SetupType {
     if setup_is_dist_erasure().await {
         SetupType::DistErasure
@@ -155,6 +158,10 @@ pub(crate) async fn current_setup_type() -> SetupType {
     }
 }
 
+#[allow(
+    dead_code,
+    reason = "setup-type override used only by tests across this crate (backlog#1823)"
+)]
 pub(crate) async fn set_setup_type(setup_type: SetupType) {
     update_erasure_type(setup_type).await;
 }
@@ -232,14 +239,6 @@ pub(crate) fn ensure_test_rpc_secret() {
     let _ = rustfs_credentials::set_global_rpc_secret(TEST_RPC_SECRET.to_owned());
 }
 
-pub(crate) fn storage_class_parity(storage_class: Option<&str>) -> Option<usize> {
-    get_global_storage_class_snapshot().get_parity_for_sc(storage_class.unwrap_or_default())
-}
-
-pub(crate) fn storage_class_should_inline(shard_size: i64, versioned: bool) -> bool {
-    get_global_storage_class_snapshot().should_inline(shard_size, versioned)
-}
-
 pub(crate) fn deployment_upload_id(upload_id: &str) -> String {
     base64_simd::URL_SAFE_NO_PAD
         .encode_to_string(format!("{}.{}", get_global_deployment_id().unwrap_or_default(), upload_id).as_bytes())
@@ -332,21 +331,6 @@ pub(crate) fn storage_class_config_snapshot() -> Arc<storageclass::Config> {
     get_global_storage_class_snapshot()
 }
 
-/// Scalar STANDARD / RRS parity for backend-info reporting.
-///
-/// Retained for the rebalance/backend-info path. `get_parity_for_sc` returns
-/// `None` when the runtime config is uninitialized or (post per-pool support)
-/// when pools disagree, so STANDARD falls back to the caller's default and RRS
-/// stays `None` — matching the pre-per-pool scalar reporting.
-pub(crate) fn backend_storage_class_parities(default_standard_parity: usize) -> (Option<usize>, Option<usize>) {
-    let sc = get_global_storage_class_snapshot();
-    let standard = sc
-        .get_parity_for_sc(storageclass::CLASS_STANDARD)
-        .or(Some(default_standard_parity));
-    let reduced_redundancy = sc.get_parity_for_sc(storageclass::RRS);
-    (standard, reduced_redundancy)
-}
-
 pub(crate) fn set_storage_class_config(config: storageclass::Config) {
     set_global_storage_class(config);
 }
@@ -414,10 +398,6 @@ pub fn transition_state_handle() -> Arc<TransitionState> {
     crate::runtime::global::current_ctx().transition_state()
 }
 
-pub(crate) fn event_notifier_handle() -> Arc<RwLock<EventNotifier>> {
-    crate::runtime::global::current_ctx().event_notifier()
-}
-
 pub(crate) async fn local_disk_by_path(path: &str) -> Option<DiskStore> {
     local_disk_map_handle().read().await.get(path).cloned().flatten()
 }
@@ -511,30 +491,6 @@ pub(crate) async fn local_disk_set_drive(
     instance_ctx.local_disk_set_drives().read().await[pool_idx][set_idx][disk_idx].clone()
 }
 
-pub(crate) async fn local_disk_for_endpoint(endpoint: &Endpoint) -> Option<DiskStore> {
-    let set_drives = local_disk_set_drives_handle();
-    let global_set_drives = set_drives.read().await;
-    if global_set_drives.is_empty() {
-        return local_disk_map_handle()
-            .read()
-            .await
-            .get(&endpoint.to_string())
-            .cloned()
-            .unwrap_or(None);
-    }
-
-    let pool_idx = usize::try_from(endpoint.pool_idx).ok()?;
-    let set_idx = usize::try_from(endpoint.set_idx).ok()?;
-    let disk_idx = usize::try_from(endpoint.disk_idx).ok()?;
-
-    global_set_drives
-        .get(pool_idx)
-        .and_then(|sets| sets.get(set_idx))
-        .and_then(|disks| disks.get(disk_idx))
-        .cloned()
-        .unwrap_or(None)
-}
-
 pub(crate) async fn local_disk_paths() -> Vec<String> {
     local_disk_map_handle().read().await.keys().cloned().collect()
 }

crates/ecstore/src/services/batch_processor.rs

@@ -23,6 +23,10 @@ use std::sync::{Arc, Mutex};
 use std::time::{Duration, Instant};
 use tokio::task::JoinSet;
 
+#[allow(
+    dead_code,
+    reason = "default operation label for the test-only AsyncBatchProcessor::new (backlog#1823)"
+)]
 const BATCH_PROCESSOR_OPERATION_CUSTOM: &str = "custom";
 const BATCH_PROCESSOR_OPERATION_READ: &str = "read";
 const BATCH_PROCESSOR_OPERATION_WRITE: &str = "write";
@@ -211,6 +215,7 @@ pub struct AsyncBatchProcessor {
 }
 
 impl AsyncBatchProcessor {
+    #[allow(dead_code, reason = "constructor used only by this file's tests (backlog#1823)")]
     pub fn new(max_concurrent: usize) -> Self {
         Self::new_with_operation(max_concurrent, BATCH_PROCESSOR_OPERATION_CUSTOM)
     }

crates/ecstore/src/services/event_notification.rs

@@ -26,11 +26,26 @@ use std::sync::atomic::Ordering;
 use tokio::sync::RwLock;
 use tracing::warn;
 
+/// Dead ecstore-side notification skeleton.
+///
+/// The working notification stack is `rustfs-notify`, whose own `EventNotifier`
+/// is the one bucket configuration actually drives. Nothing calls the methods
+/// below; `init_bucket_targets` even logs that it is a no-op in this build.
+/// Removing it means also retiring the `InstanceContext` slot that holds it
+/// (backlog#939 Phase 5), so it is left explicit here rather than half-removed.
+#[allow(
+    dead_code,
+    reason = "ecstore-side notification skeleton superseded by rustfs-notify; see module note (backlog#1823)"
+)]
 pub struct EventNotifier {
     target_list: TargetList,
     //bucket_rules_map: HashMap<String , HashMap<EventName, Rules>>,
 }
 
+#[allow(
+    dead_code,
+    reason = "ecstore-side notification skeleton superseded by rustfs-notify; see module note (backlog#1823)"
+)]
 impl EventNotifier {
     pub fn new() -> Arc<RwLock<Self>> {
         Arc::new(RwLock::new(Self {

crates/ecstore/src/services/mod.rs

@@ -13,7 +13,6 @@
 // limitations under the License.
 
 // #730: background service owners still contain staged notification/rebalance/tier paths.
-#![allow(dead_code)]
 
 pub(crate) mod batch_processor;
 pub(crate) mod event_notification;

crates/ecstore/src/services/notification_sys.rs

@@ -44,12 +44,14 @@ const CONSECUTIVE_FAILURE_THRESHOLD: u32 = 3;
 const LOG_COMPONENT_ECSTORE: &str = "ecstore";
 const LOG_SUBSYSTEM_NOTIFICATION: &str = "notification";
 const EVENT_NOTIFICATION_PEER_PROPAGATION: &str = "notification_peer_propagation";
+const EVENT_NOTIFICATION_CAPABILITY_PROBE: &str = "notification_capability_probe";
 const SCANNER_ACTIVITY_PROBE_TIMEOUT: Duration = Duration::from_secs(5);
 const TIER_CONFIG_RELOAD_RETRY_BASE: Duration = Duration::from_millis(100);
 const TIER_CONFIG_RELOAD_RETRY_CAP: Duration = Duration::from_secs(5);
 const REMOTE_VERSION_STATE_PROBE_INTERVAL: Duration = Duration::from_secs(10);
 const REMOTE_VERSION_STATE_PROBE_TIMEOUT: Duration = Duration::from_secs(5);
 const REMOTE_VERSION_STATE_PROOF_TTL: Duration = Duration::from_secs(30);
+const CROSS_POOL_FENCE_SUPPORTED_VERSION: u32 = 1;
 
 /// Cached result from the last successful admin call to a peer.
 struct PeerAdminCache {
@@ -95,15 +97,15 @@ lazy_static! {
 }
 
 #[derive(Clone)]
-struct RemoteVersionStateFleetProof {
+struct FleetCapabilityProof {
     topology_fingerprint: String,
     peer_epochs: Arc<BTreeMap<String, Uuid>>,
     expires_at: Instant,
 }
 
-impl RemoteVersionStateFleetProof {
-    fn token(&self) -> RemoteVersionStateFleetProofToken {
-        RemoteVersionStateFleetProofToken {
+impl FleetCapabilityProof {
+    fn token(&self) -> FleetCapabilityProofToken {
+        FleetCapabilityProofToken {
             topology_fingerprint: self.topology_fingerprint.clone(),
             peer_epochs: self.peer_epochs.clone(),
         }
@@ -111,37 +113,41 @@ impl RemoteVersionStateFleetProof {
 }
 
 #[derive(Clone, PartialEq, Eq)]
-pub(crate) struct RemoteVersionStateFleetProofToken {
+struct FleetCapabilityProofToken {
     topology_fingerprint: String,
     peer_epochs: Arc<BTreeMap<String, Uuid>>,
 }
 
 #[derive(Default)]
-struct RemoteVersionStateFleetProofState {
-    proof: Option<RemoteVersionStateFleetProof>,
+struct FleetCapabilityProofState {
+    proof: Option<FleetCapabilityProof>,
     topology_conflict: bool,
 }
 
-static REMOTE_VERSION_STATE_FLEET_PROOF: OnceLock<std::sync::RwLock<RemoteVersionStateFleetProofState>> = OnceLock::new();
+#[derive(Clone, PartialEq, Eq)]
+pub(crate) struct RemoteVersionStateFleetProofToken(FleetCapabilityProofToken);
+
+#[derive(Clone, PartialEq, Eq)]
+pub struct CrossPoolFenceFleetProofToken(FleetCapabilityProofToken);
+
+static REMOTE_VERSION_STATE_FLEET_PROOF: OnceLock<std::sync::RwLock<FleetCapabilityProofState>> = OnceLock::new();
+static CROSS_POOL_FENCE_FLEET_PROOF: OnceLock<std::sync::RwLock<FleetCapabilityProofState>> = OnceLock::new();
 static REMOTE_VERSION_STATE_PROBE_TOPOLOGY: OnceLock<String> = OnceLock::new();
 
-fn remote_version_state_fleet_proof_slot() -> &'static std::sync::RwLock<RemoteVersionStateFleetProofState> {
-    REMOTE_VERSION_STATE_FLEET_PROOF.get_or_init(|| std::sync::RwLock::new(RemoteVersionStateFleetProofState::default()))
+fn cross_pool_fence_fleet_proof_slot() -> &'static std::sync::RwLock<FleetCapabilityProofState> {
+    CROSS_POOL_FENCE_FLEET_PROOF.get_or_init(|| std::sync::RwLock::new(FleetCapabilityProofState::default()))
 }
 
-fn replace_remote_version_state_fleet_proof(proof: Option<RemoteVersionStateFleetProof>) {
-    replace_remote_version_state_fleet_proof_in(remote_version_state_fleet_proof_slot(), proof);
+fn remote_version_state_fleet_proof_slot() -> &'static std::sync::RwLock<FleetCapabilityProofState> {
+    REMOTE_VERSION_STATE_FLEET_PROOF.get_or_init(|| std::sync::RwLock::new(FleetCapabilityProofState::default()))
 }
 
-fn replace_remote_version_state_fleet_proof_in(
-    slot: &std::sync::RwLock<RemoteVersionStateFleetProofState>,
-    proof: Option<RemoteVersionStateFleetProof>,
-) {
+fn replace_fleet_capability_proof(slot: &std::sync::RwLock<FleetCapabilityProofState>, proof: Option<FleetCapabilityProof>) {
     slot.write().unwrap_or_else(std::sync::PoisonError::into_inner).proof = proof;
 }
 
-fn publish_remote_version_state_probe_result(
-    slot: &std::sync::RwLock<RemoteVersionStateFleetProofState>,
+fn publish_fleet_capability_probe_result(
+    slot: &std::sync::RwLock<FleetCapabilityProofState>,
     topology_fingerprint: &str,
     result: Result<BTreeMap<String, Uuid>>,
     observed_at: Instant,
@@ -155,7 +161,7 @@ fn publish_remote_version_state_probe_result(
                 .filter(|proof| proof.topology_fingerprint == topology_fingerprint && proof.peer_epochs.as_ref() == &peer_epochs)
                 .map(|proof| Arc::clone(&proof.peer_epochs))
                 .unwrap_or_else(|| Arc::new(peer_epochs));
-            state.proof = Some(RemoteVersionStateFleetProof {
+            state.proof = Some(FleetCapabilityProof {
                 topology_fingerprint: topology_fingerprint.to_string(),
                 peer_epochs,
                 expires_at: observed_at + REMOTE_VERSION_STATE_PROOF_TTL,
@@ -163,7 +169,7 @@ fn publish_remote_version_state_probe_result(
             None
         }
         Err(err) => {
-            replace_remote_version_state_fleet_proof_in(slot, None);
+            replace_fleet_capability_proof(slot, None);
             Some(err)
         }
     }
@@ -174,27 +180,60 @@ pub(crate) fn acquire_remote_version_state_fleet_proof() -> Option<RemoteVersion
     let state = remote_version_state_fleet_proof_slot()
         .read()
         .unwrap_or_else(std::sync::PoisonError::into_inner);
-    acquire_remote_version_state_fleet_proof_from(&state, expected_topology, Instant::now())
+    acquire_fleet_capability_proof_from(&state, expected_topology, Instant::now()).map(RemoteVersionStateFleetProofToken)
 }
 
-fn acquire_remote_version_state_fleet_proof_from(
-    state: &RemoteVersionStateFleetProofState,
+fn acquire_fleet_capability_proof_from(
+    state: &FleetCapabilityProofState,
     expected_topology: &str,
     now: Instant,
-) -> Option<RemoteVersionStateFleetProofToken> {
-    if state.topology_conflict || !remote_version_state_fleet_proof_valid_at(state.proof.as_ref(), expected_topology, now) {
+) -> Option<FleetCapabilityProofToken> {
+    if state.topology_conflict || !fleet_capability_proof_valid_at(state.proof.as_ref(), expected_topology, now) {
         return None;
     }
-    state.proof.as_ref().map(RemoteVersionStateFleetProof::token)
+    state.proof.as_ref().map(FleetCapabilityProof::token)
 }
 
 pub(crate) fn remote_version_state_fleet_proof_matches(proof: &RemoteVersionStateFleetProofToken) -> bool {
+    fleet_capability_proof_matches(remote_version_state_fleet_proof_slot(), &proof.0)
+}
+
+pub fn acquire_cross_pool_fence_fleet_proof() -> Option<CrossPoolFenceFleetProofToken> {
+    let expected_topology = REMOTE_VERSION_STATE_PROBE_TOPOLOGY.get()?;
+    let state = cross_pool_fence_fleet_proof_slot()
+        .read()
+        .unwrap_or_else(std::sync::PoisonError::into_inner);
+    acquire_fleet_capability_proof_from(&state, expected_topology, Instant::now()).map(CrossPoolFenceFleetProofToken)
+}
+
+pub fn cross_pool_fence_fleet_proof_matches(proof: &CrossPoolFenceFleetProofToken) -> bool {
+    fleet_capability_proof_matches(cross_pool_fence_fleet_proof_slot(), &proof.0)
+}
+
+#[cfg(any(test, feature = "test-util"))]
+pub fn rotate_cross_pool_fence_fleet_proof_for_test() -> bool {
+    let mut state = cross_pool_fence_fleet_proof_slot()
+        .write()
+        .unwrap_or_else(std::sync::PoisonError::into_inner);
+    let Some(current) = state.proof.as_ref() else {
+        return false;
+    };
+    state.proof = Some(FleetCapabilityProof {
+        topology_fingerprint: current.topology_fingerprint.clone(),
+        peer_epochs: Arc::new(current.peer_epochs.as_ref().clone()),
+        expires_at: current.expires_at,
+    });
+    true
+}
+
+fn fleet_capability_proof_matches(
+    slot: &std::sync::RwLock<FleetCapabilityProofState>,
+    proof: &FleetCapabilityProofToken,
+) -> bool {
     let Some(expected_topology) = REMOTE_VERSION_STATE_PROBE_TOPOLOGY.get() else {
         return false;
     };
-    let state = remote_version_state_fleet_proof_slot()
-        .read()
-        .unwrap_or_else(std::sync::PoisonError::into_inner);
+    let state = slot.read().unwrap_or_else(std::sync::PoisonError::into_inner);
     if state.topology_conflict {
         return false;
     }
@@ -206,14 +245,42 @@ pub(crate) fn remote_version_state_fleet_proof_matches(proof: &RemoteVersionStat
     })
 }
 
-fn remote_version_state_fleet_proof_valid_at(
-    proof: Option<&RemoteVersionStateFleetProof>,
-    expected_topology: &str,
-    now: Instant,
-) -> bool {
+fn fleet_capability_proof_valid_at(proof: Option<&FleetCapabilityProof>, expected_topology: &str, now: Instant) -> bool {
     proof.is_some_and(|proof| proof.topology_fingerprint == expected_topology && now < proof.expires_at)
 }
 
+#[cfg(test)]
+pub(crate) struct RemoteVersionStateFleetProofGuard;
+
+#[cfg(test)]
+impl Drop for RemoteVersionStateFleetProofGuard {
+    fn drop(&mut self) {
+        replace_fleet_capability_proof(remote_version_state_fleet_proof_slot(), None);
+    }
+}
+
+#[cfg(test)]
+pub(crate) fn install_remote_version_state_fleet_proof_for_test(topology_fingerprint: &str) -> RemoteVersionStateFleetProofGuard {
+    match REMOTE_VERSION_STATE_PROBE_TOPOLOGY.set(topology_fingerprint.to_string()) {
+        Ok(()) => {}
+        Err(_)
+            if REMOTE_VERSION_STATE_PROBE_TOPOLOGY
+                .get()
+                .is_some_and(|current| current == topology_fingerprint) => {}
+        Err(_) => panic!("remote version state test topology is already bound to another fingerprint"),
+    }
+    let peer_epochs = BTreeMap::new();
+    if let Some(err) = publish_fleet_capability_probe_result(
+        remote_version_state_fleet_proof_slot(),
+        topology_fingerprint,
+        Ok(peer_epochs),
+        Instant::now(),
+    ) {
+        panic!("test proof installation must not fail: {err}");
+    }
+    RemoteVersionStateFleetProofGuard
+}
+
 fn insert_remote_version_state_peer(peer_epochs: &mut BTreeMap<String, Uuid>, peer: String, epoch: Uuid) -> Result<()> {
     if epoch.is_nil() || peer_epochs.values().any(|existing| *existing == epoch) || peer_epochs.insert(peer, epoch).is_some() {
         return Err(Error::other("remote version state capability peer identity is invalid"));
@@ -224,11 +291,11 @@ fn insert_remote_version_state_peer(peer_epochs: &mut BTreeMap<String, Uuid>, pe
 pub fn start_remote_version_state_fleet_probe(topology_fingerprint: String) {
     if REMOTE_VERSION_STATE_PROBE_TOPOLOGY.set(topology_fingerprint.clone()).is_err() {
         if REMOTE_VERSION_STATE_PROBE_TOPOLOGY.get() != Some(&topology_fingerprint) {
-            let mut state = remote_version_state_fleet_proof_slot()
-                .write()
-                .unwrap_or_else(std::sync::PoisonError::into_inner);
-            state.topology_conflict = true;
-            state.proof = None;
+            for slot in [remote_version_state_fleet_proof_slot(), cross_pool_fence_fleet_proof_slot()] {
+                let mut state = slot.write().unwrap_or_else(std::sync::PoisonError::into_inner);
+                state.topology_conflict = true;
+                state.proof = None;
+            }
         }
         return;
     }
@@ -249,13 +316,23 @@ pub fn start_remote_version_state_fleet_probe(topology_fingerprint: String) {
                 }
                 None => Err(Error::other("remote version state fleet capability notification system is unavailable")),
             };
+            let fence_result = match get_global_notification_sys() {
+                Some(notification_sys) => timeout(
+                    REMOTE_VERSION_STATE_PROBE_TIMEOUT,
+                    notification_sys.probe_cross_pool_fence_fleet(&topology_fingerprint),
+                )
+                .await
+                .unwrap_or_else(|_| Err(Error::other("cross-pool fence fleet capability probe timed out"))),
+                None => Err(Error::other("cross-pool fence fleet capability notification system is unavailable")),
+            };
             let topology_conflict = remote_version_state_fleet_proof_slot()
                 .read()
                 .unwrap_or_else(std::sync::PoisonError::into_inner)
                 .topology_conflict;
             if topology_conflict {
-                replace_remote_version_state_fleet_proof(None);
-            } else if let Some(err) = publish_remote_version_state_probe_result(
+                replace_fleet_capability_proof(remote_version_state_fleet_proof_slot(), None);
+                replace_fleet_capability_proof(cross_pool_fence_fleet_proof_slot(), None);
+            } else if let Some(err) = publish_fleet_capability_probe_result(
                 remote_version_state_fleet_proof_slot(),
                 &topology_fingerprint,
                 result,
@@ -263,6 +340,24 @@ pub fn start_remote_version_state_fleet_probe(topology_fingerprint: String) {
             ) {
                 debug!(error = %err, "remote version state fleet capability probe failed closed");
             }
+            if !topology_conflict
+                && let Some(err) = publish_fleet_capability_probe_result(
+                    cross_pool_fence_fleet_proof_slot(),
+                    &topology_fingerprint,
+                    fence_result,
+                    Instant::now(),
+                )
+            {
+                debug!(
+                    event = EVENT_NOTIFICATION_CAPABILITY_PROBE,
+                    component = LOG_COMPONENT_ECSTORE,
+                    subsystem = LOG_SUBSYSTEM_NOTIFICATION,
+                    capability = "cross_pool_fence_v1",
+                    state = "failed_closed",
+                    error = %err,
+                    "notification capability probe"
+                );
+            }
             sleep(REMOTE_VERSION_STATE_PROBE_INTERVAL).await;
         }
     });
@@ -330,6 +425,27 @@ impl NotificationSys {
         }
         Ok(peer_epochs)
     }
+
+    async fn probe_cross_pool_fence_fleet(&self, topology_fingerprint: &str) -> Result<BTreeMap<String, Uuid>> {
+        if self.peer_clients.len() != self.peer_topology_hosts.len() {
+            return Err(Error::other("cross-pool fence capability fleet membership is incomplete"));
+        }
+        let probes = self.peer_clients.iter().map(|client| async {
+            let client = client
+                .as_ref()
+                .ok_or_else(|| Error::other("cross-pool fence capability peer is unreachable"))?;
+            client.probe_cross_pool_fence(topology_fingerprint.to_string()).await
+        });
+        let mut peer_epochs = BTreeMap::new();
+        for result in join_all(probes).await {
+            let (peer, version, epoch) = result?;
+            if version < CROSS_POOL_FENCE_SUPPORTED_VERSION {
+                return Err(Error::other("cross-pool fence capability version is unsupported"));
+            }
+            insert_remote_version_state_peer(&mut peer_epochs, peer, epoch)?;
+        }
+        Ok(peer_epochs)
+    }
 }
 
 pub struct NotificationPeerErr {
@@ -1507,6 +1623,7 @@ impl NotificationSys {
         workers.peers.remove(host);
     }
 
+    #[allow(dead_code, reason = "asserted by this file's tests (backlog#1823)")]
     fn tier_config_reload_worker_active(&self, host: &str) -> bool {
         self.tier_config_reload_workers
             .lock()
@@ -1680,6 +1797,7 @@ where
         .map_err(|_| Error::other(format!("scanner activity peer {host} timed out after {timeout_duration:?}")))?
 }
 
+#[allow(dead_code, reason = "asserted by this file's tests (backlog#1823)")]
 async fn call_peer_with_timeout<F, Fut>(
     timeout_dur: Duration,
     host_label: &str,
@@ -2145,16 +2263,16 @@ mod tests {
         let now = Instant::now();
         let mut peer_epochs = BTreeMap::new();
         peer_epochs.insert("peer-a".to_string(), Uuid::new_v4());
-        let proof = RemoteVersionStateFleetProof {
+        let proof = FleetCapabilityProof {
             topology_fingerprint: "topology-a".to_string(),
             peer_epochs: Arc::new(peer_epochs),
             expires_at: now + Duration::from_secs(1),
         };
 
-        assert!(remote_version_state_fleet_proof_valid_at(Some(&proof), "topology-a", now));
-        assert!(!remote_version_state_fleet_proof_valid_at(Some(&proof), "topology-b", now));
-        assert!(!remote_version_state_fleet_proof_valid_at(Some(&proof), "topology-a", proof.expires_at));
-        assert!(!remote_version_state_fleet_proof_valid_at(None, "topology-a", now));
+        assert!(fleet_capability_proof_valid_at(Some(&proof), "topology-a", now));
+        assert!(!fleet_capability_proof_valid_at(Some(&proof), "topology-b", now));
+        assert!(!fleet_capability_proof_valid_at(Some(&proof), "topology-a", proof.expires_at));
+        assert!(!fleet_capability_proof_valid_at(None, "topology-a", now));
     }
 
     #[test]
@@ -2168,25 +2286,25 @@ mod tests {
     #[test]
     fn remote_version_state_fleet_proof_accepts_single_node_membership() {
         let now = Instant::now();
-        let proof = RemoteVersionStateFleetProof {
+        let proof = FleetCapabilityProof {
             topology_fingerprint: "topology-a".to_string(),
             peer_epochs: Arc::new(BTreeMap::new()),
             expires_at: now + Duration::from_secs(1),
         };
 
-        assert!(remote_version_state_fleet_proof_valid_at(Some(&proof), "topology-a", now));
+        assert!(fleet_capability_proof_valid_at(Some(&proof), "topology-a", now));
     }
 
     #[test]
     fn remote_version_state_fleet_proof_token_changes_with_process_epoch() {
         let now = Instant::now();
-        let proof = RemoteVersionStateFleetProof {
+        let proof = FleetCapabilityProof {
             topology_fingerprint: "topology-a".to_string(),
             peer_epochs: Arc::new(BTreeMap::from([("peer-a".to_string(), Uuid::new_v4())])),
             expires_at: now + Duration::from_secs(1),
         };
         let captured = proof.token();
-        let restarted = RemoteVersionStateFleetProof {
+        let restarted = FleetCapabilityProof {
             topology_fingerprint: proof.topology_fingerprint.clone(),
             peer_epochs: Arc::new(BTreeMap::from([("peer-a".to_string(), Uuid::new_v4())])),
             expires_at: proof.expires_at,
@@ -2197,11 +2315,11 @@ mod tests {
 
     #[test]
     fn remote_version_state_fleet_proof_renewal_preserves_only_same_epoch_token() {
-        let slot = std::sync::RwLock::new(RemoteVersionStateFleetProofState::default());
+        let slot = std::sync::RwLock::new(FleetCapabilityProofState::default());
         let now = Instant::now();
         let epoch = Uuid::new_v4();
         let peers = BTreeMap::from([("peer-a".to_string(), epoch)]);
-        assert!(publish_remote_version_state_probe_result(&slot, "topology-a", Ok(peers.clone()), now).is_none());
+        assert!(publish_fleet_capability_probe_result(&slot, "topology-a", Ok(peers.clone()), now).is_none());
         let original = slot
             .read()
             .expect("proof slot should not poison")
@@ -2210,9 +2328,7 @@ mod tests {
             .expect("successful probe should publish proof")
             .token();
 
-        assert!(
-            publish_remote_version_state_probe_result(&slot, "topology-a", Ok(peers), now + Duration::from_millis(1)).is_none()
-        );
+        assert!(publish_fleet_capability_probe_result(&slot, "topology-a", Ok(peers), now + Duration::from_millis(1)).is_none());
         let renewed = slot
             .read()
             .expect("proof slot should not poison")
@@ -2224,8 +2340,7 @@ mod tests {
 
         let restarted = BTreeMap::from([("peer-a".to_string(), Uuid::new_v4())]);
         assert!(
-            publish_remote_version_state_probe_result(&slot, "topology-a", Ok(restarted), now + Duration::from_millis(2))
-                .is_none()
+            publish_fleet_capability_probe_result(&slot, "topology-a", Ok(restarted), now + Duration::from_millis(2)).is_none()
         );
         let replaced = slot
             .read()
@@ -2240,18 +2355,18 @@ mod tests {
     #[test]
     fn remote_version_state_fleet_proof_conflict_revokes_atomic_snapshot() {
         let now = Instant::now();
-        let mut state = RemoteVersionStateFleetProofState {
-            proof: Some(RemoteVersionStateFleetProof {
+        let mut state = FleetCapabilityProofState {
+            proof: Some(FleetCapabilityProof {
                 topology_fingerprint: "topology-a".to_string(),
                 peer_epochs: Arc::new(BTreeMap::new()),
                 expires_at: now + Duration::from_secs(1),
             }),
             topology_conflict: false,
         };
-        assert!(acquire_remote_version_state_fleet_proof_from(&state, "topology-a", now).is_some());
+        assert!(acquire_fleet_capability_proof_from(&state, "topology-a", now).is_some());
 
         state.topology_conflict = true;
-        assert!(acquire_remote_version_state_fleet_proof_from(&state, "topology-a", now).is_none());
+        assert!(acquire_fleet_capability_proof_from(&state, "topology-a", now).is_none());
     }
 
     #[test]
@@ -2267,19 +2382,19 @@ mod tests {
 
     #[test]
     fn remote_version_state_fleet_probe_failure_revokes_previous_proof() {
-        let slot = std::sync::RwLock::new(RemoteVersionStateFleetProofState::default());
+        let slot = std::sync::RwLock::new(FleetCapabilityProofState::default());
         let now = Instant::now();
         let peer_epochs = BTreeMap::from([("node-a:9000".to_string(), Uuid::new_v4())]);
-        assert!(publish_remote_version_state_probe_result(&slot, "topology-a", Ok(peer_epochs), now).is_none());
+        assert!(publish_fleet_capability_probe_result(&slot, "topology-a", Ok(peer_epochs), now).is_none());
         assert!(slot.read().expect("proof slot should not poison").proof.is_some());
 
         assert!(
-            publish_remote_version_state_probe_result(&slot, "topology-a", Err(Error::other("peer unavailable")), now,).is_some()
+            publish_fleet_capability_probe_result(&slot, "topology-a", Err(Error::other("peer unavailable")), now,).is_some()
         );
         assert!(slot.read().expect("proof slot should not poison").proof.is_none());
 
         let peer_epochs = BTreeMap::from([("node-a:9000".to_string(), Uuid::new_v4())]);
-        assert!(publish_remote_version_state_probe_result(&slot, "topology-a", Ok(peer_epochs), now).is_none());
+        assert!(publish_fleet_capability_probe_result(&slot, "topology-a", Ok(peer_epochs), now).is_none());
         assert!(slot.read().expect("proof slot should not poison").proof.is_some());
     }
 

crates/ecstore/src/services/rebalance/meta.rs

@@ -864,6 +864,10 @@ pub(super) fn merge_rebalance_meta(remote: &mut RebalanceMeta, local: &Rebalance
     RebalanceMetaMergeOutcome::Merged
 }
 
+#[allow(
+    dead_code,
+    reason = "stop-transition helper retained beside stop_rebalance_meta_snapshot; no caller yet (backlog#1823)"
+)]
 pub(super) fn mark_started_rebalance_pools_stopped(meta: &mut RebalanceMeta, stop_time: OffsetDateTime) {
     for pool_stat in meta.pool_stats.iter_mut() {
         if pool_stat.info.status == RebalStatus::Started {
@@ -964,6 +968,7 @@ pub(super) fn rollback_rebalance_start_meta_snapshot_for_id(
     })
 }
 
+#[allow(dead_code, reason = "asserted by this file's tests (backlog#1823)")]
 pub(super) fn stop_rebalance_meta_snapshot(meta: Option<&mut RebalanceMeta>, now: OffsetDateTime) -> Option<RebalanceMeta> {
     let meta = meta?;
     stop_rebalance_state(meta, now);

crates/ecstore/src/services/rebalance/migration.rs

@@ -171,6 +171,7 @@ where
 }
 
 #[allow(clippy::too_many_arguments)]
+#[allow(dead_code, reason = "asserted by this file's tests (backlog#1823)")]
 pub(super) async fn migrate_entry_version_with_retry_wait<Backend, F, Fut, D, DFut, W, WFut>(
     set: &Backend,
     bucket: String,

crates/ecstore/src/services/rebalance/types.rs

@@ -1,5 +1,4 @@
 use serde::{Deserialize, Serialize};
-use std::sync::Arc;
 use time::OffsetDateTime;
 use tokio_util::sync::CancellationToken;
 
@@ -32,8 +31,6 @@ pub struct RebalanceStats {
     pub cleanup_warnings: RebalanceCleanupWarnings,
 }
 
-pub type RStats = Vec<Arc<RebalanceStats>>;
-
 #[derive(Debug, Default)]
 pub(super) struct RebalanceBucketConfigs {
     pub(super) bucket_incarnation_id: Option<uuid::Uuid>,

crates/ecstore/src/services/tier/mod.rs

@@ -30,6 +30,5 @@ pub mod warm_backend_minio;
 pub mod warm_backend_r2;
 pub mod warm_backend_rustfs;
 pub mod warm_backend_s3;
-pub mod warm_backend_s3sdk;
 pub mod warm_backend_tencent;
 pub mod warm_backend_wasabi;

crates/ecstore/src/services/tier/tier.rs

@@ -488,6 +488,7 @@ impl TierCandidateMutation {
         targets
     }
 
+    #[allow(dead_code, reason = "asserted by this file's tests (backlog#1823)")]
     fn affected_targets(
         &self,
         manager: &TierConfigMgr,
@@ -802,6 +803,7 @@ fn tier_persisted_reference_blocks_any_target(
         .any(|target| tier_persisted_reference_blocks_target(tier_name, backend_identity, target))
 }
 
+#[allow(dead_code, reason = "asserted by this file's tests (backlog#1823)")]
 fn tier_object_blocks_target_rebind(object: &ObjectInfo, target: &TierMutationIntentTarget) -> io::Result<bool> {
     tier_object_blocks_any_target_rebind(object, std::slice::from_ref(target))
 }
@@ -2726,14 +2728,6 @@ impl TierConfigMgr {
         Self::publish_candidate_owned(handle, candidate, driver_tier.map(str::to_string), update).await
     }
 
-    fn begin_publish_transition(
-        handle: &Arc<RwLock<Self>>,
-        manager: &mut Self,
-        candidate: &Self,
-    ) -> std::result::Result<TierPublishTransition, AdminError> {
-        Self::begin_publish_transition_with_allowed_mutation_blocks(handle, manager, candidate, None)
-    }
-
     fn begin_publish_transition_with_allowed_mutation_blocks(
         handle: &Arc<RwLock<Self>>,
         manager: &mut Self,
@@ -2819,14 +2813,6 @@ impl TierConfigMgr {
         })
     }
 
-    async fn publish_candidate_inner(
-        handle: &Arc<RwLock<Self>>,
-        candidate: Self,
-        driver_tier: Option<&str>,
-    ) -> std::result::Result<(), AdminError> {
-        Self::publish_candidate_inner_with_allowed_mutation_blocks(handle, candidate, driver_tier, None).await
-    }
-
     async fn publish_candidate_inner_with_allowed_mutation_blocks(
         handle: &Arc<RwLock<Self>>,
         candidate: Self,
@@ -2939,6 +2925,7 @@ impl TierConfigMgr {
         admin_err
     }
 
+    #[allow(dead_code, reason = "reached only through #[cfg(test)] helpers in this file (backlog#1823)")]
     async fn publish_candidate_owned(
         handle: &Arc<RwLock<Self>>,
         candidate: Self,
@@ -3541,6 +3528,7 @@ impl TierConfigMgr {
         Self::update_candidate_with_config_lock(handle, api, TierCandidateMutation::Remove(tier_name.to_string(), force)).await
     }
 
+    #[allow(dead_code, reason = "reached only through #[cfg(test)] helpers in this file (backlog#1823)")]
     async fn remove_and_save_with<S>(
         handle: &Arc<RwLock<Self>>,
         api: Arc<S>,
@@ -3574,6 +3562,7 @@ impl TierConfigMgr {
         Self::update_candidate_with_config_lock(handle, api, TierCandidateMutation::Clear(force)).await
     }
 
+    #[allow(dead_code, reason = "reached only through #[cfg(test)] helpers in this file (backlog#1823)")]
     async fn clear_and_save_with<S>(
         handle: &Arc<RwLock<Self>>,
         api: Arc<S>,
@@ -3612,6 +3601,10 @@ impl TierConfigMgr {
     }
 
     #[cfg(test)]
+    #[allow(
+        dead_code,
+        reason = "lease accounting asserted by a bucket_lifecycle_ops test behind `--features test-util` (backlog#1823)"
+    )]
     pub(crate) async fn active_operation_lease_count(handle: &Arc<RwLock<Self>>, tier_name: &str) -> usize {
         let manager = handle.read().await;
         let Some(runtime) = registered_tier_driver_runtime(&manager) else {
@@ -3717,10 +3710,6 @@ impl TierConfigMgr {
         Ok(())
     }
 
-    fn retire_driver(&mut self, tier_name: &str) {
-        self.revoke_driver(tier_name);
-    }
-
     fn revoke_all_drivers(&mut self) {
         if let Some(runtime) = registered_tier_driver_runtime(self) {
             let mut runtime = lock_unpoisoned(&runtime);
@@ -3884,6 +3873,7 @@ impl TierConfigMgr {
         self.save_config(api, &config_file, data).await
     }
 
+    #[allow(dead_code, reason = "reached only through #[cfg(test)] helpers in this file (backlog#1823)")]
     async fn save_tiering_config_if_current<S>(
         &self,
         api: Arc<S>,

crates/ecstore/src/services/tier/tier_mutation_intent.rs

@@ -305,6 +305,10 @@ impl TierMutationIntent {
     }
 }
 
+#[allow(
+    dead_code,
+    reason = "intent-record persistence asserted by store::init tests (backlog#1823)"
+)]
 pub(crate) fn tier_mutation_intent_record_object_name(mutation_id: Uuid) -> Result<String> {
     tier_mutation_intent_record_object_name_with_prefix(TIER_MUTATION_INTENT_RECORD_PREFIX, mutation_id)
 }
@@ -317,6 +321,10 @@ fn tier_mutation_intent_record_object_name_with_prefix(prefix: &str, mutation_id
     Ok(format!("{}/{}/{}/{}.json", prefix, &mutation_key[..2], &mutation_key[2..4], mutation_key))
 }
 
+#[allow(
+    dead_code,
+    reason = "intent-record persistence asserted by store::init tests (backlog#1823)"
+)]
 pub(crate) fn tier_mutation_intent_id_from_record_object_name(object: &str) -> Result<Uuid> {
     tier_mutation_intent_id_from_record_object_name_with_prefix(TIER_MUTATION_INTENT_RECORD_PREFIX, object)
 }
@@ -355,6 +363,10 @@ fn tier_mutation_intent_id_from_record_object_name_with_prefix(prefix: &str, obj
     Uuid::parse_str(mutation_key).map_err(|_| TierMutationIntentError::Corrupt("intent record path has invalid uuid"))
 }
 
+#[allow(
+    dead_code,
+    reason = "intent-record persistence asserted by store::init tests (backlog#1823)"
+)]
 pub(crate) async fn save_tier_mutation_intent_record<S>(api: Arc<S>, intent: &TierMutationIntent) -> EcstoreResult<()>
 where
     S: EcstoreObjectIO,
@@ -446,6 +458,10 @@ where
     Ok((intent, etag))
 }
 
+#[allow(
+    dead_code,
+    reason = "intent-record persistence asserted by store::init tests (backlog#1823)"
+)]
 pub(crate) async fn save_tier_mutation_intent_record_if_current<S>(
     api: Arc<S>,
     intent: &TierMutationIntent,

crates/ecstore/src/services/tier/warm_backend_gcs.rs

@@ -41,10 +41,7 @@ use crate::services::tier::{
 };
 use tracing::warn;
 
-const MAX_MULTIPART_PUT_OBJECT_SIZE: i64 = 1024 * 1024 * 1024 * 1024 * 5;
-const MAX_PARTS_COUNT: i64 = 10000;
 const _MAX_PART_SIZE: i64 = 1024 * 1024 * 1024 * 5;
-const MIN_PART_SIZE: i64 = 1024 * 1024 * 128;
 
 fn parse_generation(remote_version: &str) -> Result<Option<i64>, Error> {
     if remote_version.is_empty() {
@@ -64,7 +61,6 @@ pub struct WarmBackendGCS {
     pub control: Arc<StorageControl>,
     pub bucket: String,
     pub prefix: String,
-    pub storage_class: String,
 }
 
 impl WarmBackendGCS {
@@ -104,7 +100,6 @@ impl WarmBackendGCS {
             control,
             bucket: conf.bucket.clone(),
             prefix: conf.prefix.strip_suffix("/").unwrap_or(&conf.prefix).to_owned(),
-            storage_class: "".to_string(),
         })
     }
 

crates/ecstore/src/services/tier/warm_backend_s3.rs

@@ -33,8 +33,6 @@ use crate::client::{
     transition_api::{BucketLookupType, Options, TransitionClient, TransitionCore},
     transition_api::{ReadCloser, ReaderImpl},
 };
-use crate::error::ErrorResponse;
-use crate::error::error_resp_to_object_err;
 use crate::services::tier::{
     tier_config::TierS3,
     warm_backend::{

crates/ecstore/src/services/tier/warm_backend_s3sdk.rs

@@ -1,200 +0,0 @@
-// Copyright 2024 RustFS Team
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-#![allow(unused_imports)]
-#![allow(unused_variables)]
-#![allow(unused_mut)]
-#![allow(unused_assignments)]
-#![allow(unused_must_use)]
-#![allow(clippy::all)]
-
-use std::collections::HashMap;
-use std::sync::Arc;
-use url::Url;
-
-use aws_config::meta::region::RegionProviderChain;
-use aws_sdk_s3::Client;
-use aws_sdk_s3::config::{Credentials, Region};
-use aws_sdk_s3::primitives::ByteStream;
-
-use crate::client::{
-    api_get_options::GetObjectOptions,
-    api_put_object::PutObjectOptions,
-    api_remove::RemoveObjectOptions,
-    transition_api::{ReadCloser, ReaderImpl},
-};
-use crate::error::ErrorResponse;
-use crate::error::error_resp_to_object_err;
-use crate::services::tier::{
-    tier_config::TierS3,
-    warm_backend::{WarmBackend, WarmBackendGetOpts},
-};
-
-pub struct WarmBackendS3 {
-    pub client: Arc<Client>,
-    pub bucket: String,
-    pub prefix: String,
-    pub storage_class: String,
-}
-
-impl WarmBackendS3 {
-    pub async fn new(conf: &TierS3, tier: &str) -> Result<Self, std::io::Error> {
-        let u = match Url::parse(&conf.endpoint) {
-            Ok(u) => u,
-            Err(err) => {
-                return Err(std::io::Error::other(err.to_string()));
-            }
-        };
-
-        if conf.aws_role_web_identity_token_file == "" && conf.aws_role_arn != ""
-            || conf.aws_role_web_identity_token_file != "" && conf.aws_role_arn == ""
-        {
-            return Err(std::io::Error::other("both the token file and the role ARN are required"));
-        } else if conf.access_key == "" && conf.secret_key != "" || conf.access_key != "" && conf.secret_key == "" {
-            return Err(std::io::Error::other("both the access and secret keys are required"));
-        } else if conf.aws_role
-            && (conf.aws_role_web_identity_token_file != ""
-                || conf.aws_role_arn != ""
-                || conf.access_key != ""
-                || conf.secret_key != "")
-        {
-            return Err(std::io::Error::other(
-                "AWS Role cannot be activated with static credentials or the web identity token file",
-            ));
-        } else if conf.bucket == "" {
-            return Err(std::io::Error::other("no bucket name was provided"));
-        }
-
-        let creds;
-        if conf.access_key != "" && conf.secret_key != "" {
-            creds = Credentials::new(
-                conf.access_key.clone(), // access_key_id
-                conf.secret_key.clone(), // secret_access_key
-                None,                    // session_token (optional)
-                None,
-                "Static",
-            );
-        } else {
-            return Err(std::io::Error::other("insufficient parameters for S3 backend authentication"));
-        }
-        let region_provider = RegionProviderChain::default_provider().or_else(Region::new(conf.region.clone()));
-        #[allow(deprecated)]
-        let config = aws_config::from_env()
-            .endpoint_url(conf.endpoint.clone())
-            .region(region_provider)
-            .credentials_provider(creds)
-            .load()
-            .await;
-        let client = Client::new(&config);
-        let client = Arc::new(client);
-        Ok(Self {
-            client,
-            bucket: conf.bucket.clone(),
-            prefix: conf.prefix.clone().trim_matches('/').to_string(),
-            storage_class: conf.storage_class.clone(),
-        })
-    }
-
-    pub fn get_dest(&self, object: &str) -> String {
-        let mut dest_obj = object.to_string();
-        if self.prefix != "" {
-            dest_obj = format!("{}/{}", &self.prefix, object);
-        }
-        return dest_obj;
-    }
-}
-
-#[async_trait::async_trait]
-impl WarmBackend for WarmBackendS3 {
-    async fn put_with_meta(
-        &self,
-        object: &str,
-        r: ReaderImpl,
-        length: i64,
-        meta: HashMap<String, String>,
-    ) -> Result<String, std::io::Error> {
-        let client = self.client.clone();
-        let Ok(res) = client
-            .put_object()
-            .bucket(&self.bucket)
-            .key(&self.get_dest(object))
-            .body(match r {
-                ReaderImpl::Body(content_body) => ByteStream::from(content_body.to_vec()),
-                ReaderImpl::ObjectBody(mut content_body) => ByteStream::from(content_body.read_all().await?),
-            })
-            .send()
-            .await
-        else {
-            return Err(std::io::Error::other("put_object error"));
-        };
-
-        Ok(res.version_id().unwrap_or("").to_string())
-    }
-
-    async fn put(&self, object: &str, r: ReaderImpl, length: i64) -> Result<String, std::io::Error> {
-        self.put_with_meta(object, r, length, HashMap::new()).await
-    }
-
-    async fn get(&self, object: &str, rv: &str, opts: WarmBackendGetOpts) -> Result<ReadCloser, std::io::Error> {
-        let client = self.client.clone();
-        let mut req = client.get_object().bucket(&self.bucket).key(&self.get_dest(object));
-
-        if !rv.is_empty() {
-            req = req.version_id(rv);
-        }
-
-        if opts.start_offset >= 0 && opts.length > 0 {
-            let end = opts
-                .start_offset
-                .checked_add(opts.length)
-                .and_then(|v| v.checked_sub(1))
-                .ok_or_else(|| std::io::Error::other("invalid range: overflow"))?;
-            req = req.range(format!("bytes={}-{}", opts.start_offset, end));
-        }
-
-        let res = req.send().await.map_err(|e| std::io::Error::other(e.to_string()))?;
-
-        Ok(ReadCloser::new(std::io::Cursor::new(
-            res.body.collect().await.map(|data| data.into_bytes().to_vec())?,
-        )))
-    }
-
-    async fn remove(&self, object: &str, rv: &str) -> Result<(), std::io::Error> {
-        let client = self.client.clone();
-        let mut req = client.delete_object().bucket(&self.bucket).key(&self.get_dest(object));
-
-        if !rv.is_empty() {
-            req = req.version_id(rv);
-        }
-
-        req.send().await.map_err(|e| std::io::Error::other(e.to_string()))?;
-
-        Ok(())
-    }
-
-    async fn in_use(&self) -> Result<bool, std::io::Error> {
-        let client = self.client.clone();
-        let Ok(res) = client
-            .list_objects_v2()
-            .bucket(&self.bucket)
-            //.max_keys(10)
-            //.into_paginator()
-            .send()
-            .await
-        else {
-            return Err(std::io::Error::other("list_objects_v2 error"));
-        };
-
-        Ok(res.common_prefixes.unwrap_or_default().len() > 0 || res.contents.unwrap_or_default().len() > 0)
-    }
-}

crates/ecstore/src/set_disk/core/io_primitives.rs

@@ -46,6 +46,7 @@ use crate::diagnostics::get::{
     GetObjectFailureReason, classify_disk_error, get_stage_timer_if_enabled, record_get_object_pipeline_failure,
     record_get_object_pipeline_failure_for_path, record_get_stage_duration_if_enabled,
 };
+use crate::disk::disk_store::DiskStoreRenameDataExt;
 use crate::disk::local::DELETE_DATA_DIR_MARKER_PREFIX;
 use crate::disk::{
     DataDirDeleteStatus, OldCurrentSize, PART_TRANSACTION_NEW_META, PART_TRANSACTION_OLD_META, PART_TRANSACTION_ROLLBACK,
@@ -590,7 +591,7 @@ impl MetadataQuorumAccumulator {
         })
     }
 
-    pub(in crate::set_disk) fn default_write_quorum(&self) -> usize {
+    pub(crate) fn default_write_quorum(&self) -> usize {
         if self.default_parity_count == 0 || self.default_parity_count >= self.total_disks {
             return self.total_disks;
         }
@@ -3011,12 +3012,41 @@ impl RenameConvergence {
     }
 }
 
+pub(in crate::set_disk) struct RenameDataCommit {
+    pub(in crate::set_disk) online_disks: Vec<Option<DiskStore>>,
+    pub(in crate::set_disk) convergence: RenameConvergence,
+    pub(in crate::set_disk) data_dir: Option<Uuid>,
+    pub(in crate::set_disk) cleanup_disks: Vec<Option<DiskStore>>,
+    pub(in crate::set_disk) old_current_size: Option<OldCurrentSize>,
+    pub(in crate::set_disk) committed_file_info: FileInfo,
+}
+
+type RenameDataLegacyTuple = (
+    Vec<Option<DiskStore>>,
+    RenameConvergence,
+    Option<Uuid>,
+    Vec<Option<DiskStore>>,
+    Option<OldCurrentSize>,
+);
+
+impl RenameDataCommit {
+    fn into_legacy_tuple(self) -> RenameDataLegacyTuple {
+        (
+            self.online_disks,
+            self.convergence,
+            self.data_dir,
+            self.cleanup_disks,
+            self.old_current_size,
+        )
+    }
+}
+
 impl SetDisks {
     pub(in crate::set_disk) fn default_read_quorum(&self) -> usize {
         self.set_drive_count - self.default_parity_count
     }
 
-    pub(in crate::set_disk) fn default_write_quorum(&self) -> usize {
+    pub(crate) fn default_write_quorum(&self) -> usize {
         let mut data_count = self.set_drive_count - self.default_parity_count;
         if data_count == self.default_parity_count {
             data_count += 1
@@ -3025,6 +3055,97 @@ impl SetDisks {
         data_count
     }
 
+    pub(in crate::set_disk) async fn prepare_quota_mutation_fences(
+        disks: &[Option<DiskStore>],
+        bucket: &str,
+        object: &str,
+        write_quorum: usize,
+    ) -> crate::error::Result<(Vec<Option<DiskStore>>, Vec<Option<SnapshotLeaseToken>>)> {
+        let fence_path = crate::disk::quota_mutation_fence_path(bucket, object);
+        let results = join_all(disks.iter().map(|disk| {
+            let disk = disk.clone();
+            let fence_path = fence_path.clone();
+            async move {
+                let disk = disk?;
+                match disk.acquire_snapshot_lease(RUSTFS_META_BUCKET, &fence_path).await {
+                    Ok(token) => Some((disk, token)),
+                    Err(_) => None,
+                }
+            }
+        }))
+        .await;
+        if results.iter().flatten().count() < write_quorum {
+            for (disk, token) in results.iter().flatten() {
+                let _ = disk.release_snapshot_lease(RUSTFS_META_BUCKET, &fence_path, *token).await;
+            }
+            return Err(StorageError::ErasureWriteQuorum);
+        }
+        let mut fenced_disks = Vec::with_capacity(results.len());
+        let mut tokens = Vec::with_capacity(results.len());
+        for result in results {
+            match result {
+                Some((disk, token)) => {
+                    fenced_disks.push(Some(disk));
+                    tokens.push(Some(token));
+                }
+                None => {
+                    fenced_disks.push(None);
+                    tokens.push(None);
+                }
+            }
+        }
+        Ok((fenced_disks, tokens))
+    }
+
+    pub(in crate::set_disk) async fn release_quota_mutation_fences(
+        disks: &[Option<DiskStore>],
+        tokens: &[Option<SnapshotLeaseToken>],
+        bucket: &str,
+        object: &str,
+        write_quorum: usize,
+    ) -> crate::error::Result<()> {
+        let fence_path = crate::disk::quota_mutation_fence_path(bucket, object);
+        let results = join_all(disks.iter().zip(tokens).filter_map(|(disk, token)| {
+            let disk = disk.as_ref()?.clone();
+            let token = (*token)?;
+            let fence_path = fence_path.clone();
+            Some(async move { disk.release_snapshot_lease(RUSTFS_META_BUCKET, &fence_path, token).await })
+        }))
+        .await;
+        if results.iter().filter(|result| result.is_ok()).count() < write_quorum {
+            return Err(StorageError::ErasureWriteQuorum);
+        }
+        Ok(())
+    }
+
+    pub(in crate::set_disk) fn assign_rename_data_indexes(file_infos: &mut [FileInfo]) {
+        for (index, file_info) in file_infos.iter_mut().enumerate() {
+            if file_info.erasure.index == 0 {
+                file_info.erasure.index = index + 1;
+            }
+        }
+    }
+
+    pub(in crate::set_disk) async fn abort_quota_reservation_after_fence(
+        reservation: crate::bucket::quota::reservation::QuotaReservation,
+        disks: &[Option<DiskStore>],
+        tokens: &[Option<SnapshotLeaseToken>],
+        bucket: &str,
+        object: &str,
+        write_quorum: usize,
+        fenced: bool,
+    ) {
+        let safe_to_abort = !fenced
+            || Self::release_quota_mutation_fences(disks, tokens, bucket, object, write_quorum)
+                .await
+                .is_ok();
+        if safe_to_abort {
+            reservation.abort().await;
+        } else {
+            reservation.defer_after_fence();
+        }
+    }
+
     #[tracing::instrument(level = "debug", skip(disks, file_infos))]
     #[allow(clippy::type_complexity)]
     pub(in crate::set_disk) async fn rename_data(
@@ -3035,13 +3156,22 @@ impl SetDisks {
         dst_bucket: &str,
         dst_object: &str,
         write_quorum: usize,
-    ) -> disk::error::Result<(
-        Vec<Option<DiskStore>>,
-        RenameConvergence,
-        Option<Uuid>,
-        Vec<Option<DiskStore>>,
-        Option<OldCurrentSize>,
-    )> {
+    ) -> disk::error::Result<RenameDataLegacyTuple> {
+        Self::rename_data_owned(disks, src_bucket, src_object, file_infos.to_vec(), dst_bucket, dst_object, write_quorum)
+            .await
+            .map(RenameDataCommit::into_legacy_tuple)
+    }
+
+    #[tracing::instrument(level = "debug", skip(disks, file_infos))]
+    pub(in crate::set_disk) async fn rename_data_owned(
+        disks: &[Option<DiskStore>],
+        src_bucket: &str,
+        src_object: &str,
+        file_infos: Vec<FileInfo>,
+        dst_bucket: &str,
+        dst_object: &str,
+        write_quorum: usize,
+    ) -> disk::error::Result<RenameDataCommit> {
         if let Some(file_info) = disks
             .iter()
             .zip(file_infos.iter())
@@ -3066,7 +3196,7 @@ impl SetDisks {
 
         let disk_count = disks.len();
         let fanout_disks = disks.to_vec();
-        let fanout_file_infos = file_infos.to_vec();
+        let fanout_file_infos = file_infos;
         let fanout_src_bucket = src_bucket.clone();
         let fanout_src_object = src_object.clone();
         let fanout_dst_bucket = dst_bucket.clone();
@@ -3078,9 +3208,9 @@ impl SetDisks {
         let fanout = tokio::spawn(async move {
             let futures = fanout_disks
                 .into_iter()
-                .zip(fanout_file_infos)
+                .zip(fanout_file_infos.iter())
                 .enumerate()
-                .map(|(i, (disk, mut file_info))| {
+                .map(|(i, (disk, file_info))| {
                     let src_bucket = fanout_src_bucket.clone();
                     let src_object = fanout_src_object.clone();
                     let dst_object = fanout_dst_object.clone();
@@ -3097,11 +3227,15 @@ impl SetDisks {
                         };
 
                         let is_delete_marker = file_info.is_canonical_delete_marker();
-                        if file_info.erasure.index == 0 {
-                            file_info.erasure.index = i + 1;
-                        }
-
-                        if !is_delete_marker && !file_info.has_valid_erasure_geometry() {
+                        let mut local_file_info;
+                        let file_info = if file_info.erasure.index == 0 {
+                            local_file_info = file_info.clone();
+                            local_file_info.erasure.index = i + 1;
+                            &local_file_info
+                        } else {
+                            file_info
+                        };
+                        if file_info.erasure.index == 0 || (!is_delete_marker && !file_info.has_valid_erasure_geometry()) {
                             return Err(DiskError::FileCorrupt);
                         }
 
@@ -3109,12 +3243,13 @@ impl SetDisks {
                         // A no-op immediately-ready future in production.
                         Self::rename_fanout_barrier(&dst_object, i, rename_fanout_barrier_phase::RENAME).await;
 
-                        disk.rename_data(&src_bucket, &src_object, file_info, &dst_bucket, &dst_object)
+                        disk.rename_data_borrowed(&src_bucket, &src_object, file_info, &dst_bucket, &dst_object)
                             .await
                     })
                     .catch_unwind()
                 });
-            join_all(futures).await
+            let results = join_all(futures).await;
+            (results, fanout_file_infos)
         });
 
         let mut disk_versions = vec![None; disk_count];
@@ -3122,7 +3257,7 @@ impl SetDisks {
         let mut cleanup_data_dirs = vec![None; disk_count];
         let mut old_current_sizes = vec![None; disk_count];
 
-        let results = fanout.await.map_err(|_| DiskError::Unexpected)?;
+        let (results, mut file_infos) = fanout.await.map_err(|_| DiskError::Unexpected)?;
 
         for (idx, result) in results.iter().enumerate() {
             match result {
@@ -3178,7 +3313,7 @@ impl SetDisks {
                 }
 
                 if let Some(disk) = disks[i].as_ref() {
-                    let fi = file_infos[i].clone();
+                    let fi = std::mem::take(&mut file_infos[i]);
                     let old_data_dir = data_dirs[i];
                     let disk = disk.clone();
                     let dst_bucket = dst_bucket.clone();
@@ -3301,6 +3436,8 @@ impl SetDisks {
         let convergence = Self::classify_rename_convergence(&disk_versions, &errs);
         let old_current_size = Self::reduce_common_old_current_size(&old_current_sizes, write_quorum);
         let online_disks = Self::eval_disks(disks, &errs);
+        let committed_slot = online_disks.iter().position(Option::is_some).ok_or(DiskError::Unexpected)?;
+        let committed_file_info = std::mem::take(&mut file_infos[committed_slot]);
         let cleanup_disks = if let Some(data_dir) = data_dir {
             disks
                 .iter()
@@ -3318,7 +3455,14 @@ impl SetDisks {
             vec![None; disks.len()]
         };
 
-        Ok((online_disks, convergence, data_dir, cleanup_disks, old_current_size))
+        Ok(RenameDataCommit {
+            online_disks,
+            convergence,
+            data_dir,
+            cleanup_disks,
+            old_current_size,
+            committed_file_info,
+        })
     }
 
     /// rustfs/backlog#1009: reduce the per-disk observations of the

crates/ecstore/src/set_disk/mod.rs

@@ -719,8 +719,8 @@ pub(crate) use core::io_primitives::disk_call_counters;
 mod ctx;
 mod metadata;
 mod ops;
-#[cfg(test)]
-pub(crate) use ops::multipart::{MultipartCommitBarrier, MultipartCommitPause};
+#[cfg(any(test, feature = "test-util"))]
+pub use ops::multipart::{MultipartCommitBarrier, MultipartCommitPause};
 #[cfg(feature = "test-util")]
 pub(crate) use ops::object::TransitionCleanupStoreBarrier as SetDiskTransitionCleanupStoreBarrier;
 pub(crate) use ops::object::body_cache_plaintext_len;
@@ -2741,12 +2741,12 @@ mod write_layout_tests {
 
         let held_layout = resolve_write_layout(&held, 0, 4, 2, None, false).expect("held snapshot should remain valid");
         assert_eq!(held_layout.parity_drives, 2);
-        assert!(held.should_inline(512, false));
+        assert!(held.should_inline(512, held_layout.data_drives, false));
 
         let current = published.load_full();
         let current_layout = resolve_write_layout(&current, 0, 4, 2, None, false).expect("new snapshot should resolve");
         assert_eq!(current_layout.parity_drives, 1);
-        assert!(!current.should_inline(512, false));
+        assert!(!current.should_inline(512, current_layout.data_drives, false));
     }
 }
 
@@ -2792,6 +2792,9 @@ pub struct SetDisks {
     get_object_metadata_cache: moka::future::Cache<GetObjectMetadataCacheKey, Arc<GetObjectMetadataCacheEntry>>,
     get_object_metadata_cache_hash_builder: std::collections::hash_map::RandomState,
     get_object_metadata_cache_generations: Arc<[AtomicU64]>,
+    /// GET codecs keyed by every persisted layout dimension that affects
+    /// decoding. Clones of a set share the memoized shells.
+    erasure_cache: Arc<ErasureCache>,
     pub lockers: Vec<Arc<dyn LockClient>>,
     shared_lockers: Arc<[Arc<dyn LockClient>]>,
     local_lock_manager: Arc<rustfs_lock::GlobalLockManager>,
@@ -2814,6 +2817,137 @@ pub struct SetDisks {
     storage_class_config_override: Arc<std::sync::RwLock<Option<Arc<storageclass::Config>>>>,
 }
 
+const ERASURE_CACHE_MAX_ENTRIES: usize = 32;
+
+#[derive(Clone, Copy, Debug, Eq, Hash, PartialEq)]
+struct ErasureCacheKey {
+    data_shards: usize,
+    parity_shards: usize,
+    block_size: usize,
+    uses_legacy: bool,
+}
+
+struct ErasureCache {
+    entries: parking_lot::RwLock<HashMap<ErasureCacheKey, Arc<coding::Erasure>>>,
+}
+
+impl std::fmt::Debug for ErasureCache {
+    fn fmt(&self, formatter: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        formatter
+            .debug_struct("ErasureCache")
+            .field("entries", &self.entries.read().len())
+            .finish()
+    }
+}
+
+impl ErasureCache {
+    fn new() -> Self {
+        Self {
+            entries: parking_lot::RwLock::new(HashMap::new()),
+        }
+    }
+
+    fn get_or_try_insert(
+        &self,
+        key: ErasureCacheKey,
+    ) -> std::result::Result<Arc<coding::Erasure>, coding::ErasureConstructionError> {
+        if let Some(erasure) = self.entries.read().get(&key) {
+            return Ok(Arc::clone(erasure));
+        }
+
+        // Serialize first construction for a key so concurrent cold GETs still
+        // create exactly one shell. Codec construction never awaits.
+        let mut entries = self.entries.write();
+        if let Some(erasure) = entries.get(&key) {
+            return Ok(Arc::clone(erasure));
+        }
+        let erasure = Arc::new(coding::Erasure::try_new_with_options(
+            key.data_shards,
+            key.parity_shards,
+            key.block_size,
+            key.uses_legacy,
+        )?);
+        if entries.len() < ERASURE_CACHE_MAX_ENTRIES {
+            entries.insert(key, Arc::clone(&erasure));
+        }
+        Ok(erasure)
+    }
+
+    fn get_for_file_info(&self, fi: &FileInfo) -> Result<Arc<coding::Erasure>> {
+        self.get_or_try_insert(ErasureCacheKey {
+            data_shards: fi.erasure.data_blocks,
+            parity_shards: fi.erasure.parity_blocks,
+            block_size: fi.erasure.block_size,
+            uses_legacy: fi.uses_legacy_checksum,
+        })
+        .map_err(Error::from)
+    }
+}
+
+#[cfg(test)]
+mod erasure_cache_tests {
+    use super::*;
+
+    #[test]
+    fn reuses_shells_and_keeps_every_layout_dimension_in_the_key() {
+        let cache = ErasureCache::new();
+        let base = ErasureCacheKey {
+            data_shards: 4,
+            parity_shards: 2,
+            block_size: 1_048_576,
+            uses_legacy: false,
+        };
+        let first = cache.get_or_try_insert(base).expect("modern shell should construct");
+        let reused = cache.get_or_try_insert(base).expect("same modern shell should be cached");
+        assert!(Arc::ptr_eq(&first, &reused));
+
+        for distinct in [
+            ErasureCacheKey { data_shards: 3, ..base },
+            ErasureCacheKey {
+                parity_shards: 1,
+                ..base
+            },
+            ErasureCacheKey {
+                block_size: 524_288,
+                ..base
+            },
+            ErasureCacheKey {
+                uses_legacy: true,
+                ..base
+            },
+        ] {
+            let shell = cache.get_or_try_insert(distinct).expect("distinct shell should construct");
+            assert!(!Arc::ptr_eq(&first, &shell));
+        }
+        assert_eq!(cache.entries.read().len(), 5);
+    }
+
+    #[test]
+    fn does_not_cache_invalid_layouts_or_grow_past_the_bound() {
+        let cache = ErasureCache::new();
+        let invalid = ErasureCacheKey {
+            data_shards: 4,
+            parity_shards: 2,
+            block_size: 0,
+            uses_legacy: false,
+        };
+        assert!(cache.get_or_try_insert(invalid).is_err());
+        assert!(cache.entries.read().is_empty());
+
+        for block_size in 1..=(ERASURE_CACHE_MAX_ENTRIES + 1) {
+            cache
+                .get_or_try_insert(ErasureCacheKey {
+                    data_shards: 4,
+                    parity_shards: 2,
+                    block_size,
+                    uses_legacy: false,
+                })
+                .expect("bounded cache fixture should construct");
+        }
+        assert_eq!(cache.entries.read().len(), ERASURE_CACHE_MAX_ENTRIES);
+    }
+}
+
 #[derive(Clone, Debug, Eq, PartialEq)]
 struct GetObjectMetadataCacheKey {
     bucket: Arc<str>,
@@ -3212,6 +3346,7 @@ impl SetDisks {
                     .map(|_| AtomicU64::new(0))
                     .collect::<Vec<_>>(),
             ),
+            erasure_cache: Arc::new(ErasureCache::new()),
             lockers,
             shared_lockers,
             // Sourced from the instance context so each instance owns its lock
@@ -9816,6 +9951,7 @@ mod tests {
         let body = SetDisks::try_get_object_direct_data_shards_with_fileinfo(
             "bucket",
             "object",
+            Arc::new(ErasureCache::new()),
             &fi,
             &disk_files,
             &disks,
@@ -9879,6 +10015,7 @@ mod tests {
         let body = SetDisks::try_get_object_direct_data_shards_with_fileinfo(
             "bucket",
             "object",
+            Arc::new(ErasureCache::new()),
             &fi,
             &disk_files,
             &vec![Some(disk); erasure.total_shard_count()],
@@ -9959,6 +10096,7 @@ mod tests {
         let body = SetDisks::try_get_object_direct_data_shards_with_fileinfo(
             bucket,
             object,
+            Arc::new(ErasureCache::new()),
             &fi,
             &files,
             &disks,
@@ -10044,6 +10182,7 @@ mod tests {
             SetDisks::get_object_with_fileinfo(
                 bucket,
                 object,
+                Arc::new(ErasureCache::new()),
                 range_offset,
                 range_length as i64,
                 &mut writer,
@@ -10155,6 +10294,7 @@ mod tests {
             SetDisks::get_object_with_fileinfo(
                 bucket,
                 object,
+                Arc::new(ErasureCache::new()),
                 0,
                 total_size as i64,
                 &mut writer,

crates/ecstore/src/set_disk/ops/heal.rs

@@ -13,6 +13,7 @@
 // limitations under the License.
 
 use super::super::*;
+use crate::disk::disk_store::DiskStoreRenameDataExt;
 use crate::io_support::bitrot::object_mmap_read_enabled;
 use crate::storage_api_contracts::namespace::NamespaceLocking as _;
 use tracing::trace;
@@ -1164,10 +1165,10 @@ impl SetDisks {
                                 let rename_result = if should_fail_heal_rename(bucket, object, index) {
                                     Err(DiskError::Unexpected)
                                 } else {
-                                    disk.rename_data(
+                                    disk.rename_data_borrowed(
                                         RUSTFS_META_TMP_BUCKET,
                                         &tmp_id,
-                                        parts_metadata[index].clone(),
+                                        &parts_metadata[index],
                                         bucket,
                                         object,
                                     )
@@ -1425,6 +1426,33 @@ impl SetDisks {
     /// post-heal tail — reclaim identically. Never fails the heal: delete errors
     /// are logged and swallowed. Callers must gate this on `!opts.dry_run`.
     async fn reclaim_orphan_data_dirs_best_effort(&self, bucket: &str, object: &str) {
+        match self.reconcile_old_data_cleanup_receipts(bucket, object).await {
+            Ok(removed) if removed > 0 => {
+                debug!(
+                    event = EVENT_SET_DISK_HEAL,
+                    component = LOG_COMPONENT_ECSTORE,
+                    subsystem = LOG_SUBSYSTEM_SET_DISK,
+                    bucket,
+                    object,
+                    removed,
+                    state = "old_data_cleanup_receipt_reconciled",
+                    "Set disk old-data cleanup receipts reconciled"
+                );
+            }
+            Ok(_) => {}
+            Err(e) => {
+                warn!(
+                    event = EVENT_SET_DISK_HEAL,
+                    component = LOG_COMPONENT_ECSTORE,
+                    subsystem = LOG_SUBSYSTEM_SET_DISK,
+                    bucket,
+                    object,
+                    error = %e,
+                    state = "old_data_cleanup_receipt_reconcile_failed",
+                    "Set disk old-data cleanup receipt reconcile failed"
+                );
+            }
+        }
         match self.reclaim_orphan_data_dirs(bucket, object).await {
             Ok(removed) if removed > 0 => {
                 debug!(

crates/ecstore/src/set_disk/read.rs

@@ -482,6 +482,7 @@ impl SetDisks {
     pub(super) async fn try_get_object_direct_data_shards_with_fileinfo(
         bucket: &str,
         object: &str,
+        erasure_cache: Arc<ErasureCache>,
         fi: &FileInfo,
         files: &[FileInfo],
         disks: &[Option<DiskStore>],
@@ -502,13 +503,7 @@ impl SetDisks {
             return Ok(None);
         }
 
-        let erasure = coding::Erasure::try_new_with_options(
-            fi.erasure.data_blocks,
-            fi.erasure.parity_blocks,
-            fi.erasure.block_size,
-            fi.uses_legacy_checksum,
-        )
-        .map_err(Error::from)?;
+        let erasure = erasure_cache.get_for_file_info(fi)?;
 
         let checksum_info = fi.erasure.get_checksum_info(part.number);
         let checksum_algo = if fi.uses_legacy_checksum && checksum_info.algorithm == HashAlgorithm::HighwayHash256S {
@@ -636,6 +631,7 @@ impl SetDisks {
         // &self,
         bucket: &str,
         object: &str,
+        erasure_cache: Arc<ErasureCache>,
         offset: usize,
         length: i64,
         writer: &mut W,
@@ -730,13 +726,7 @@ impl SetDisks {
             object, offset, length, end_offset, part_index, last_part_index, last_part_relative_offset, "Multipart read bounds"
         );
 
-        let erasure = coding::Erasure::try_new_with_options(
-            fi.erasure.data_blocks,
-            fi.erasure.parity_blocks,
-            fi.erasure.block_size,
-            fi.uses_legacy_checksum,
-        )
-        .map_err(Error::from)?;
+        let erasure = erasure_cache.get_for_file_info(&fi)?;
 
         let part_indices: Vec<usize> = (part_index..=last_part_index).collect();
         debug!(bucket, object, ?part_indices, "Multipart part indices to stream");
@@ -1170,6 +1160,7 @@ impl SetDisks {
     pub(super) async fn get_object_decode_reader_with_fileinfo(
         bucket: &str,
         object: &str,
+        erasure_cache: Arc<ErasureCache>,
         fi: &FileInfo,
         files: &[FileInfo],
         disks: &[Option<DiskStore>],
@@ -1180,14 +1171,7 @@ impl SetDisks {
         metrics_size_bucket: &'static str,
         prefer_data_blocks_first_reader_setup: bool,
     ) -> Result<GetCodecStreamingReaderBuildOutcome> {
-        let erasure = coding::Erasure::try_new_with_options(
-            fi.erasure.data_blocks,
-            fi.erasure.parity_blocks,
-            fi.erasure.block_size,
-            fi.uses_legacy_checksum,
-        )
-        .map_err(Error::from)?;
-
+        let erasure = erasure_cache.get_for_file_info(fi)?;
         let (disks, files) = Self::shuffle_disks_and_parts_metadata_by_index(disks, files, fi);
 
         if fi.parts.len() == 1 {
@@ -1574,7 +1558,7 @@ struct LazyCodecPartContext {
     fi: FileInfo,
     files: Vec<FileInfo>,
     disks: Vec<Option<DiskStore>>,
-    erasure: coding::Erasure,
+    erasure: Arc<coding::Erasure>,
     skip_verify_bitrot: bool,
     metrics_object_class: &'static str,
     metrics_size_bucket: &'static str,
@@ -2058,6 +2042,7 @@ mod metadata_cache_tests {
         let err = SetDisks::get_object_with_fileinfo(
             "bucket",
             "object",
+            Arc::new(ErasureCache::new()),
             0,
             1,
             &mut output,
@@ -2088,6 +2073,7 @@ mod metadata_cache_tests {
         let err = SetDisks::get_object_with_fileinfo(
             bucket,
             object,
+            Arc::new(ErasureCache::new()),
             2,
             1,
             &mut output,
@@ -2111,6 +2097,7 @@ mod metadata_cache_tests {
         let err = SetDisks::get_object_with_fileinfo(
             bucket,
             object,
+            Arc::new(ErasureCache::new()),
             usize::MAX,
             1,
             &mut output,
@@ -2132,6 +2119,7 @@ mod metadata_cache_tests {
         let err = SetDisks::get_object_with_fileinfo(
             bucket,
             object,
+            Arc::new(ErasureCache::new()),
             1,
             1,
             &mut output,
@@ -2155,6 +2143,7 @@ mod metadata_cache_tests {
         let err = SetDisks::get_object_with_fileinfo(
             bucket,
             object,
+            Arc::new(ErasureCache::new()),
             0,
             1,
             &mut output,
@@ -2192,6 +2181,7 @@ mod metadata_cache_tests {
         SetDisks::get_object_with_fileinfo(
             bucket,
             object,
+            Arc::new(ErasureCache::new()),
             0,
             0,
             &mut output,
@@ -2224,6 +2214,7 @@ mod metadata_cache_tests {
         let err = SetDisks::get_object_with_fileinfo(
             bucket,
             object,
+            Arc::new(ErasureCache::new()),
             0,
             1,
             &mut output,
@@ -4128,6 +4119,7 @@ mod tests {
         let result = SetDisks::get_object_decode_reader_with_fileinfo(
             CODEC_STREAMING_TEST_BUCKET,
             CODEC_STREAMING_TEST_OBJECT,
+            Arc::new(ErasureCache::new()),
             &fi,
             &[],
             &[],
@@ -4150,6 +4142,7 @@ mod tests {
         let invalid_size = SetDisks::get_object_decode_reader_with_fileinfo(
             CODEC_STREAMING_TEST_BUCKET,
             CODEC_STREAMING_TEST_OBJECT,
+            Arc::new(ErasureCache::new()),
             &single_part,
             &[],
             &[],
@@ -4170,6 +4163,7 @@ mod tests {
             SetDisks::get_object_decode_reader_with_fileinfo(
                 CODEC_STREAMING_TEST_BUCKET,
                 CODEC_STREAMING_TEST_OBJECT,
+                Arc::new(ErasureCache::new()),
                 &multipart,
                 &[],
                 &[],
@@ -4194,6 +4188,7 @@ mod tests {
             SetDisks::get_object_decode_reader_with_fileinfo(
                 CODEC_STREAMING_TEST_BUCKET,
                 CODEC_STREAMING_TEST_OBJECT,
+                Arc::new(ErasureCache::new()),
                 &multipart,
                 &[],
                 &[],
@@ -4222,6 +4217,7 @@ mod tests {
                 SetDisks::get_object_decode_reader_with_fileinfo(
                     CODEC_STREAMING_TEST_BUCKET,
                     CODEC_STREAMING_TEST_OBJECT,
+                    Arc::new(ErasureCache::new()),
                     &multipart,
                     &[],
                     &[],
@@ -4275,6 +4271,7 @@ mod tests {
                 SetDisks::get_object_decode_reader_with_fileinfo(
                     CODEC_STREAMING_TEST_BUCKET,
                     CODEC_STREAMING_TEST_OBJECT,
+                    Arc::new(ErasureCache::new()),
                     &fi,
                     &files,
                     &disks,
@@ -4328,6 +4325,7 @@ mod tests {
             SetDisks::get_object_decode_reader_with_fileinfo(
                 CODEC_STREAMING_TEST_BUCKET,
                 CODEC_STREAMING_TEST_OBJECT,
+                Arc::new(ErasureCache::new()),
                 &fi,
                 &files,
                 &disks,
@@ -4372,6 +4370,7 @@ mod tests {
         SetDisks::get_object_with_fileinfo(
             CODEC_STREAMING_TEST_BUCKET,
             CODEC_STREAMING_TEST_OBJECT,
+            Arc::new(ErasureCache::new()),
             0,
             part_data.len() as i64,
             &mut output,

crates/ecstore/src/set_disk/replication.rs

@@ -48,6 +48,23 @@ impl RestoreCleanupIdentity {
     }
 }
 
+fn ensure_restore_metadata_lock_held(bucket: &str, object: &str, opts: &ObjectOptions, mode: &'static str) -> Result<()> {
+    if opts
+        .namespace_lock_fence
+        .as_ref()
+        .is_some_and(NamespaceLockFence::is_lock_lost)
+    {
+        return Err(StorageError::NamespaceLockQuorumUnavailable {
+            mode,
+            bucket: bucket.to_string(),
+            object: object.to_string(),
+            required: 1,
+            achieved: 0,
+        });
+    }
+    Ok(())
+}
+
 impl SetDisks {
     pub(super) async fn finalize_restore_metadata(
         &self,
@@ -88,6 +105,7 @@ impl SetDisks {
         if !expected.matches_file_info(&fi, &expected_etag) {
             return Err(Error::other("restored object changed before restore metadata finalization"));
         }
+        ensure_restore_metadata_lock_held(bucket, object, opts, "restore_finalize_metadata")?;
         let restore_expiry =
             lifecycle::expected_expiry_time(OffsetDateTime::now_utc(), opts.transition.restore_request.days.unwrap_or(1));
         fi.metadata.insert(
@@ -159,6 +177,7 @@ impl SetDisks {
         if !expected.matches_file_info(&fi, &expected_etag) {
             return Ok(());
         }
+        ensure_restore_metadata_lock_held(bucket, object, opts, "restore_cleanup_metadata")?;
         fi.metadata.remove(X_AMZ_RESTORE.as_str());
         fi.metadata.remove(AMZ_RESTORE_EXPIRY_DAYS);
         fi.metadata.remove(AMZ_RESTORE_REQUEST_DATE);

crates/ecstore/src/store/init.rs

@@ -13,7 +13,7 @@
 // limitations under the License.
 
 use super::*;
-use crate::core::pools::local_decommission_queue_prefix;
+use crate::core::pools::{local_decommission_queue_prefix, pool_meta_has_active_decommission};
 use crate::error::is_err_decommission_running;
 use crate::runtime::instance::InstanceContext;
 use crate::runtime::sources as runtime_sources;
@@ -109,14 +109,6 @@ fn should_auto_start_rebalance_after_init(decommission_running: bool, rebalance_
     rebalance_meta_loaded && !decommission_running
 }
 
-fn pool_meta_has_active_decommission(meta: &PoolMeta) -> bool {
-    meta.pools.iter().any(|pool| {
-        pool.decommission
-            .as_ref()
-            .is_some_and(|info| info.has_decommission_state() && !info.complete && !info.failed && !info.canceled)
-    })
-}
-
 async fn wait_for_local_decommission_resume_delay(rx: &CancellationToken, delay: Duration) -> bool {
     tokio::select! {
         _ = rx.cancelled() => false,
@@ -1182,6 +1174,32 @@ mod tests {
         }
     }
 
+    #[tokio::test]
+    #[serial_test::serial(storage_class_env)]
+    async fn quota_object_fence_ignores_an_unrelated_offline_pool() {
+        let temp_dir = tempfile::tempdir().expect("create quota fence store dir");
+        let (_ctx, store, shutdown) =
+            without_storage_class_env(build_isolated_test_store(temp_dir.path(), "quota-object-fence", &[4, 4])).await;
+        crate::bucket::metadata_sys::init_bucket_metadata_sys(store.clone(), Vec::new()).await;
+        let bucket = format!("quota-object-fence-{}", uuid::Uuid::new_v4());
+        let object = "object.bin";
+        store
+            .make_bucket(&bucket, &MakeBucketOptions::default())
+            .await
+            .expect("create quota fence bucket");
+        store.pools[1].disk_set[0].disks.write().await.fill(None);
+
+        crate::bucket::quota::reservation::fence_namespace_mutations_for_test(&store, &bucket, object, Some((0, 0)))
+            .await
+            .expect("the selected pool fence should ignore an unrelated offline pool");
+        let err = crate::bucket::quota::reservation::fence_namespace_mutations_for_test(&store, &bucket, object, None)
+            .await
+            .expect_err("legacy reservations must conservatively fence every pool");
+        assert!(matches!(err, StorageError::ErasureWriteQuorum));
+
+        shutdown.cancel();
+    }
+
     #[tokio::test]
     #[serial_test::serial(storage_class_env)]
     async fn tag_updates_skip_active_rebalance_source_pool() {

crates/ecstore/src/store/list.rs

@@ -1,81 +0,0 @@
-// Copyright 2024 RustFS Team
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-use super::*;
-
-impl ECStore {
-    #[instrument(level = "trace", skip(self))]
-    #[allow(clippy::too_many_arguments)]
-    pub(super) async fn handle_list_objects_v2(
-        self: Arc<Self>,
-        bucket: &str,
-        prefix: &str,
-        continuation_token: Option<String>,
-        delimiter: Option<String>,
-        max_keys: i32,
-        fetch_owner: bool,
-        start_after: Option<String>,
-        incl_deleted: bool,
-    ) -> Result<ListObjectsV2Info> {
-        self.inner_list_objects_v2(
-            bucket,
-            prefix,
-            continuation_token,
-            delimiter,
-            max_keys,
-            fetch_owner,
-            start_after,
-            incl_deleted,
-        )
-        .await
-    }
-
-    #[instrument(skip(self))]
-    pub(super) async fn handle_list_object_versions(
-        self: Arc<Self>,
-        bucket: &str,
-        prefix: &str,
-        marker: Option<String>,
-        version_marker: Option<String>,
-        delimiter: Option<String>,
-        max_keys: i32,
-    ) -> Result<ListObjectVersionsInfo> {
-        self.inner_list_object_versions(bucket, prefix, marker, version_marker, delimiter, max_keys)
-            .await
-    }
-
-    pub(crate) async fn list_object_versions_for_lifecycle(
-        self: Arc<Self>,
-        bucket: &str,
-        prefix: &str,
-        marker: Option<String>,
-        version_marker: Option<String>,
-        delimiter: Option<String>,
-        max_keys: i32,
-    ) -> Result<ListObjectVersionsInfo> {
-        self.inner_list_object_versions_for_lifecycle(bucket, prefix, marker, version_marker, delimiter, max_keys)
-            .await
-    }
-
-    pub(super) async fn handle_walk(
-        self: Arc<Self>,
-        rx: CancellationToken,
-        bucket: &str,
-        prefix: &str,
-        result: tokio::sync::mpsc::Sender<ObjectInfoOrErr>,
-        opts: WalkOptions,
-    ) -> Result<()> {
-        self.walk_internal(rx, bucket, prefix, result, opts).await
-    }
-}

crates/ecstore/src/store/list_objects.rs

@@ -641,7 +641,7 @@ pub(crate) fn observe_scanner_namespace_mutations(bucket: &str, delta: u64) {
         .fetch_update(Ordering::AcqRel, Ordering::Acquire, |current| Some(current.saturating_add(delta)));
 }
 
-pub(super) async fn observe_list_objects_mutation(store: &ECStore, bucket: &str) -> u64 {
+pub(crate) async fn observe_list_objects_mutation(store: &ECStore, bucket: &str) -> u64 {
     observe_list_objects_mutations(store, bucket, 1).await.unwrap_or_default()
 }
 
@@ -3845,7 +3845,7 @@ impl ECStore {
         .await
     }
 
-    pub(crate) async fn inner_list_object_versions_for_lifecycle(
+    pub(crate) async fn list_object_versions_for_lifecycle(
         self: Arc<Self>,
         bucket: &str,
         prefix: &str,

crates/ecstore/src/store/mod.rs

@@ -148,7 +148,6 @@ mod heal_walk;
 pub use heal_walk::HealWalkVersion;
 mod init;
 pub(crate) mod init_format;
-mod list;
 pub(crate) mod list_objects;
 mod multipart;
 mod object;
@@ -601,7 +600,7 @@ impl crate::storage_api_contracts::list::ListOperations for ECStore {
         start_after: Option<String>,
         incl_deleted: bool,
     ) -> Result<ListObjectsV2Info> {
-        self.handle_list_objects_v2(
+        self.inner_list_objects_v2(
             bucket,
             prefix,
             continuation_token,
@@ -624,7 +623,7 @@ impl crate::storage_api_contracts::list::ListOperations for ECStore {
         delimiter: Option<String>,
         max_keys: i32,
     ) -> Result<ListObjectVersionsInfo> {
-        self.handle_list_object_versions(bucket, prefix, marker, version_marker, delimiter, max_keys)
+        self.inner_list_object_versions(bucket, prefix, marker, version_marker, delimiter, max_keys)
             .await
     }
 
@@ -636,7 +635,7 @@ impl crate::storage_api_contracts::list::ListOperations for ECStore {
         result: tokio::sync::mpsc::Sender<ObjectInfoOrErr>,
         opts: WalkOptions,
     ) -> Result<()> {
-        self.handle_walk(rx, bucket, prefix, result, opts).await
+        self.walk_internal(rx, bucket, prefix, result, opts).await
     }
 }
 

crates/ecstore/src/store/object.rs

@@ -4741,9 +4741,10 @@ mod tests {
     #[tokio::test]
     #[serial_test::serial(body_cache_hook)]
     async fn select_snapshot_rejects_latest_versioned_delete_marker_during_prepare() {
-        let (_first_dirs, first_set) = make_local_set_disks(4, 2).await;
-        let (_second_dirs, second_set) = make_local_set_disks(4, 2).await;
-        let store = new_prepared_reader_test_store(&[Arc::clone(&first_set), Arc::clone(&second_set)]).await;
+        let ctx = Arc::new(crate::runtime::instance::InstanceContext::new());
+        let (_first_dirs, first_set) = make_local_set_disks_with_ctx(4, 2, Arc::clone(&ctx)).await;
+        let (_second_dirs, second_set) = make_local_set_disks_with_ctx(4, 2, Arc::clone(&ctx)).await;
+        let store = new_prepared_reader_test_store_with_ctx(&[Arc::clone(&first_set), Arc::clone(&second_set)], ctx).await;
         let bucket = "select-snapshot-latest-delete-marker";
         let object = "versioned-object.bin";
         let versioned_opts = ObjectOptions {

crates/ecstore/tests/ecstore_contract_compat_test.rs

@@ -157,6 +157,18 @@ fn ecstore_implements_storage_list_operations_contract() {
     assert!(storage_list_operations_type_name::<ECStore>().ends_with("::ECStore"));
 }
 
+#[test]
+fn ecstore_pools_expose_storage_list_operations_contract() {
+    fn assert_contract(store: &ECStore) {
+        let future = store.pools[0]
+            .clone()
+            .list_objects_v2("bucket", "", None, None, 1, false, None, false);
+        drop(future);
+    }
+
+    let _ = assert_contract;
+}
+
 #[test]
 fn ecstore_implements_storage_multipart_operations_contract() {
     assert!(storage_multipart_operations_type_name::<ECStore>().ends_with("::ECStore"));

crates/filemeta/src/fileinfo.rs

@@ -18,8 +18,9 @@ use rmp_serde::Serializer;
 use rustfs_utils::HashAlgorithm;
 use rustfs_utils::http::{
     AMZ_OBJECT_TAGGING, SUFFIX_COMPRESSION, SUFFIX_DATA_MOVED, SUFFIX_DATA_MOVED_TAGS, SUFFIX_FREE_VERSION, SUFFIX_HEALING,
-    SUFFIX_INLINE_DATA, SUFFIX_TIER_FV_ID, SUFFIX_TIER_FV_MARKER, SUFFIX_TIER_SKIP_FV_ID, contains_key_str, get_str,
-    has_internal_suffix, insert_str, is_encryption_metadata_key, starts_with_ignore_ascii_case,
+    SUFFIX_INLINE_DATA, SUFFIX_OBJECT_TRANSACTION_EPOCH, SUFFIX_TIER_FV_ID, SUFFIX_TIER_FV_MARKER, SUFFIX_TIER_SKIP_FV_ID,
+    contains_key_str, get_consistent_str, get_str, has_internal_suffix, insert_str, is_encryption_metadata_key,
+    starts_with_ignore_ascii_case,
 };
 use s3s::dto::{RestoreStatus, Timestamp};
 use s3s::header::X_AMZ_RESTORE;
@@ -1172,6 +1173,22 @@ impl FileInfo {
         insert_str(&mut self.metadata, SUFFIX_DATA_MOVED, String::new());
     }
 
+    pub fn set_object_transaction_epoch(&mut self, epoch: Uuid) {
+        insert_str(&mut self.metadata, SUFFIX_OBJECT_TRANSACTION_EPOCH, epoch.to_string());
+    }
+
+    pub fn object_transaction_epoch(&self) -> Result<Option<Uuid>> {
+        if !contains_key_str(&self.metadata, SUFFIX_OBJECT_TRANSACTION_EPOCH) {
+            return Ok(None);
+        }
+        let value = get_consistent_str(&self.metadata, SUFFIX_OBJECT_TRANSACTION_EPOCH).ok_or(Error::FileCorrupt)?;
+        let epoch = Uuid::parse_str(value).map_err(|_| Error::FileCorrupt)?;
+        if epoch.is_nil() {
+            return Err(Error::FileCorrupt);
+        }
+        Ok(Some(epoch))
+    }
+
     pub fn inline_data(&self) -> bool {
         contains_key_str(&self.metadata, SUFFIX_INLINE_DATA) && !self.is_remote()
     }
@@ -1484,6 +1501,46 @@ mod tests {
         assert_eq!(ei.get_checksum_info(99).algorithm, HashAlgorithm::HighwayHash256S);
     }
 
+    #[test]
+    fn object_transaction_epoch_uses_consistent_dual_internal_metadata() {
+        let mut fi = validation_test_fileinfo();
+        assert_eq!(fi.object_transaction_epoch().expect("absent epoch should decode"), None);
+
+        let epoch = Uuid::new_v4();
+        let epoch_text = epoch.to_string();
+        fi.set_object_transaction_epoch(epoch);
+        assert_eq!(fi.object_transaction_epoch().expect("written epoch should decode"), Some(epoch));
+        assert_eq!(fi.metadata.get("x-rustfs-internal-object-transaction-epoch"), Some(&epoch_text));
+        assert_eq!(fi.metadata.get("x-minio-internal-object-transaction-epoch"), Some(&epoch_text));
+
+        let mut rustfs_only = validation_test_fileinfo();
+        rustfs_only
+            .metadata
+            .insert("x-rustfs-internal-object-transaction-epoch".to_string(), epoch_text);
+        assert_eq!(
+            rustfs_only
+                .object_transaction_epoch()
+                .expect("single compatibility key should decode"),
+            Some(epoch)
+        );
+
+        let mut conflicting = fi.clone();
+        conflicting
+            .metadata
+            .insert("x-minio-internal-object-transaction-epoch".to_string(), Uuid::new_v4().to_string());
+        assert_eq!(conflicting.object_transaction_epoch(), Err(Error::FileCorrupt));
+
+        let mut malformed = validation_test_fileinfo();
+        malformed
+            .metadata
+            .insert("x-rustfs-internal-object-transaction-epoch".to_string(), "not-a-uuid".to_string());
+        assert_eq!(malformed.object_transaction_epoch(), Err(Error::FileCorrupt));
+
+        let mut nil = validation_test_fileinfo();
+        nil.set_object_transaction_epoch(Uuid::nil());
+        assert_eq!(nil.object_transaction_epoch(), Err(Error::FileCorrupt));
+    }
+
     // backlog#949: distribution range/permutation validation.
     #[test]
     fn is_valid_distribution_accepts_permutation() {

crates/heal/src/error.rs

@@ -34,36 +34,21 @@ pub enum Error {
     #[error("Configuration error: {0}")]
     Config(String),
 
-    #[error("Heal configuration error: {message}")]
-    ConfigurationError { message: String },
-
     #[error("Other error: {0}")]
     Other(String),
 
     #[error("Serialization error: {0}")]
     Serialization(String),
 
-    #[error("IO error: {0}")]
-    IO(String),
-
-    #[error("Not found: {0}")]
-    NotFound(String),
-
     #[error("Invalid checkpoint: {0}")]
     InvalidCheckpoint(String),
 
     #[error("Heal task not found: {task_id}")]
     TaskNotFound { task_id: String },
 
-    #[error("Heal task already exists: {task_id}")]
-    TaskAlreadyExists { task_id: String },
-
     #[error("Invalid heal client token")]
     InvalidClientToken,
 
-    #[error("Heal manager is not running")]
-    ManagerNotRunning,
-
     #[error("Heal task execution failed: {message}")]
     TaskExecutionFailed { message: String },
 
@@ -78,12 +63,6 @@ pub enum Error {
 
     #[error("Heal task timeout")]
     TaskTimeout,
-
-    #[error("Heal event processing failed: {message}")]
-    EventProcessingFailed { message: String },
-
-    #[error("Heal progress tracking failed: {message}")]
-    ProgressTrackingFailed { message: String },
 }
 
 /// A specialized Result type for heal operations
@@ -129,9 +108,7 @@ impl Error {
                         | DiskError::FaultyDisk
                 ) || is_recoverable_heal_error_message(&err.to_string())
             }
-            Error::TaskExecutionFailed { message } | Error::IO(message) | Error::Other(message) => {
-                is_recoverable_heal_error_message(message)
-            }
+            Error::TaskExecutionFailed { message } | Error::Other(message) => is_recoverable_heal_error_message(message),
             Error::Io(err) => is_recoverable_heal_error_message(&err.to_string()),
             _ => false,
         }

crates/heal/src/heal/task.rs

@@ -597,7 +597,7 @@ impl HealTask {
                 | EcstoreError::ObjectNotFound(_, _)
                 | EcstoreError::VersionNotFound(_, _, _),
             ) => true,
-            Error::Other(message) | Error::IO(message) => {
+            Error::Other(message) => {
                 message.contains("File not found")
                     || message.contains("file not found")
                     || message.contains("File version not found")

crates/io-metrics/src/lib.rs

@@ -2703,6 +2703,10 @@ mod tests {
         record_get_object_reader_prefetch_wait("codec_streaming", 0.0002);
         record_get_object_response_handoff("standard", "selected", 8192, 1024, 0.0001);
         record_get_object_metadata_fanout_duration("legacy_duplex", 0.001);
+        record_get_object_stage_duration("legacy_duplex", "read_version_path_resolve", 0.0001);
+        record_get_object_stage_duration("legacy_duplex", "read_version_path_check", 0.0001);
+        record_get_object_stage_duration("legacy_duplex", "read_version_xlmeta_read", 0.0005);
+        record_get_object_stage_duration("legacy_duplex", "read_version_decode", 0.0002);
         record_get_object_first_metadata_response_latency("legacy_duplex", 0.001);
         record_get_object_first_valid_metadata_response_latency("legacy_duplex", 0.001);
         record_get_object_slowest_metadata_response_latency("legacy_duplex", 0.003);

crates/kms/src/api_types.rs

@@ -293,15 +293,6 @@ enum StrictVaultAuthMethod {
         #[serde(default)]
         refresh_safety_window_secs: Option<u64>,
     },
-    Kubernetes {
-        role: String,
-        #[serde(default)]
-        mount: Option<String>,
-        #[serde(default)]
-        jwt_path: Option<std::path::PathBuf>,
-        #[serde(default)]
-        refresh_safety_window_secs: Option<u64>,
-    },
     TokenFile {
         path: std::path::PathBuf,
         #[serde(default)]
@@ -328,17 +319,6 @@ impl From<StrictVaultAuthMethod> for VaultAuthMethod {
                 mount: mount.unwrap_or_else(|| crate::config::DEFAULT_VAULT_APPROLE_MOUNT.to_string()),
                 refresh_safety_window_secs,
             },
-            StrictVaultAuthMethod::Kubernetes {
-                role,
-                mount,
-                jwt_path,
-                refresh_safety_window_secs,
-            } => Self::Kubernetes {
-                role,
-                mount: mount.unwrap_or_else(|| crate::config::DEFAULT_VAULT_KUBERNETES_MOUNT.to_string()),
-                jwt_path: jwt_path.unwrap_or_else(|| std::path::PathBuf::from(crate::config::DEFAULT_VAULT_KUBERNETES_JWT_PATH)),
-                refresh_safety_window_secs,
-            },
             StrictVaultAuthMethod::TokenFile {
                 path,
                 poll_interval_secs,
@@ -519,7 +499,6 @@ impl From<&KmsConfig> for KmsConfigSummary {
                 auth_method_type: match &vault_config.auth_method {
                     VaultAuthMethod::Token { .. } => "token".to_string(),
                     VaultAuthMethod::AppRole { .. } => "approle".to_string(),
-                    VaultAuthMethod::Kubernetes { .. } => "kubernetes".to_string(),
                     VaultAuthMethod::TokenFile { .. } => "token_file".to_string(),
                 },
                 has_stored_credentials: true,
@@ -534,7 +513,6 @@ impl From<&KmsConfig> for KmsConfigSummary {
                 auth_method_type: match &vault_config.auth_method {
                     VaultAuthMethod::Token { .. } => "token".to_string(),
                     VaultAuthMethod::AppRole { .. } => "approle".to_string(),
-                    VaultAuthMethod::Kubernetes { .. } => "kubernetes".to_string(),
                     VaultAuthMethod::TokenFile { .. } => "token_file".to_string(),
                 },
                 has_stored_credentials: true,
@@ -923,42 +901,6 @@ mod tests {
         assert!(request.to_kms_config().validate().is_ok());
     }
 
-    /// The admin API reaches Kubernetes auth with the role alone; the mount and
-    /// the projected token path fall back to the cluster defaults, so a Tenant
-    /// manifest carries no credential and no cluster-specific paths.
-    #[test]
-    fn test_deserialize_vault_configure_request_accepts_kubernetes_auth() {
-        let raw = serde_json::json!({
-            "backend_type": "vault-transit",
-            "address": "https://vault.example.com:8200",
-            "mount_path": "rustfs",
-            "auth_method": { "Kubernetes": { "role": "rustfs" } }
-        });
-
-        let request: ConfigureKmsRequest = serde_json::from_value(raw).expect("kubernetes auth should deserialize");
-        let config = request.to_kms_config();
-        config.validate().expect("kubernetes auth must validate");
-
-        let vault = config.vault_transit_config().expect("vault transit backend config");
-        let VaultAuthMethod::Kubernetes {
-            role, mount, jwt_path, ..
-        } = &vault.auth_method
-        else {
-            panic!("expected Kubernetes auth, got {:?}", vault.auth_method);
-        };
-        assert_eq!(role, "rustfs");
-        assert_eq!(mount, crate::config::DEFAULT_VAULT_KUBERNETES_MOUNT);
-        assert_eq!(jwt_path, std::path::Path::new(crate::config::DEFAULT_VAULT_KUBERNETES_JWT_PATH));
-
-        let unknown_field = serde_json::json!({
-            "backend_type": "vault-transit",
-            "address": "https://vault.example.com:8200",
-            "auth_method": { "Kubernetes": { "role": "rustfs", "service_account": "rustfs" } }
-        });
-        serde_json::from_value::<ConfigureKmsRequest>(unknown_field)
-            .expect_err("an unknown auth field must be rejected rather than silently dropped");
-    }
-
     #[test]
     fn test_deserialize_aws_configure_request_accepts_type_aliases() {
         for backend_type in ["AWS", "AwsKms", "aws", "aws-kms", "aws_kms"] {

crates/kms/src/backends/vault.rs

@@ -550,7 +550,6 @@ impl VaultKmsClient {
             address: config.address.clone(),
             namespace: config.namespace.clone(),
             attempt_timeout: kms_config.effective_timeout(),
-            skip_tls_verify: config.tls.as_ref().is_some_and(|tls| tls.skip_verify),
         };
         let source = token_source_for(&config.auth_method, &settings)?;
         let policy = VaultCredentialPolicy::from_kms_config(

crates/kms/src/backends/vault_credentials.rs

@@ -326,97 +326,6 @@ impl fmt::Debug for AppRoleLogin {
     }
 }
 
-/// Token source for [`VaultAuthMethod::Kubernetes`]: exchanges the pod's
-/// projected ServiceAccount token for a lease-bound Vault token.
-///
-/// The JWT is re-read on every login because the kubelet rotates a projected
-/// token well inside the pod's lifetime; caching it would strand the source on
-/// an expired assertion once the current Vault token can no longer be renewed.
-///
-/// Unlike [`TokenFileSource`], the file mode is not checked: the kubelet owns
-/// the projected token and mounts it world-readable by default, so rejecting
-/// group/other bits would refuse every standard pod rather than catch a
-/// deployment error.
-pub(crate) struct KubernetesLogin {
-    /// Unauthenticated client used only for the login exchange.
-    login_client: VaultClient,
-    mount: String,
-    role: String,
-    jwt_path: PathBuf,
-}
-
-impl KubernetesLogin {
-    pub(crate) fn new(settings: &VaultConnectionSettings, mount: String, role: String, jwt_path: PathBuf) -> Result<Self> {
-        Ok(Self {
-            login_client: settings.build_login_client()?,
-            mount,
-            role,
-            jwt_path,
-        })
-    }
-
-    /// Read the ServiceAccount token for one login attempt.
-    ///
-    /// Mirrors [`AppRoleLogin::resolve_secret_id`]: a read failure is fatal for
-    /// the attempt but the refresh loop keeps retrying, so a token the kubelet
-    /// has not projected yet heals the source without a restart.
-    async fn resolve_jwt(&self) -> AttemptResult<SecretString> {
-        let mut raw = tokio::fs::read_to_string(&self.jwt_path)
-            .await
-            .map_err(|error| AttemptError {
-                class: ErrorClass::Fatal,
-                error: KmsError::configuration_error(format!(
-                    "Failed to read Kubernetes ServiceAccount token {}: {error}",
-                    self.jwt_path.display()
-                )),
-            })?;
-        let trimmed = raw.trim();
-        if trimmed.is_empty() {
-            raw.zeroize();
-            return Err(AttemptError {
-                class: ErrorClass::Fatal,
-                error: KmsError::configuration_error(format!(
-                    "Kubernetes ServiceAccount token {} is empty",
-                    self.jwt_path.display()
-                )),
-            });
-        }
-        let jwt = SecretString::new(trimmed.to_string());
-        raw.zeroize();
-        Ok(jwt)
-    }
-}
-
-#[async_trait]
-impl TokenSource for KubernetesLogin {
-    async fn acquire(&self) -> AttemptResult<TokenLease> {
-        let jwt = self.resolve_jwt().await?;
-        let auth = vaultrs::auth::kubernetes::login(&self.login_client, &self.mount, &self.role, jwt.expose())
-            .await
-            .map_err(|error| attempt_error("Kubernetes login", error))?;
-        Ok(TokenLease::from_auth(auth))
-    }
-
-    async fn renew(&self, client: &VaultClient) -> AttemptResult<TokenLease> {
-        let auth = vaultrs::token::renew_self(client, None)
-            .await
-            .map_err(|error| attempt_error("token renewal", error))?;
-        Ok(TokenLease::from_auth(auth))
-    }
-}
-
-impl fmt::Debug for KubernetesLogin {
-    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
-        // The login client embeds Vault client settings and must stay out of
-        // Debug output; the role name is not a secret, and the JWT is never held.
-        f.debug_struct("KubernetesLogin")
-            .field("mount", &self.mount)
-            .field("role", &self.role)
-            .field("jwt_path", &self.jwt_path)
-            .finish_non_exhaustive()
-    }
-}
-
 /// Token source for [`VaultAuthMethod::TokenFile`]: reads an agent-managed
 /// token file (for example a Vault Agent auto-auth sink).
 ///
@@ -555,9 +464,6 @@ pub(crate) fn token_source_for(
             secret_id.clone(),
             secret_id_file.clone(),
         )?)),
-        VaultAuthMethod::Kubernetes {
-            role, mount, jwt_path, ..
-        } => Ok(Box::new(KubernetesLogin::new(settings, mount.clone(), role.clone(), jwt_path.clone())?)),
         VaultAuthMethod::TokenFile {
             path,
             poll_interval_secs,
@@ -580,9 +486,6 @@ pub(crate) struct VaultConnectionSettings {
     pub(crate) namespace: Option<String>,
     /// Per-attempt HTTP timeout applied to the underlying reqwest client.
     pub(crate) attempt_timeout: Duration,
-    /// Whether to accept an unverified Vault server certificate. Gated on
-    /// `allow_insecure_dev_defaults` by `KmsConfig::validate`.
-    pub(crate) skip_tls_verify: bool,
 }
 
 impl VaultConnectionSettings {
@@ -596,11 +499,6 @@ impl VaultConnectionSettings {
         // operation-level retry policy.
         settings_builder.timeout(Some(self.attempt_timeout));
         settings_builder.token(token);
-        // Always set explicitly: left unset, vaultrs derives this from its own
-        // VAULT_SKIP_VERIFY variable, so a stray value in the environment would
-        // disable certificate verification behind the KMS configuration and its
-        // insecure-defaults gate.
-        settings_builder.verify(!self.skip_tls_verify);
 
         if let Some(namespace) = &self.namespace {
             settings_builder.namespace(Some(namespace.clone()));
@@ -653,10 +551,6 @@ impl VaultCredentialPolicy {
                 refresh_safety_window_secs: Some(secs),
                 ..
             }
-            | VaultAuthMethod::Kubernetes {
-                refresh_safety_window_secs: Some(secs),
-                ..
-            }
             | VaultAuthMethod::TokenFile {
                 refresh_safety_window_secs: Some(secs),
                 ..
@@ -690,25 +584,15 @@ pub(crate) struct VaultClientHandle {
 
 impl VaultClientHandle {
     /// Absolute expiry of this generation's token.
-    ///
-    /// `lease.ttl` is built from the `lease_duration` the Vault server sent, so
-    /// a value too large to add to `issued_at` would panic on the bare `+`. A
-    /// TTL that cannot be represented is indistinguishable from no expiry, so it
-    /// collapses to `None` — the same answer already given for the zero-lease
-    /// tokens Vault issues, which keeps the token in use and still fully
-    /// validated by Vault on every call.
     fn expires_at(&self) -> Option<Instant> {
-        self.lease.and_then(|lease| self.issued_at.checked_add(lease.ttl))
+        self.lease.map(|lease| self.issued_at + lease.ttl)
     }
 
     /// When the renewal task should refresh this generation: half the TTL,
     /// leaving the second half as budget for retries before the fail-closed
     /// window is reached.
-    ///
-    /// Unrepresentable TTLs collapse to `None` as in [`Self::expires_at`],
-    /// leaving a token that never expires with nothing to renew.
     fn renew_at(&self) -> Option<Instant> {
-        self.lease.and_then(|lease| self.issued_at.checked_add(lease.ttl / 2))
+        self.lease.map(|lease| self.issued_at + lease.ttl / 2)
     }
 }
 
@@ -778,7 +662,7 @@ impl VaultCredentialProvider {
         let handle = self.current.load_full();
         if let Some(expires_at) = handle.expires_at() {
             let now = Instant::now();
-            if self.inside_safety_window(now, expires_at) {
+            if now + self.policy.safety_window >= expires_at {
                 return Err(KmsError::credentials_unavailable(format!(
                     "Vault token (generation {}) is within {:?} of expiry and has not been refreshed; refusing to use it",
                     handle.generation, self.policy.safety_window
@@ -788,18 +672,6 @@ impl VaultCredentialProvider {
         Ok(handle)
     }
 
-    /// Whether the token expiring at `expires_at` is close enough to refuse.
-    ///
-    /// `safety_window` reaches here from persisted configuration, so it is not
-    /// guaranteed to have passed this version's validation: a window too large
-    /// to add to the current instant would panic on the bare `+`. Such a window
-    /// means every token is always inside it, so saturating to "refuse" is both
-    /// the fail-closed answer and the one the arithmetic was reaching for.
-    fn inside_safety_window(&self, now: Instant, expires_at: Instant) -> bool {
-        now.checked_add(self.policy.safety_window)
-            .is_none_or(|deadline| deadline >= expires_at)
-    }
-
     /// Publish the credential gauges for the generation currently installed.
     ///
     /// The fail-closed gauge re-evaluates the very gate
@@ -811,7 +683,7 @@ impl VaultCredentialProvider {
         let fail_closed = match handle.expires_at() {
             Some(expires_at) => {
                 metrics::gauge!(METRIC_TOKEN_TTL_SECONDS).set(expires_at.saturating_duration_since(now).as_secs_f64());
-                self.inside_safety_window(now, expires_at)
+                now + self.policy.safety_window >= expires_at
             }
             // A generation without an expiry has no remaining TTL to report
             // and can never lapse, so it can never fail closed either.
@@ -988,7 +860,7 @@ impl Drop for CredentialTaskHandle {
 #[cfg(test)]
 mod tests {
     use super::*;
-    use crate::config::{DEFAULT_VAULT_KUBERNETES_MOUNT, REDACTED_SECRET};
+    use crate::config::REDACTED_SECRET;
     use std::sync::atomic::{AtomicBool, AtomicU32, Ordering};
 
     const TEST_TOKEN: &str = "vault-token-debug-leak-canary";
@@ -999,7 +871,6 @@ mod tests {
             address: "http://127.0.0.1:8200".to_string(),
             namespace: Some("team-namespace".to_string()),
             attempt_timeout: Duration::from_secs(30),
-            skip_tls_verify: false,
         }
     }
 
@@ -1186,143 +1057,6 @@ mod tests {
         assert!(format!("{source:?}").contains("AppRoleLogin"));
     }
 
-    #[tokio::test]
-    async fn test_kubernetes_auth_method_maps_to_login_source() {
-        let settings = test_settings();
-        let source = token_source_for(&VaultAuthMethod::kubernetes("rustfs".to_string()), &settings)
-            .expect("kubernetes auth must map to a login source");
-
-        assert!(format!("{source:?}").contains("KubernetesLogin"));
-    }
-
-    /// `refresh_safety_window_secs` is operator-supplied and reaches the request
-    /// path from persisted configuration, so the fail-closed comparison must
-    /// survive a window too large to add to the current instant. Before the
-    /// checked arithmetic this panicked with "overflow when adding duration to
-    /// instant" on the first request after a lease-bearing login.
-    #[tokio::test]
-    async fn test_current_refuses_rather_than_panics_on_an_unrepresentable_safety_window() {
-        let (provider, _state) = scripted_provider(
-            Duration::from_secs(60),
-            true,
-            test_policy(Duration::from_secs(u64::MAX), Duration::from_secs(5)),
-        )
-        .await;
-
-        let error = provider
-            .current()
-            .expect_err("a window wider than any lease must refuse the token");
-        assert!(
-            matches!(error, KmsError::CredentialsUnavailable { .. }),
-            "expected CredentialsUnavailable, got {error:?}"
-        );
-    }
-
-    /// `lease_duration` is a bare u64 straight off the Vault response and forms
-    /// the other side of the same comparison, so an absurd one must not panic
-    /// either. It is indistinguishable from a non-expiring token, which is how
-    /// the zero-lease case already behaves.
-    #[tokio::test]
-    async fn test_an_unrepresentable_lease_is_treated_as_non_expiring() {
-        let (provider, _state) = scripted_provider(
-            Duration::from_secs(u64::MAX),
-            true,
-            test_policy(Duration::from_secs(30), Duration::from_secs(5)),
-        )
-        .await;
-
-        provider
-            .current()
-            .expect("a token whose expiry cannot be represented must stay usable");
-    }
-
-    /// The configured flag has to reach the HTTP client, not just the config
-    /// struct: every generation (authenticated and login) builds its own client,
-    /// and a Vault with a self-signed certificate fails the handshake unless
-    /// each one carries the setting.
-    #[test]
-    fn test_skip_tls_verify_reaches_every_vault_client_generation() {
-        for skip_tls_verify in [false, true] {
-            let settings = VaultConnectionSettings {
-                address: "https://vault.example.com:8200".to_string(),
-                namespace: None,
-                attempt_timeout: Duration::from_secs(30),
-                skip_tls_verify,
-            };
-
-            let authenticated = settings.build_client(TEST_TOKEN).expect("authenticated client must build");
-            assert_eq!(authenticated.settings.verify, !skip_tls_verify);
-
-            let login = settings.build_login_client().expect("login client must build");
-            assert_eq!(login.settings.verify, !skip_tls_verify);
-        }
-    }
-
-    /// vaultrs derives `verify` from its own VAULT_SKIP_VERIFY variable when the
-    /// builder leaves it unset, which would disable certificate verification
-    /// without passing the KMS insecure-defaults gate.
-    #[test]
-    fn test_vaultrs_skip_verify_env_cannot_override_the_configured_setting() {
-        temp_env::with_var("VAULT_SKIP_VERIFY", Some("true"), || {
-            let client = test_settings().build_client(TEST_TOKEN).expect("client must build");
-            assert!(
-                client.settings.verify,
-                "a stray VAULT_SKIP_VERIFY must not disable verification behind the KMS configuration"
-            );
-        });
-    }
-
-    /// The projected token is read fresh per login attempt and trimmed, so a
-    /// kubelet rotation is picked up without a restart and a trailing newline
-    /// does not corrupt the assertion sent to Vault.
-    #[tokio::test]
-    async fn test_kubernetes_login_rereads_and_trims_the_service_account_token() {
-        let dir = tempfile::tempdir().expect("temp dir");
-        let path = dir.path().join("token");
-        tokio::fs::write(&path, "  first-jwt\n").await.expect("write token");
-
-        let login = KubernetesLogin::new(
-            &test_settings(),
-            DEFAULT_VAULT_KUBERNETES_MOUNT.to_string(),
-            "rustfs".to_string(),
-            path.clone(),
-        )
-        .expect("login source must build");
-
-        assert_eq!(login.resolve_jwt().await.expect("first read").expose(), "first-jwt");
-
-        tokio::fs::write(&path, "rotated-jwt").await.expect("rotate token");
-        assert_eq!(
-            login.resolve_jwt().await.expect("second read").expose(),
-            "rotated-jwt",
-            "a rotated projected token must be picked up without a restart"
-        );
-    }
-
-    /// The ServiceAccount token is re-read per attempt, so an unreadable or
-    /// empty one fails that attempt without reaching Vault; the refresh loop
-    /// keeps retrying, which is what lets a late projection heal the source.
-    #[tokio::test]
-    async fn test_kubernetes_login_rejects_an_unusable_service_account_token() {
-        let dir = tempfile::tempdir().expect("temp dir");
-        let missing = dir.path().join("absent-token");
-        let empty = dir.path().join("empty-token");
-        tokio::fs::write(&empty, "  \n").await.expect("write empty token");
-
-        for (path, expected) in [(missing, "Failed to read"), (empty, "is empty")] {
-            let login =
-                KubernetesLogin::new(&test_settings(), DEFAULT_VAULT_KUBERNETES_MOUNT.to_string(), "rustfs".to_string(), path)
-                    .expect("login source must build");
-
-            let error = login
-                .acquire()
-                .await
-                .expect_err("an unusable ServiceAccount token must fail the attempt");
-            assert!(matches!(error.class, ErrorClass::Fatal));
-            assert!(error.error.to_string().contains(expected), "got {}", error.error);
-        }
-    }
-
     #[tokio::test(start_paused = true)]
     async fn test_renewal_task_renews_at_half_ttl() {
         let (provider, state) = scripted_provider(

crates/kms/src/backends/vault_transit.rs

@@ -415,7 +415,6 @@ impl VaultTransitKmsClient {
             address: config.address.clone(),
             namespace: config.namespace.clone(),
             attempt_timeout: kms_config.effective_timeout(),
-            skip_tls_verify: config.tls.as_ref().is_some_and(|tls| tls.skip_verify),
         };
         let source = token_source_for(&config.auth_method, &settings)?;
         let policy = VaultCredentialPolicy::from_kms_config(