test(e2e): isolate mc mirror fixture in full suite

Co-Authored-By: heihutu <heihutu@gmail.com> Co-Authored-By: zhi22915 <qiuzgang@gmail.com>
perf(s3): streamline conditional multipart preflight
2026-11-01 00:32:21 +00:00 · 2026-11-01 02:40:44 +08:00 · 2026-10-31 22:38:26 +08:00 · 2026-10-31 22:25:08 +08:00 · 2026-10-31 21:58:51 +08:00 · 2026-10-31 20:48:34 +08:00
159 changed files with 8931 additions and 328 deletions
@@ -1,2 +1,2 @@
-sha256-darwin=67251cb7d9978d38e899268cac4d7898297ff7e5b5c48c9c1546dc760b93568d
-sha256-linux=673da76c2e5710c4622fe2fa32d2b297730895769487fcf1152ee1c2366f32f4
+sha256-darwin=7c705942d3a9e583ebaa85845daa21c4f81fdbf36def24db931aaef38636c53e
+sha256-linux=5c33dc395233671cb77452f8fb12900ecdbeb368632222b96835d310bce1aab8
@@ -1 +1 @@
-sha256=e9dc896774122a304e2b8b90f28c82d4d4e0af8ded36a82b147b30945ec994e3
+sha256=00f8a56b75990b487a594b97c36610b94476a6944ba00473e37187ea654d42bf
@@ -976,6 +976,12 @@ test-group = 'e2e-vault'
 filter = 'package(e2e_test) & (test(/^list_objects_v2_pagination_test::tests::(test_list_objects_v2_delimiter_small_page_traverses_all|test_list_objects_v2_max_keys_above_limit_returns_token|test_list_objects_v2_maxkeys_above_limit_with_delimiter)$/) | test(=reliant::tiering::test_hermetic_transition_restore_failure_expiry_and_retry))'
 threads-required = "num-test-threads"

+# The mc fixture uploads hundreds of objects concurrently before measuring listing.
+# Reserve the runner so other server fixtures do not starve its disk operations.
+[[profile.e2e-full.overrides]]
+filter = 'package(e2e_test) & test(=mc_mirror_small_bucket_test::test_mc_mirror_small_bucket_completes_without_list_timeout)'
+threads-required = "num-test-threads"
+
 # Fixed, small contract for every executable server change. These existing
 # scenarios exercise write/read, anonymous denial and retained bytes on restart.
 [profile.core-contract]
@@ -0,0 +1,77 @@
+{
+  "schema_version": 1,
+  "plan_id": "rustfs-release-validation",
+  "description": "Versioned certification plan for every public RustFS release exit (rustfs/backlog#2662, R01). preview, prerelease and stable all require this explicit plan. Scripts/release/release_gate.py fail-closes publication on any missing, duplicate, stale, substituted or non-PASS required item.",
+  "release_types": ["preview", "prerelease", "stable"],
+  "targets": [
+    {"os": "linux", "arch": "x86_64", "abi": "musl"},
+    {"os": "linux", "arch": "aarch64", "abi": "musl"},
+    {"os": "linux", "arch": "x86_64", "abi": "gnu"},
+    {"os": "linux", "arch": "aarch64", "abi": "gnu"},
+    {"os": "macos", "arch": "aarch64", "abi": "none"},
+    {"os": "windows", "arch": "x86_64", "abi": "msvc"}
+  ],
+  "targets_basis": "Platform matrix of .github/workflows/build.yml (prepare-platform-matrix). gnu and macOS targets build with the pyroscope feature; musl and Windows targets build with no extra features.",
+  "features": ["pyroscope"],
+  "trusted_workflows": [
+    {"repository": "rustfs/s3chaos", "workflow_id": "release-gate.yml"}
+  ],
+  "trusted_workflows_basis": "The shared evidence envelope producer lives in rustfs/s3chaos (G01, fault/release_gate.rs) and its plan/live split workflow is .github/workflows/release-gate.yml there. Only results from these identities may enter a release certification; PR-uploaded JSON never gains release authority. R02 must extend this list when additional verifier workflows land, never widen it to untrusted sources.",
+  "lanes": [
+    {
+      "lane": "identity",
+      "harness_repository": "rustfs/s3chaos",
+      "harness_sha": "9a48f55c1d6d58ce63a8fb1ea7317e024f32f11d",
+      "harness_basis": "Fixed G01 evidence-envelope producer revision (rustfs/s3chaos PR #102 head recorded in rustfs/backlog#2658). R02 re-pins this when the live verifier ships.",
+      "timeout_seconds": 1800,
+      "environment_capabilities": ["process-exec"],
+      "cases": ["artifact-identity", "startup"],
+      "applies_to": {
+        "release_types": ["preview", "prerelease", "stable"],
+        "platforms": "all"
+      },
+      "applies_basis": "Artifact identity and startup checks are mandatory for every release type, preview included, on every shipped target (rustfs/backlog#2662 frozen design item 5)."
+    },
+    {
+      "lane": "upgrade",
+      "harness_repository": "rustfs/s3chaos",
+      "harness_sha": "9a48f55c1d6d58ce63a8fb1ea7317e024f32f11d",
+      "harness_basis": "Same fixed envelope producer as the identity lane; the workflow SHA and the product build SHA are bound separately and need not be equal.",
+      "timeout_seconds": 5400,
+      "environment_capabilities": ["process-exec", "previous-release-artifact"],
+      "cases": [
+        "direct-upgrade",
+        "mixed-version-upgrade",
+        "bucket-config-upgrade",
+        "bucket-config-rollback",
+        "multipart-layout-upgrade",
+        "multipart-layout-baseline"
+      ],
+      "cases_basis": "Case IDs of the pinned previous-release matrix in .github/workflows/e2e-upgrade.yml (source.version/asset/sha256 and the case list mapped there).",
+      "applies_to": {
+        "release_types": ["prerelease", "stable"],
+        "platforms": [{"os": "linux", "arch": "x86_64", "abi": "gnu"}]
+      },
+      "applies_basis": "preview releases use the pre-declared smaller set (identity lane only). The upgrade lane is only exercised on linux-x86_64-gnu, the platform of the pinned source assets."
+    }
+  ],
+  "upgrade_sources": {
+    "basis": "Exactly the two previous-release sources pinned in .github/workflows/e2e-upgrade.yml are exercised today (source.version / source.asset / source.sha256). No other N-1/N-2 compatibility is claimed, and these digests are not inferred from tags.",
+    "sources": [
+      {
+        "version": "1.0.1",
+        "role": "N-1",
+        "artifact_name": "rustfs-linux-x86_64-gnu-v1.0.1.zip",
+        "artifact_sha256": "9742e183cb0dfb0d48fa909797af572fe47b7f827569036baa4156e0d3958ee5"
+      },
+      {
+        "version": "1.0.0-rc.5",
+        "role": "N-2",
+        "artifact_name": "rustfs-linux-x86_64-gnu-v1.0.0-rc.5.zip",
+        "artifact_sha256": "3ee8df71e8edcfada533be452c4135868f697bc515460ae97b027313eade7a3d"
+      }
+    ],
+    "rollback_supported": false,
+    "rollback_basis": "Only the bucket-config-rollback case (rollback_to_previous_release_reads_current_bucket_metadata) is exercised. Full data-plane rollback is not certified and is never a default claim."
+  }
+}
@@ -814,13 +814,18 @@ jobs:
          export AWS_SECRET_ACCESS_KEY="$R2_SECRET_ACCESS_KEY"
          export AWS_DEFAULT_REGION="auto"

-          # Determine upload path based on build type
+          # Determine upload path based on build type. Release and prerelease
+          # builds only stage their bytes here: the official
+          # artifacts/rustfs/release/ path is written solely by the
+          # certification-gated promote-release-artifacts job, from these same
+          # staged objects. Development builds keep the uncertified dev channel
+          # and never touch official or latest channels.
          if [[ "$BUILD_TYPE" == "development" ]]; then
            R2_PATH="s3://${R2_BUCKET}/artifacts/rustfs/dev/"
            echo "📤 Uploading development build to R2 dev directory"
          else
-            R2_PATH="s3://${R2_BUCKET}/artifacts/rustfs/release/"
-            echo "📤 Uploading release build to R2 release directory"
+            R2_PATH="s3://${R2_BUCKET}/artifacts/rustfs/staging/${GITHUB_RUN_ID}/${GITHUB_RUN_ATTEMPT}/"
+            echo "📤 Staging release build for certification-gated promotion"
          fi

          # Upload all rustfs zip files to R2 using S3-compatible API
@@ -869,6 +874,221 @@ jobs:
            echo "This run does not trigger Docker publishing."
          fi

+  # Aggregate the parent candidate batch. This job always collects results and
+  # retains its evidence, including on failure, and every publication job
+  # below requires its success. Missing, stale, substituted or non-PASS
+  # evidence fails closed here: only the trusted verification sources
+  # (rustfs/s3chaos release-gate envelopes, rustfs/backlog#2658) can satisfy
+  # it, so a PR-uploaded JSON set never gains release authority.
+  release-certification:
+    name: Release Certification
+    needs: [ build-check, build-rustfs ]
+    if: ${{ !cancelled() && needs.build-check.outputs.should_publish == 'true' && startsWith(github.ref, 'refs/tags/') }}
+    runs-on: ubuntu-latest # gh CLI required; the sm-standard-2 fleet does not ship it
+    timeout-minutes: 30
+    permissions:
+      contents: read
+      actions: read
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7
+        with:
+          persist-credentials: false
+
+      - name: Download all build artifacts
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          path: ./artifacts
+          pattern: rustfs-*
+          merge-multiple: true
+
+      - name: Write candidate and collect trusted validation results
+        env:
+          # Cross-repo read of the trusted verification run. Falls back to the
+          # workflow token, which cannot read rustfs/s3chaos; a missing token
+          # therefore fail-closes instead of certifying.
+          GH_TOKEN: ${{ secrets.RELEASE_VALIDATION_TOKEN || github.token }}
+          PRODUCT_COMMIT: ${{ github.sha }}
+          VERSION: ${{ needs.build-check.outputs.version }}
+          BUILD_TYPE: ${{ needs.build-check.outputs.build_type }}
+          FEATURES: ${{ needs.build-check.outputs.build_type == 'development' && '' || 'pyroscope' }}
+        shell: bash
+        run: |
+          set -euo pipefail
+
+          mkdir -p results release-gate-output
+          PLAN_SHA256=$(python3 -c "import hashlib,json,sys; sys.path.insert(0,'scripts/release'); import release_gate; print(release_gate.canonical_sha256(json.load(open('.config/release-validation-plan.json'))))")
+
+          python3 - "$PLAN_SHA256" > candidate.json <<'PY'
+          import hashlib, json, os, sys, zipfile
+
+          plan_sha256 = sys.argv[1]
+          profile = {"release": "stable", "prerelease": "prerelease", "preview": "preview"}.get(os.environ["BUILD_TYPE"])
+          if profile is None:
+              raise SystemExit("release certification only covers preview, prerelease and stable builds")
+
+          def sha256(path):
+              digest = hashlib.sha256()
+              with open(path, "rb") as handle:
+                  for chunk in iter(lambda: handle.read(1024 * 1024), b""):
+                      digest.update(chunk)
+              return digest.hexdigest()
+
+          deliverables = []
+          for name in sorted(os.listdir("artifacts")):
+              if not name.startswith("rustfs-") or not name.endswith(".zip"):
+                  continue
+              path = os.path.join("artifacts", name)
+              members = zipfile.ZipFile(path).namelist()
+              binary_name = "rustfs.exe" if "rustfs.exe" in members else "rustfs"
+              with zipfile.ZipFile(path) as archive:
+                  binary_bytes = archive.read(binary_name)
+              import tempfile
+              with tempfile.NamedTemporaryFile() as handle:
+                  handle.write(binary_bytes)
+                  handle.flush()
+                  binary_sha = sha256(handle.name)
+              deliverables.append({
+                  "kind": "zip",
+                  "name": name,
+                  "location": "https://github.com/rustfs/rustfs/releases/download/{}/{}".format(os.environ["VERSION"], name),
+                  "sha256": sha256(path),
+                  "size": os.path.getsize(path),
+                  "binary_sha256": binary_sha,
+              })
+          if not deliverables:
+              raise SystemExit("no built deliverables found to certify")
+          candidate = {
+              "schema_version": 1,
+              "product_commit": os.environ["PRODUCT_COMMIT"],
+              "version": os.environ["VERSION"],
+              "release_profile": profile,
+              "features": [f for f in os.environ.get("FEATURES", "").split(",") if f],
+              "plan_sha256": plan_sha256,
+              "validation_batch": {"run_id": os.environ["GITHUB_RUN_ID"], "run_attempt": int(os.environ["GITHUB_RUN_ATTEMPT"])},
+              "deliverables": deliverables,
+          }
+          json.dump(candidate, sys.stdout, indent=2, sort_keys=True)
+          print()
+          PY
+
+          # Trusted verification evidence only: the release-gate envelopes of
+          # rustfs/s3chaos for this exact product commit. Absence blocks below.
+          TRUSTED_REPO="rustfs/s3chaos"
+          TRUSTED_WORKFLOW="release-gate.yml"
+          TRUSTED_RUN=$(gh api "repos/${TRUSTED_REPO}/actions/workflows/${TRUSTED_WORKFLOW}/runs?head_sha=${PRODUCT_COMMIT}&status=success&per_page=1" --jq '.workflow_runs[0].id // empty' || true)
+          if [[ -z "$TRUSTED_RUN" ]]; then
+            echo "❌ No trusted verification run of ${TRUSTED_REPO}/${TRUSTED_WORKFLOW} for ${PRODUCT_COMMIT}; refusing to certify" >&2
+          else
+            gh run download "$TRUSTED_RUN" -R "$TRUSTED_REPO" -n release-validation-evidence -D results || \
+              echo "❌ Trusted verification run ${TRUSTED_RUN} published no release-validation-evidence artifact" >&2
+          fi
+
+          python3 scripts/release/release_gate.py validate \
+            --plan .config/release-validation-plan.json \
+            --candidate candidate.json \
+            --results results \
+            --output release-gate-output
+
+      - name: Upload certification evidence
+        if: always()
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: release-certification
+          path: |
+            candidate.json
+            results/
+            release-gate-output/
+          if-no-files-found: warn
+          retention-days: 30
+
+  # The only writer of the official R2 release path. Promotion re-checks the
+  # exact bytes about to be published against the passed certification list
+  # and copies the staged objects byte-for-byte: no rebuild-after-verify.
+  promote-release-artifacts:
+    name: Promote Release Artifacts
+    needs: [ build-check, build-rustfs, release-certification ]
+    # Target-channel lock for the official R2 release path.
+    concurrency:
+      group: release-channel-r2-release
+      cancel-in-progress: false
+    if: needs.build-check.outputs.should_publish == 'true' && startsWith(github.ref, 'refs/tags/') && (needs.build-check.outputs.build_type == 'release' || needs.build-check.outputs.build_type == 'prerelease')
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    permissions:
+      contents: read
+      actions: read
+    env:
+      R2_ACCESS_KEY_ID: ${{ secrets.R2_ACCESS_KEY_ID }}
+      R2_SECRET_ACCESS_KEY: ${{ secrets.R2_SECRET_ACCESS_KEY }}
+      R2_ENDPOINT: ${{ secrets.R2_ENDPOINT }}
+      R2_BUCKET: ${{ secrets.R2_BUCKET }}
+      AWS_EC2_METADATA_DISABLED: true
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7
+        with:
+          persist-credentials: false
+
+      - name: Download build and certification artifacts
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          path: ./artifacts
+          pattern: rustfs-*
+          merge-multiple: true
+
+      - name: Download certification evidence
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: release-certification
+          path: ./certification
+
+      - name: Verify and promote staged release artifacts
+        shell: bash
+        run: |
+          set -euo pipefail
+
+          if [[ -z "$R2_ACCESS_KEY_ID" || -z "$R2_SECRET_ACCESS_KEY" || -z "$R2_ENDPOINT" || -z "$R2_BUCKET" ]]; then
+            echo "❌ R2 credentials missing; refusing to promote to the official channel" >&2
+            exit 1
+          fi
+
+          for zip_file in artifacts/rustfs-*.zip; do
+            [[ -f "$zip_file" ]] || continue
+            name="$(basename "$zip_file")"
+            python3 scripts/release/release_gate.py verify-promotion \
+              --plan .config/release-validation-plan.json \
+              --candidate certification/candidate.json \
+              --summary certification/release-gate-output \
+              --artifact "$zip_file" \
+              --artifact-name "$name"
+          done
+
+          if ! command -v aws >/dev/null 2>&1; then
+            sudo apt-get update && sudo apt-get install -y awscli
+          fi
+          export AWS_ACCESS_KEY_ID="$R2_ACCESS_KEY_ID"
+          export AWS_SECRET_ACCESS_KEY="$R2_SECRET_ACCESS_KEY"
+          export AWS_DEFAULT_REGION="auto"
+
+          STAGING_PATH="s3://${R2_BUCKET}/artifacts/rustfs/staging/${GITHUB_RUN_ID}/${GITHUB_RUN_ATTEMPT}/"
+          RELEASE_PATH="s3://${R2_BUCKET}/artifacts/rustfs/release/"
+          for zip_file in artifacts/rustfs-*.zip; do
+            [[ -f "$zip_file" ]] || continue
+            name="$(basename "$zip_file")"
+            staged="$(mktemp)"
+            aws s3 cp "${STAGING_PATH}${name}" "$staged" --endpoint-url "$R2_ENDPOINT" --only-show-errors
+            staged_sha="$(sha256sum "$staged" | awk '{print $1}')"
+            built_sha="$(sha256sum "$zip_file" | awk '{print $1}')"
+            if [[ "$staged_sha" != "$built_sha" ]]; then
+              echo "❌ Staged object ${name} does not match the verified bytes" >&2
+              exit 1
+            fi
+            aws s3 cp "$staged" "${RELEASE_PATH}${name}" --endpoint-url "$R2_ENDPOINT" --only-show-errors
+            rm -f "$staged"
+            echo "✅ Promoted ${name} (${built_sha})"
+          done
+
  # Create GitHub Release for every valid release tag, including previews
  create-release:
    name: Create GitHub Release
@@ -1028,6 +1248,10 @@ jobs:
  update-latest-version:
    name: Update Latest Version
    needs: [ build-check, publish-release ]
+    # Target-channel lock for the latest.json version pointer.
+    concurrency:
+      group: release-channel-oss-latest
+      cancel-in-progress: false
    if: needs.build-check.outputs.should_publish == 'true' && startsWith(github.ref, 'refs/tags/') && (needs.build-check.outputs.build_type == 'release' || needs.build-check.outputs.build_type == 'prerelease')
    runs-on: ubuntu-latest
    timeout-minutes: 30
@@ -1068,6 +1292,45 @@ jobs:
          rm -rf "$OSSUTIL_DIR" "$OSSUTIL_ZIP"
          chmod +x "$OSSUTIL_BIN"

+          # Candidate/pointer ordering: an older candidate must never overwrite
+          # a newer pointer, even if its promotion job finishes later.
+          CURRENT_LATEST="${RUNNER_TEMP}/current-latest.json"
+          if "$OSSUTIL_BIN" cp oss://rustfs-version/latest.json "$CURRENT_LATEST" 2>/dev/null; then
+            python3 - "$CURRENT_LATEST" "$VERSION" <<'PY'
+          import json
+          import re
+          import sys
+
+          def key(version):
+              match = re.match(r"^(\d+)\.(\d+)\.(\d+)(?:-([0-9A-Za-z.-]+))?$", version)
+              if not match:
+                  raise SystemExit(3)
+              core = tuple(int(part) for part in match.groups()[:3])
+              prerelease = match.group(4)
+              if prerelease is None:
+                  return core + (1,)
+              return core + (0, tuple(int(p) if p.isdigit() else p for p in re.split(r"[.-]", prerelease)))
+
+          try:
+              current = json.load(open(sys.argv[1], encoding="utf-8")).get("version", "")
+              proposed = sys.argv[2]
+              if current and key(current) > key(proposed):
+                  raise SystemExit(1)
+          except SystemExit:
+              raise
+          except (OSError, ValueError, TypeError):
+              raise SystemExit(3)
+          PY
+            guard_status=$?
+            if [[ "$guard_status" -eq 1 ]]; then
+              echo "Current latest.json points at a newer version; refusing to downgrade" >&2
+              exit 0
+            elif [[ "$guard_status" -ne 0 ]]; then
+              echo "Existing latest.json is unparsable; refusing to overwrite it blindly" >&2
+              exit 1
+            fi
+          fi
+
          # Create latest.json
          cat > latest.json << EOF
          {
@@ -1084,16 +1347,59 @@ jobs:

          echo "✅ Updated latest.json for ${RELEASE_TYPE} release $VERSION"

-  # Publish release (remove draft status)
+  # Publish release (remove draft status). Requires the release-certification
+  # aggregate: without a complete legal success there is no public write.
  publish-release:
    name: Publish Release
-    needs: [ build-check, create-release, upload-release-assets ]
+    needs: [ build-check, create-release, upload-release-assets, release-certification ]
+    # Target-channel lock: concurrent releases serialize on this channel so an
+    # older candidate cannot interleave its publish with a newer one.
+    concurrency:
+      group: release-channel-github-release
+      cancel-in-progress: false
    if: needs.build-check.outputs.should_publish == 'true' && startsWith(github.ref, 'refs/tags/') && (needs.build-check.outputs.build_type == 'preview' || needs.build-check.outputs.build_type == 'release' || needs.build-check.outputs.build_type == 'prerelease')
    runs-on: ubuntu-latest # gh CLI required; the sm-standard-2 fleet does not ship it
    timeout-minutes: 30
    permissions:
      contents: write
+      actions: read
    steps:
+      - name: Checkout repository
+        uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7
+        with:
+          persist-credentials: false
+
+      - name: Download certification evidence
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: release-certification
+          path: ./certification
+
+      - name: Verify release assets against certification
+        env:
+          GH_TOKEN: ${{ github.token }}
+        shell: bash
+        run: |
+          set -euo pipefail
+          TAG="${{ needs.build-check.outputs.version }}"
+          mkdir -p "$RUNNER_TEMP/promotion-assets"
+          gh release download "$TAG" --dir "$RUNNER_TEMP/promotion-assets" --pattern '*.zip'
+          found=0
+          for zip_file in "$RUNNER_TEMP"/promotion-assets/*.zip; do
+            [[ -f "$zip_file" ]] || continue
+            found=1
+            python3 scripts/release/release_gate.py verify-promotion \
+              --plan .config/release-validation-plan.json \
+              --candidate certification/candidate.json \
+              --summary certification/release-gate-output \
+              --artifact "$zip_file" \
+              --artifact-name "$(basename "$zip_file")"
+          done
+          if [[ "$found" -ne 1 ]]; then
+            echo "No release zip assets to verify against the certification" >&2
+            exit 1
+          fi
+
      - name: Publish release
        env:
          GH_TOKEN: ${{ github.token }}
@@ -96,7 +96,7 @@ env:
  RUST_BACKTRACE: 1

 jobs:
-  # Readers: test-and-lint (workspace and ILM), build-rustfs-debug-binary,
+  # Readers: workspace-lint-and-build, workspace-tests (workspace and ILM), build-rustfs-debug-binary,
  # e2e-tests, e2e-full.
  warm-ci-dev:
    name: Warm ci-dev
@@ -146,7 +146,7 @@ jobs:
          if-no-files-found: error

      # --all-targets covers the test binaries nextest builds, including
-      # e2e_test, which test-and-lint's own run excludes. The second build adds
+      # e2e_test, which the workspace run excludes. The second build adds
      # the e2e-test-hooks feature resolution that build-rustfs-debug-binary uses
      # and that no lint lane enables.
      - name: Build ci-dev superset
@@ -113,7 +113,7 @@ jobs:
            printf '%s\n' 'mode=full' >> "$GITHUB_OUTPUT"
            echo "Base CI policy unavailable; running the full matrix."
          fi
-          if ! grep -q '^plan=' "$GITHUB_OUTPUT" || ! grep -q '^rehearse_shards=' "$GITHUB_OUTPUT"; then
+          if ! grep -q '^plan=' "$GITHUB_OUTPUT" || ! grep -q '^plan_contract=2$' "$GITHUB_OUTPUT"; then
            printf '%s\n' 'mode=full' 'connect=true' 'full_validation=true' 'rehearse_shards=false' 'packages=' 'plan=' >> "$GITHUB_OUTPUT"
            echo "Base policy does not cover this workflow contract; retaining the full matrix."
          fi
@@ -160,7 +160,7 @@ jobs:
      - name: Run shared quick checks
        uses: ./.github/actions/quick-checks

-  test-and-lint:
+  workspace-lint-and-build:
    name: Workspace Lint and Build
    if: contains(fromJSON('["full", "e2e"]'), needs.classify-changes.outputs.mode) && (github.event_name != 'pull_request' || github.event.action != 'closed')
    needs: [ quick-checks, classify-changes ]
@@ -193,13 +193,13 @@ jobs:

      - name: Prepare test evidence
        run: |
-          mkdir -p artifacts/test-and-lint
+          mkdir -p artifacts/workspace
          {
            echo "run_id=${GITHUB_RUN_ID}"
            echo "job=${GITHUB_JOB}"
            echo "runner=${RUNNER_NAME}"
            echo "started_at=$(date --utc --iso-8601=seconds)"
-          } > artifacts/test-and-lint/run-metadata.txt
+          } > artifacts/workspace/run-metadata.txt

      # Clippy gates every event, pull requests included. When it ran only after
      # merge, a lint regression merged freely and then failed every main run
@@ -233,11 +233,11 @@ jobs:

      - name: Run documentation tests
        run: |
-          mkdir -p artifacts/test-and-lint
+          mkdir -p artifacts/workspace
          set +e
          timeout --verbose --signal=TERM --kill-after=30s 15m \
            python3 scripts/ci_test_artifact.py cargo doc --configuration workspace \
-            2>&1 | tee artifacts/test-and-lint/doctest.log
+            2>&1 | tee artifacts/workspace/doctest.log
          status=${PIPESTATUS[0]}
          {
            echo "command=cargo test --all --exclude e2e_test --doc"
@@ -246,7 +246,7 @@ jobs:
            echo
            echo "Remaining test-related processes:"
            pgrep -af 'cargo|rustdoc|target/.*/deps/' || true
-          } > artifacts/test-and-lint/doctest-diagnostics.txt
+          } > artifacts/workspace/doctest-diagnostics.txt
          exit "${status}"

      - name: Upload test reports and diagnostics
@@ -255,7 +255,7 @@ jobs:
        with:
          name: junit-test-and-lint-${{ github.run_number }}-${{ github.run_attempt }}
          path: |
-            artifacts/test-and-lint
+            artifacts/workspace
          retention-days: 3
          if-no-files-found: error

@@ -268,7 +268,7 @@ jobs:

  workspace-tests:
    name: Workspace tests
-    needs: [ test-and-lint, classify-changes ]
+    needs: [ workspace-lint-and-build, classify-changes ]
    # The archive retains compile-time fixture paths and the large test set
    # requires the same runner image until the hosted-runtime pilot passes.
    runs-on: sm-standard-4
@@ -293,14 +293,14 @@ jobs:

      - name: Extract and list workspace tests
        run: |
-          mkdir -p artifacts/test-and-lint
+          mkdir -p artifacts/workspace
          cargo nextest list --profile ci --archive-file "$RUNNER_TEMP/workspace-tests.tar.zst" --workspace-remap "$GITHUB_WORKSPACE" --extract-to "$GITHUB_WORKSPACE" --extract-overwrite --message-format json \
-            > artifacts/test-and-lint/core-test-listing.json
-          python3 scripts/check_test_wiring.py --check-core artifacts/test-and-lint/core-test-listing.json
+            > artifacts/workspace/core-test-listing.json
+          python3 scripts/check_test_wiring.py --check-core artifacts/workspace/core-test-listing.json

      - name: Run nextest tests
        run: |
-          mkdir -p artifacts/test-and-lint
+          mkdir -p artifacts/workspace
          rm -f target/nextest/ci/junit.xml
          ./scripts/ci/resource_sampler.sh start nextest
          trap './scripts/ci/resource_sampler.sh stop' EXIT
@@ -309,7 +309,7 @@ jobs:
            cargo nextest run --profile ci --cargo-metadata target/nextest/cargo-metadata.json --binaries-metadata target/nextest/binaries-metadata.json \
            --workspace-remap "$GITHUB_WORKSPACE" --target-dir-remap "$GITHUB_WORKSPACE/target" \
            --status-level all --final-status-level all \
-            2>&1 | tee artifacts/test-and-lint/nextest.log
+            2>&1 | tee artifacts/workspace/nextest.log
          status=${PIPESTATUS[0]}
          {
            echo "command=workspace archive execution"
@@ -321,13 +321,13 @@ jobs:
            echo
            echo "Kernel OOM / kill events:"
            dmesg -T 2>/dev/null | grep -iE 'oom|out of memory|killed process' | tail -20 || true
-          } > artifacts/test-and-lint/nextest-diagnostics.txt
+          } > artifacts/workspace/nextest-diagnostics.txt
          exit "${status}"

      - name: Verify workspace execution completeness
        run: |
-          python3 scripts/ci_test_artifact.py evidence artifacts/test-and-lint/core-test-listing.json target/nextest/ci/junit.xml
-          ./scripts/check_migration_gate_count.sh evidence artifacts/test-and-lint/core-test-listing.json target/nextest/ci/junit.xml
+          python3 scripts/ci_test_artifact.py evidence artifacts/workspace/core-test-listing.json target/nextest/ci/junit.xml
+          ./scripts/check_migration_gate_count.sh evidence artifacts/workspace/core-test-listing.json target/nextest/ci/junit.xml

      - name: Run ignored ILM integration tests serially
        if: needs.classify-changes.outputs.mode == 'full'
@@ -358,7 +358,7 @@ jobs:
          name: workspace-test-evidence-${{ github.run_attempt }}
          path: |
            target/nextest/ci/junit.xml
-            artifacts/test-and-lint
+            artifacts/workspace
            artifacts/ilm-integration
          retention-days: 3
          if-no-files-found: error
@@ -368,7 +368,7 @@ jobs:
        if: needs.classify-changes.outputs.rehearse_shards == 'true'
        run: |
          python3 scripts/ci_test_shards.py prepare \
-            --listing artifacts/test-and-lint/core-test-listing.json \
+            --listing artifacts/workspace/core-test-listing.json \
            --junit target/nextest/ci/junit.xml --output artifacts/workspace-shard-plan
      - name: Upload same-run shard plan
        if: needs.classify-changes.outputs.rehearse_shards == 'true'
@@ -449,7 +449,7 @@ jobs:

  connect-feature-boundaries:
    name: Connect Feature Boundaries
-    if: needs.classify-changes.outputs.mode == 'full' && needs.classify-changes.outputs.connect != 'false' && (github.event_name != 'pull_request' || github.event.action != 'closed')
+    if: needs.classify-changes.outputs.mode == 'full' && needs.classify-changes.outputs.connect != 'false' && contains(fromJSON('["schedule", "workflow_dispatch"]'), github.event_name)
    needs: [ quick-checks, classify-changes ]
    runs-on: sm-standard-4
    timeout-minutes: 90
@@ -499,11 +499,13 @@ jobs:

  test-and-lint-rio-v2:
    name: Test and Lint (rio-v2)
-    # Alternate feature configurations run on the nightly schedule, merge
-    # groups and manual dispatch. The default workspace remains the PR gate and
-    # the per-push main baseline: repeating four feature builds on every merge
-    # bought nothing the nightly run does not report within a day.
-    if: needs.classify-changes.outputs.mode == 'full' && contains(fromJSON('["merge_group", "schedule", "workflow_dispatch"]'), github.event_name)
+    # Specialized boundary, hardware and alternate-feature lanes run only on
+    # the nightly schedule and manual dispatch. They do not gate a merge: the
+    # nightly run reports a regression within a day, and repeating these builds
+    # on every PR revision and merge group bought no earlier signal worth the
+    # runner occupancy. Workspace lint and tests, the core contract, the debug
+    # build, E2E smoke and the S3 lanes remain the pull-request gate.
+    if: needs.classify-changes.outputs.mode == 'full' && contains(fromJSON('["schedule", "workflow_dispatch"]'), github.event_name)
    needs: [ quick-checks, classify-changes ]
    runs-on: sm-standard-4
    timeout-minutes: 90
@@ -540,12 +542,12 @@ jobs:
          # --profile ci so the quarantine list (and its junit flaky markers)
          # covers this leg too; the default profile is the local no-retry
          # profile and silently ignored quarantined flakes here (rustfs#6703).
-          mkdir -p artifacts/test-and-lint
+          mkdir -p artifacts/workspace
          rm -f target/nextest/ci/junit.xml
          ./scripts/ci/resource_sampler.sh start nextest-rio-v2
          trap './scripts/ci/resource_sampler.sh stop' EXIT
          cargo nextest run --profile ci -p rustfs -p rustfs-ecstore --features rio-v2 \
-            2>&1 | tee artifacts/test-and-lint/nextest.log
+            2>&1 | tee artifacts/workspace/nextest.log
          cargo test -p rustfs --doc --features rio-v2

      - name: Upload rio-v2 test reports and diagnostics
@@ -555,14 +557,14 @@ jobs:
          name: junit-test-and-lint-rio-v2-${{ github.run_number }}-${{ github.run_attempt }}
          path: |
            target/nextest/ci/junit.xml
-            artifacts/test-and-lint
+            artifacts/workspace
          retention-days: 3
          if-no-files-found: error

  test-and-lint-protocols:
    name: "Test and Lint (${{ matrix.features.name }})"
    # Same cadence as test-and-lint-rio-v2 above.
-    if: needs.classify-changes.outputs.mode == 'full' && contains(fromJSON('["merge_group", "schedule", "workflow_dispatch"]'), github.event_name)
+    if: needs.classify-changes.outputs.mode == 'full' && contains(fromJSON('["schedule", "workflow_dispatch"]'), github.event_name)
    needs: [ quick-checks, classify-changes ]
    runs-on: sm-standard-4
    timeout-minutes: 90
@@ -631,7 +633,7 @@ jobs:
          path: |
            target/nextest/ci/junit.xml
            artifacts/protocol-tests
-            artifacts/test-and-lint
+            artifacts/workspace
          retention-days: 3
          if-no-files-found: warn

@@ -783,7 +785,7 @@ jobs:
    # job had neither, so each closed/merged PR really ran the whole io_uring
    # suite (measured 4m17s / 7m19s / 7m31s on runs 30678272341 / 30678117601 /
    # 30662728539) and kept the cancellation run in progress for minutes.
-    if: needs.classify-changes.outputs.mode == 'full' && (github.event_name != 'pull_request' || github.event.action != 'closed')
+    if: needs.classify-changes.outputs.mode == 'full' && contains(fromJSON('["schedule", "workflow_dispatch"]'), github.event_name)
    needs: [ quick-checks, classify-changes ]
    # GitHub-hosted ubuntu-latest runs a recent kernel with io_uring and, unlike
    # a container, applies no seccomp filter that would block io_uring_setup — so
@@ -978,7 +980,7 @@ jobs:
          path: |
            ${{ runner.temp }}/rustfs-e2e-smoke-logs/
            ${{ runner.temp }}/rustfs-e2e-smoke-list.json
-            artifacts/test-and-lint
+            artifacts/workspace
          if-no-files-found: warn

      - name: Upload e2e smoke JUnit report
@@ -1389,7 +1391,7 @@ jobs:
      - classify-changes
      - typos
      - quick-checks
-      - test-and-lint
+      - workspace-lint-and-build
      - workspace-tests
      - workspace-shards
      - workspace-shard-evidence
@@ -1425,7 +1427,7 @@ jobs:
      - required-checks
      - typos
      - quick-checks
-      - test-and-lint
+      - workspace-lint-and-build
      - workspace-tests
      - core-contract
      - test-and-lint-rio-v2
@@ -329,13 +329,75 @@ jobs:
          echo "  - Create latest: $create_latest"
          echo "  - Source ref: $source_ref"

+  # Consume the trusted release certification for the exact version this
+  # workflow wraps and verify the certified input digests. A manual dispatch
+  # without that certification fails here and pushes no official tag; only
+  # results from the trusted verification sources carry release authority.
+  release-certification:
+    name: Release Certification
+    needs: build-check
+    if: needs.build-check.outputs.should_build == 'true'
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    permissions:
+      contents: read
+      actions: read
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7
+        with:
+          persist-credentials: false
+          ref: ${{ needs.build-check.outputs.source_ref }}
+
+      - name: Download and verify release certification
+        env:
+          GH_TOKEN: ${{ secrets.RELEASE_VALIDATION_TOKEN || github.token }}
+          TRIGGERING_RUN_ID: ${{ github.event.workflow_run.id }}
+          VERSION: ${{ needs.build-check.outputs.version }}
+        shell: bash
+        run: |
+          set -euo pipefail
+          mkdir -p certification
+          run_id="$TRIGGERING_RUN_ID"
+          if [[ -z "$run_id" ]]; then
+            run_id="$(gh api --method GET \
+              "repos/${GITHUB_REPOSITORY}/actions/workflows/build.yml/runs" \
+              -f branch="$VERSION" -f status=success -F per_page=1 \
+              --jq '.workflow_runs[0].id // empty' || true)"
+          fi
+          if [[ -z "$run_id" ]]; then
+            echo "No certified Build and Release run found for ${VERSION}; failing closed" >&2
+            exit 1
+          fi
+          if ! gh run download "$run_id" -n release-certification -D certification; then
+            echo "Build run ${run_id} published no release-certification artifact; failing closed" >&2
+            exit 1
+          fi
+          python3 scripts/release/release_gate.py verify-promotion \
+            --plan .config/release-validation-plan.json \
+            --candidate certification/candidate.json \
+            --summary certification/release-gate-output \
+            --artifact-sha256 "$(jq -r '.deliverables[0].sha256' certification/candidate.json)" \
+            --artifact-name "$(jq -r '.deliverables[0].name' certification/candidate.json)"
+
+          # Input digest binding: every zip this image wraps must be the
+          # certified byte-for-byte content, never a mutable latest pointer.
+          while IFS=$'\t' read -r name location expected; do
+            echo "Verifying certified input ${name}"
+            actual="$(curl -fsSL "$location" | sha256sum | awk '{print $1}')"
+            if [[ "$actual" != "$expected" ]]; then
+              echo "Certified input ${name} does not match its recorded digest" >&2
+              exit 1
+            fi
+          done < <(jq -r '.deliverables[] | select(.name | contains("linux")) | [.name, .location, .sha256] | @tsv' certification/candidate.json)
+
  # Build multi-arch Docker images
  # Strategy: Build images using pre-built binaries from dl.rustfs.com
  # Supports both release and dev channel binaries based on build context
  # Only runs when should_build is true (which includes workflow success check)
  build-docker:
    name: Build Docker Images
-    needs: build-check
+    needs: [ build-check, release-certification ]
    if: needs.build-check.outputs.should_build == 'true'
    runs-on: ubuntu-latest
    timeout-minutes: 60
@@ -443,6 +505,14 @@ jobs:
          # Output tags
          echo "tags=$TAGS" >> "$GITHUB_OUTPUT"

+          # Staging identity for this run's promotion: official tags are only
+          # created after the staged image verifies against the certification,
+          # and they point at this same digest (no rebuild-after-verify).
+          STAGING_TAG="staging-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}${VARIANT_SUFFIX}"
+          STAGING_TAGS="${{ env.REGISTRY_DOCKERHUB }}:${STAGING_TAG},${{ env.REGISTRY_GHCR }}:${STAGING_TAG},${{ env.REGISTRY_QUAY }}:${STAGING_TAG}"
+          echo "staging_tags=$STAGING_TAGS" >> "$GITHUB_OUTPUT"
+          echo "staging_tag=$STAGING_TAG" >> "$GITHUB_OUTPUT"
+
          # Generate labels
          LABELS="org.opencontainers.image.title=RustFS"
          LABELS="$LABELS,org.opencontainers.image.description=RustFS distributed object storage system"
@@ -467,7 +537,9 @@ jobs:
          file: ${{ matrix.file }}
          platforms: ${{ env.DOCKER_PLATFORMS }}
          push: ${{ needs.build-check.outputs.should_push == 'true' }}
-          tags: ${{ steps.meta.outputs.tags }}
+          # Push to staging tags only: official tags are created by the
+          # certification-gated promotion step below from this same digest.
+          tags: ${{ steps.meta.outputs.staging_tags }}
          labels: ${{ steps.meta.outputs.labels }}
          # No layer cache. This build compiles nothing — it downloads a
          # release zip and runs apk/apt — so the cache could only save the
@@ -493,6 +565,114 @@ jobs:
          no-cache: false
          pull: true

+      # A later-built wrapper: the staged image must complete this platform's
+      # own binary identity verification before any official tag is written.
+      # It may not inherit an unverified package's conclusion.
+      - name: Verify staged image against certification
+        if: needs.build-check.outputs.should_push == 'true'
+        env:
+          GH_TOKEN: ${{ secrets.RELEASE_VALIDATION_TOKEN || github.token }}
+          TRIGGERING_RUN_ID: ${{ github.event.workflow_run.id }}
+          VERSION: ${{ needs.build-check.outputs.version }}
+        shell: bash
+        run: |
+          set -euo pipefail
+          mkdir -p certification
+          run_id="$TRIGGERING_RUN_ID"
+          if [[ -z "$run_id" ]]; then
+            run_id="$(gh api --method GET \
+              "repos/${GITHUB_REPOSITORY}/actions/workflows/build.yml/runs" \
+              -f branch="$VERSION" -f status=success -F per_page=1 \
+              --jq '.workflow_runs[0].id // empty' || true)"
+          fi
+          gh run download "$run_id" -n release-certification -D certification
+
+          STAGING_REF="${{ env.REGISTRY_DOCKERHUB }}:staging-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}${{ matrix.suffix }}"
+          case "${{ matrix.variant }}" in
+            musl) libc="musl" ;;
+            glibc) libc="gnu" ;;
+          esac
+          for platform in linux/amd64 linux/arm64; do
+            case "$platform" in
+              linux/amd64) arch_sub="x86_64" ;;
+              linux/arm64) arch_sub="aarch64" ;;
+            esac
+            docker pull --platform "$platform" "$STAGING_REF"
+            container="$(docker create --platform "$platform" "$STAGING_REF")"
+            docker cp "$container:/usr/bin/rustfs" "$RUNNER_TEMP/staged-rustfs"
+            docker rm "$container" >/dev/null
+            actual="$(sha256sum "$RUNNER_TEMP/staged-rustfs" | awk '{print $1}')"
+            expected="$(jq -r --arg needle "linux-${arch_sub}-${libc}" \
+              '[.deliverables[] | select(.name | contains($needle)) | .binary_sha256][0] // empty' \
+              certification/candidate.json)"
+            if [[ -z "$expected" || "$actual" != "$expected" ]]; then
+              echo "Staged image binary for ${platform} does not match the certified binary digest" >&2
+              exit 1
+            fi
+            python3 scripts/release/release_gate.py verify-promotion \
+              --plan .config/release-validation-plan.json \
+              --candidate certification/candidate.json \
+              --summary certification/release-gate-output \
+              --artifact "$RUNNER_TEMP/staged-rustfs" \
+              --artifact-role binary
+          done
+
+      - name: Promote staged image to official tags
+        if: needs.build-check.outputs.should_push == 'true'
+        shell: bash
+        run: |
+          set -euo pipefail
+          STAGING_REF="${{ env.REGISTRY_DOCKERHUB }}:staging-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}${{ matrix.suffix }}"
+          IFS=',' read -r -a official_tags <<< "${{ steps.meta.outputs.tags }}"
+          for tag in "${official_tags[@]}"; do
+            docker buildx imagetools create -t "$tag" "$STAGING_REF"
+            echo "Promoted $tag -> $STAGING_REF"
+          done
+
+      # Downstream consumers (Helm) verify this record instead of inheriting
+      # an unverified wrapper's conclusion.
+      - name: Record image promotion
+        if: needs.build-check.outputs.should_push == 'true'
+        shell: bash
+        env:
+          GH_TOKEN: ${{ secrets.RELEASE_VALIDATION_TOKEN || github.token }}
+          TRIGGERING_RUN_ID: ${{ github.event.workflow_run.id }}
+          VERSION: ${{ needs.build-check.outputs.version }}
+        run: |
+          set -euo pipefail
+          mkdir -p certification
+          run_id="$TRIGGERING_RUN_ID"
+          if [[ -z "$run_id" ]]; then
+            run_id="$(gh api --method GET \
+              "repos/${GITHUB_REPOSITORY}/actions/workflows/build.yml/runs" \
+              -f branch="$VERSION" -f status=success -F per_page=1 \
+              --jq '.workflow_runs[0].id // empty' || true)"
+          fi
+          gh run download "$run_id" -n release-certification -D certification
+          STAGING_REF="${{ env.REGISTRY_DOCKERHUB }}:staging-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}${{ matrix.suffix }}"
+          digest="$(docker buildx imagetools inspect "$STAGING_REF" --format '{{json .Manifest}}' | jq -r '.digest')"
+          candidate_sha="$(python3 -c "import json,hashlib,sys; sys.path.insert(0,'scripts/release'); import release_gate; print(release_gate.canonical_sha256(json.load(open('certification/candidate.json'))))")"
+          jq -n \
+            --arg version "$VERSION" \
+            --arg digest "$digest" \
+            --arg staging_ref "$STAGING_REF" \
+            --arg candidate_sha256 "$candidate_sha" \
+            --arg tags "${{ steps.meta.outputs.tags }}" \
+            --slurpfile candidate certification/candidate.json \
+            '{schema_version: 1, version: $version, image_digest: $digest, staging_ref: $staging_ref,
+              promoted_tags: ($tags | split(",")), candidate_sha256: $candidate_sha256,
+              binary_sha256s: ($candidate[0].deliverables | map(.binary_sha256) | unique)}' \
+            > image-promotion-record.json
+
+      - name: Upload image promotion record
+        if: needs.build-check.outputs.should_push == 'true'
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: image-promotion-record${{ matrix.suffix }}
+          path: image-promotion-record.json
+          if-no-files-found: error
+          retention-days: 30
+
  # Note: Manifest creation is no longer needed as we only build one variant
  # Multi-arch manifests are automatically created by docker/build-push-action

@@ -30,9 +30,102 @@ permissions:
  contents: read

 jobs:
+  # Consume the same trusted release certification as every other publication
+  # exit and verify the image promotion record of the Docker workflow. The
+  # chart wraps no binary of its own, so it may only reference an image whose
+  # platform verification already passed; it must not inherit an unverified
+  # package's conclusion. A run without that evidence fails closed here and
+  # never reaches the chart repository.
+  release-certification:
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    permissions:
+      contents: read
+      actions: read
+    outputs:
+      version: ${{ steps.version.outputs.raw_tag }}
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7
+        with:
+          persist-credentials: false
+
+      - name: Normalize release version
+        id: version
+        env:
+          RAW_INPUT: ${{ github.event.inputs.version }}
+          RAW_BRANCH: ${{ github.event.workflow_run.head_branch }}
+        run: |
+          set -euo pipefail
+          if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
+            RAW="$RAW_INPUT"
+          else
+            RAW="$RAW_BRANCH"
+          fi
+          case "$RAW" in
+            refs/tags/*) RAW_TAG="${RAW#refs/tags/}" ;;
+            *) RAW_TAG="$RAW" ;;
+          esac
+          echo "raw_tag=$RAW_TAG" >> "$GITHUB_OUTPUT"
+
+      - name: Download and verify release certification and image record
+        env:
+          GH_TOKEN: ${{ secrets.RELEASE_VALIDATION_TOKEN || github.token }}
+          TRIGGERING_RUN_ID: ${{ github.event.workflow_run.id }}
+          RAW_TAG: ${{ steps.version.outputs.raw_tag }}
+        shell: bash
+        run: |
+          set -euo pipefail
+          mkdir -p certification image-record
+
+          build_run="$TRIGGERING_RUN_ID"
+          if [[ -z "$build_run" ]]; then
+            build_run="$(gh api --method GET \
+              "repos/${GITHUB_REPOSITORY}/actions/workflows/build.yml/runs" \
+              -f branch="$RAW_TAG" -f status=success -F per_page=1 \
+              --jq '.workflow_runs[0].id // empty' || true)"
+          fi
+          if [[ -z "$build_run" ]]; then
+            echo "No certified Build and Release run found for ${RAW_TAG}; failing closed" >&2
+            exit 1
+          fi
+          if ! gh run download "$build_run" -n release-certification -D certification; then
+            echo "Build run ${build_run} published no release-certification artifact; failing closed" >&2
+            exit 1
+          fi
+          python3 scripts/release/release_gate.py verify-promotion \
+            --plan .config/release-validation-plan.json \
+            --candidate certification/candidate.json \
+            --summary certification/release-gate-output \
+            --artifact-sha256 "$(jq -r '.deliverables[0].sha256' certification/candidate.json)" \
+            --artifact-name "$(jq -r '.deliverables[0].name' certification/candidate.json)"
+
+          docker_run="$(gh api --method GET \
+            "repos/${GITHUB_REPOSITORY}/actions/workflows/docker.yml/runs" \
+            -f branch="$RAW_TAG" -f status=success -F per_page=1 \
+            --jq '.workflow_runs[0].id // empty' || true)"
+          if [[ -z "$docker_run" ]] || ! gh run download "$docker_run" -n image-promotion-record -D image-record; then
+            echo "No image promotion record for ${RAW_TAG}; a chart may not wrap an unverified image" >&2
+            exit 1
+          fi
+          candidate_sha="$(python3 -c "import json,hashlib,sys; sys.path.insert(0,'scripts/release'); import release_gate; print(release_gate.canonical_sha256(json.load(open('certification/candidate.json'))))")"
+          record_sha="$(jq -r '.candidate_sha256 // empty' image-record/image-promotion-record.json)"
+          if [[ "$record_sha" != "$candidate_sha" ]]; then
+            echo "Image promotion record does not belong to this certification" >&2
+            exit 1
+          fi
+          overlap="$(jq -r --slurpfile candidate certification/candidate.json \
+            '[.binary_sha256s[]] - ($candidate[0].deliverables | map(.binary_sha256)) | length' \
+            image-record/image-promotion-record.json)"
+          if [[ "$overlap" -ne 0 ]]; then
+            echo "Image promotion record carries binary digests outside the certification" >&2
+            exit 1
+          fi
+
  build-helm-package:
    runs-on: ubuntu-latest
    timeout-minutes: 30
+    needs: [ release-certification ]
    if: |
      (github.event_name == 'workflow_dispatch' && !contains(github.event.inputs.version, '-preview')) ||
      (
@@ -225,10 +225,57 @@ jobs:
          echo "  Build run ID: $BUILD_RUN_ID"
          echo "  Build run number: $RUN_NUMBER"

+  # Consume the trusted release certification of the resolved build run and
+  # verify the certified input digests before any package is wrapped. A run
+  # without that certification fails closed here; packages built later must
+  # complete their own verification and cannot inherit an unverified
+  # conclusion.
+  release-certification:
+    name: Release Certification
+    needs: resolve
+    if: needs.resolve.result == 'success'
+    runs-on: ubuntu-latest # gh CLI required; the sm-standard-2 fleet does not ship it
+    timeout-minutes: 30
+    permissions:
+      contents: read
+      actions: read
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7
+        with:
+          persist-credentials: false
+
+      - name: Download and verify release certification
+        env:
+          GH_TOKEN: ${{ secrets.RELEASE_VALIDATION_TOKEN || github.token }}
+          BUILD_RUN_ID: ${{ needs.resolve.outputs.build_run_id }}
+          BUILD_TYPE: ${{ needs.resolve.outputs.build_type }}
+        shell: bash
+        run: |
+          set -euo pipefail
+          mkdir -p certification
+          if [[ "$BUILD_TYPE" == "development" ]]; then
+            # Development artifacts are explicitly uncertified and never touch
+            # official or latest channels; only the staging/dev paths remain.
+            jq -n '{schema_version: 1, certified: false, reason: "development artifacts are explicitly uncertified"}' \
+              > certification/development-uncertified.json
+            exit 0
+          fi
+          if ! gh run download "$BUILD_RUN_ID" -n release-certification -D certification; then
+            echo "Build run ${BUILD_RUN_ID} published no release-certification artifact; failing closed" >&2
+            exit 1
+          fi
+          python3 scripts/release/release_gate.py verify-promotion \
+            --plan .config/release-validation-plan.json \
+            --candidate certification/candidate.json \
+            --summary certification/release-gate-output \
+            --artifact-sha256 "$(jq -r '.deliverables[0].sha256' certification/candidate.json)" \
+            --artifact-name "$(jq -r '.deliverables[0].name' certification/candidate.json)"
+
  # Build DEB and RPM packages for each architecture and libc variant
  package:
    name: Package (${{ matrix.arch }}-${{ matrix.libc }})
-    needs: resolve
+    needs: [ resolve, release-certification ]
    runs-on: ubuntu-latest # gh CLI required; the sm-standard-2 fleet does not ship it
    timeout-minutes: 30
    strategy:
@@ -494,6 +541,55 @@ jobs:
          echo "rpm_file=$RPM_FILE" >> "$GITHUB_OUTPUT"
          echo "✅ RPM built: $RPM_FILE"

+      - name: Download certification evidence
+        if: needs.resolve.outputs.build_type != 'development'
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: release-certification
+          path: ./certification
+
+      # Later-built wrapper verification: the binary inside each package must
+      # match the certified binary digest for this platform before anything is
+      # uploaded, and the package itself stays on staging until promotion.
+      - name: Verify wrapped binary against certification
+        if: needs.resolve.outputs.build_type != 'development'
+        shell: bash
+        env:
+          DEB_FILE: ${{ steps.deb.outputs.deb_file }}
+          RPM_FILE: ${{ steps.rpm.outputs.rpm_file }}
+          ARTIFACT_NAME: ${{ matrix.artifact_name }}
+        run: |
+          set -euo pipefail
+          expected="$(jq -r --arg needle "$ARTIFACT_NAME" \
+            '[.deliverables[] | select(.name | contains($needle)) | .binary_sha256][0] // empty' \
+            certification/candidate.json)"
+          if [[ -z "$expected" ]]; then
+            echo "No certified binary digest recorded for ${ARTIFACT_NAME}" >&2
+            exit 1
+          fi
+          if ! command -v rpm2cpio >/dev/null 2>&1; then
+            sudo apt-get update && sudo apt-get install -y rpm2cpio
+          fi
+          if ! command -v cpio >/dev/null 2>&1; then
+            sudo apt-get update && sudo apt-get install -y cpio
+          fi
+          for package_file in "$DEB_FILE" "$RPM_FILE"; do
+            case "$package_file" in
+              *.deb)
+                dpkg-deb --fsys-tarfile "$package_file" | tar -xOf - ./usr/bin/rustfs > "$RUNNER_TEMP/wrapped-rustfs"
+                ;;
+              *.rpm)
+                rpm2cpio "$package_file" | cpio -i --to-stdout ./usr/bin/rustfs > "$RUNNER_TEMP/wrapped-rustfs"
+                ;;
+            esac
+            python3 scripts/release/release_gate.py verify-promotion \
+              --plan .config/release-validation-plan.json \
+              --candidate certification/candidate.json \
+              --summary certification/release-gate-output \
+              --artifact "$RUNNER_TEMP/wrapped-rustfs" \
+              --artifact-role binary
+          done
+
      - name: Upload packages to artifacts
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
@@ -531,10 +627,14 @@ jobs:
          export AWS_SECRET_ACCESS_KEY="$R2_SECRET_ACCESS_KEY"
          export AWS_DEFAULT_REGION="auto"

+          # Build-phase writes stay on staging for release types: the official
+          # packages/release and packages/latest paths are written only by the
+          # certification-gated promote-packages job, from these same staged
+          # objects. Development packages keep the uncertified dev channel.
          if [[ "$BUILD_TYPE" == "development" ]]; then
            R2_PREFIX="artifacts/rustfs/packages/dev"
          else
-            R2_PREFIX="artifacts/rustfs/packages/release"
+            R2_PREFIX="artifacts/rustfs/packages/staging/${GITHUB_RUN_ID}/${GITHUB_RUN_ATTEMPT}"
          fi
          R2_PATH="s3://${R2_BUCKET}/${R2_PREFIX}/"

@@ -549,18 +649,6 @@ jobs:

          echo "✅ Upload complete"

-          # Also upload as latest for release/prerelease
-          if [[ "$BUILD_TYPE" == "release" || "$BUILD_TYPE" == "prerelease" ]]; then
-            LATEST_PATH="s3://${R2_BUCKET}/artifacts/rustfs/packages/latest/"
-            for f in "$DEB_FILE" "$RPM_FILE"; do
-              if [[ -n "$f" && -f "$f" ]]; then
-                echo "Uploading latest: $(basename "$f")"
-                aws s3 cp "$f" "$LATEST_PATH" --endpoint-url "$R2_ENDPOINT" --only-show-errors
-              fi
-            done
-            echo "✅ Latest packages updated"
-          fi
-
      - name: Upload packages to GitHub Release
        if: needs.resolve.outputs.tag != ''
        env:
@@ -614,6 +702,114 @@ jobs:

          echo "✅ GitHub release assets updated"

+  # The only writer of the official packages/release and packages/latest R2
+  # paths. Promotion re-checks each package's wrapped binary against the
+  # passed certification list and copies the staged objects byte-for-byte:
+  # no rebuild-after-verify, no mutable latest resolution downstream.
+  promote-packages:
+    name: Promote Packages
+    needs: [ resolve, package, release-certification ]
+    # Target-channel lock for the official package paths.
+    concurrency:
+      group: release-channel-r2-packages
+      cancel-in-progress: false
+    if: needs.resolve.outputs.tag != '' && (needs.resolve.outputs.build_type == 'release' || needs.resolve.outputs.build_type == 'prerelease')
+    runs-on: ubuntu-latest # gh CLI required; the sm-standard-2 fleet does not ship it
+    timeout-minutes: 30
+    permissions:
+      contents: read
+      actions: read
+    env:
+      R2_ACCESS_KEY_ID: ${{ secrets.R2_ACCESS_KEY_ID }}
+      R2_SECRET_ACCESS_KEY: ${{ secrets.R2_SECRET_ACCESS_KEY }}
+      R2_ENDPOINT: ${{ secrets.R2_ENDPOINT }}
+      R2_BUCKET: ${{ secrets.R2_BUCKET }}
+      AWS_EC2_METADATA_DISABLED: true
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7
+        with:
+          persist-credentials: false
+
+      - name: Download packages and certification
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          path: ./packages
+          pattern: packages-*
+          merge-multiple: true
+
+      - name: Download certification evidence
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: release-certification
+          path: ./certification
+
+      - name: Verify and promote staged packages
+        shell: bash
+        run: |
+          set -euo pipefail
+
+          if [[ -z "$R2_ACCESS_KEY_ID" || -z "$R2_SECRET_ACCESS_KEY" || -z "$R2_ENDPOINT" || -z "$R2_BUCKET" ]]; then
+            echo "❌ R2 credentials missing; refusing to promote to the official channel" >&2
+            exit 1
+          fi
+
+          STAGING_PREFIX="s3://${R2_BUCKET}/artifacts/rustfs/packages/staging/${GITHUB_RUN_ID}/${GITHUB_RUN_ATTEMPT}/"
+          RELEASE_PATH="s3://${R2_BUCKET}/artifacts/rustfs/packages/release/"
+          LATEST_PATH="s3://${R2_BUCKET}/artifacts/rustfs/packages/latest/"
+
+          if ! command -v aws >/dev/null 2>&1; then
+            sudo apt-get update && sudo apt-get install -y awscli
+          fi
+          export AWS_ACCESS_KEY_ID="$R2_ACCESS_KEY_ID"
+          export AWS_SECRET_ACCESS_KEY="$R2_SECRET_ACCESS_KEY"
+          export AWS_DEFAULT_REGION="auto"
+
+          if ! command -v rpm2cpio >/dev/null 2>&1; then
+            sudo apt-get install -y rpm2cpio
+          fi
+          if ! command -v cpio >/dev/null 2>&1; then
+            sudo apt-get install -y cpio
+          fi
+
+          promoted=0
+          for package_file in packages/*.deb packages/*.rpm; do
+            [[ -f "$package_file" ]] || continue
+            name="$(basename "$package_file")"
+            case "$package_file" in
+              *.deb)
+                dpkg-deb --fsys-tarfile "$package_file" | tar -xOf - ./usr/bin/rustfs > "$RUNNER_TEMP/wrapped-rustfs"
+                ;;
+              *.rpm)
+                rpm2cpio "$package_file" | cpio -i --to-stdout ./usr/bin/rustfs > "$RUNNER_TEMP/wrapped-rustfs"
+                ;;
+            esac
+            python3 scripts/release/release_gate.py verify-promotion \
+              --plan .config/release-validation-plan.json \
+              --candidate certification/candidate.json \
+              --summary certification/release-gate-output \
+              --artifact "$RUNNER_TEMP/wrapped-rustfs" \
+              --artifact-role binary
+
+            staged="$(mktemp)"
+            aws s3 cp "${STAGING_PREFIX}${name}" "$staged" --endpoint-url "$R2_ENDPOINT" --only-show-errors
+            staged_sha="$(sha256sum "$staged" | awk '{print $1}')"
+            built_sha="$(sha256sum "$package_file" | awk '{print $1}')"
+            if [[ "$staged_sha" != "$built_sha" ]]; then
+              echo "❌ Staged package ${name} does not match the verified bytes" >&2
+              exit 1
+            fi
+            aws s3 cp "$staged" "${RELEASE_PATH}${name}" --endpoint-url "$R2_ENDPOINT" --only-show-errors
+            aws s3 cp "$staged" "${LATEST_PATH}${name}" --endpoint-url "$R2_ENDPOINT" --only-show-errors
+            rm -f "$staged"
+            promoted=$((promoted + 1))
+            echo "✅ Promoted ${name} (${built_sha})"
+          done
+          if [[ "$promoted" -eq 0 ]]; then
+            echo "No staged packages found to promote" >&2
+            exit 1
+          fi
+
  # Summary
  summary:
    name: Summary
@@ -1321,9 +1321,9 @@ dependencies = [

 [[package]]
 name = "aws-smithy-schema"
-version = "1.1.0"
+version = "1.1.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bec8dae1015a6d959a5faf86fbdf77486cfe19e4ccb6ee009d8a46efc45028a4"
+checksum = "9543fc722ed4865ab29fb66bd7ed0bef7b029d265ba8c587144511e30006d431"
 dependencies = [
 "aws-smithy-runtime-api",
 "aws-smithy-types",
@@ -4198,9 +4198,9 @@ checksum = "34aa73646ffb006b8f5147f3dc182bd4bcb190227ce861fc4a4844bf8e3cb2c0"

 [[package]]
 name = "encoding_rs"
-version = "0.8.42"
+version = "0.8.44"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8e985e0451871ad22fb8d2b6b076e2028a502a0d3950998c2c5c0a4f9b5d9679"
+checksum = "89253175e704ab869b04f9db224d38630e0211a53841a79181deae0889e169f5"
 dependencies = [
 "cfg-if",
 "core_detect",
@@ -5277,9 +5277,9 @@ dependencies = [

 [[package]]
 name = "hotpath"
-version = "0.30.1"
+version = "0.30.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "502dc37a7c218b9b1d3a0ccfb904da81d10d6dda0e899c722c503092d55576ea"
+checksum = "b39e941010d86063ff233bf8325269bf68097fb24ba67000fbddc0a410e8056e"
 dependencies = [
 "arc-swap",
 "async-channel",
@@ -5312,15 +5312,15 @@ dependencies = [

 [[package]]
 name = "hotpath-drain"
-version = "0.30.1"
+version = "0.30.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0ea17d04c231b90b1f68a91f6f80fb0762c5dea07c611dce9ae157b56a50ff4c"
+checksum = "d0faae1a9e1fd8ce5debaaaf452dcbe833fc8a8a4f3779d2ec8828b116c3c16a"

 [[package]]
 name = "hotpath-macros"
-version = "0.30.1"
+version = "0.30.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a76e0af911930fc97abc766b393b48cdca77fea9f5f6b388cf2123a6d9c30deb"
+checksum = "a24f5179ff680132003306354efd0ac8cde12e87b1a788719c836e91af35cb58"
 dependencies = [
 "proc-macro2",
 "quote",
@@ -5899,9 +5899,9 @@ dependencies = [

 [[package]]
 name = "js-sys"
-version = "0.3.106"
+version = "0.3.107"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7883d941dae510fb2d978fc3fe018c71c9e2892fd38854de3e8b92c2e5ad9cc5"
+checksum = "8dc09d2154098bbf4ef54eab6b117a3c24cbbffe94046b16ee6d6d4510584d3a"
 dependencies = [
 "cfg-if",
 "futures-util",
@@ -6094,9 +6094,9 @@ dependencies = [

 [[package]]
 name = "libbz2-rs-sys"
-version = "0.2.5"
+version = "0.2.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "34b357333733e8260735ba5894eb928c02ecc69c78715f01a8019e7fa7f2db4c"
+checksum = "32f454fd6831a29c0e827ed075bca2a15be201bd57f4168f0fd1041124eab17e"

 [[package]]
 name = "libc"
@@ -8305,9 +8305,9 @@ dependencies = [

 [[package]]
 name = "pulldown-cmark"
-version = "0.13.5"
+version = "0.13.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "278e9268c93b9e498a2da46c34d90ba93a3255eb99009646398f34bc73ab36eb"
+checksum = "3db2be46835f013dd3f4fa7f5f7402c537787b54ebb6fe2b94bbdd7e2669bb7b"
 dependencies = [
 "bitflags 2.13.2",
 "memchr",
@@ -8823,9 +8823,9 @@ dependencies = [

 [[package]]
 name = "redis"
-version = "1.8.0"
+version = "1.8.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7acd809e80afa754c63f586955699d8990efe1c4b6613183ee5f027a11fbc8b5"
+checksum = "db7f3d75b5a3301746bff39a767bf4c5c42506b08513527308b3875bfb64a031"
 dependencies = [
 "arc-swap",
 "arcstr",
@@ -12217,9 +12217,9 @@ dependencies = [

 [[package]]
 name = "sysinfo"
-version = "0.40.0"
+version = "0.40.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "110e37d98880fd804cd47509b90a8444f7aaaab655ae625e83cd442a8bc2ebf2"
+checksum = "0e8a3edbe0394ce115f3917a00349dd242be09eb5a091ed509eaf67b55cfb8a8"
 dependencies = [
 "libc",
 "memchr",
@@ -12710,9 +12710,9 @@ checksum = "06bdbd8cfc056b8d2e2e85f29b56a3bdbecb527cef81eb39e3e7b98af4652770"

 [[package]]
 name = "tonic"
-version = "0.14.8"
+version = "0.14.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cd1fa9b1a51188f3266a823208078315811269d06d272c3a61be0b9a194194ff"
+checksum = "e2cdfc673aabd30fe8fee92e65837b644c37c5d47f0f97ae6d5e0f1237d15e1b"
 dependencies = [
 "async-trait",
 "axum",
@@ -12743,9 +12743,9 @@ dependencies = [

 [[package]]
 name = "tonic-build"
-version = "0.14.8"
+version = "0.14.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2c07bd4e9f99e2a3ed8bebad596ae02a94e53745b68acc6900e22c3475c8bc44"
+checksum = "ac6d916d206ed7bdda1778ddff9bda43303789c258877e7bc22fb44ee5c984b4"
 dependencies = [
 "prettyplease 0.2.37",
 "proc-macro2",
@@ -12755,9 +12755,9 @@ dependencies = [

 [[package]]
 name = "tonic-prost"
-version = "0.14.8"
+version = "0.14.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f63c616ffaa648f7c5dd5657e97d9a285fcb44ff3b70da761d436f5a13ff7be6"
+checksum = "eba464054e2226f182a34489b8b079bf4c6e3e7ab5fd7fc30e024f24aa92a484"
 dependencies = [
 "bytes",
 "prost 0.14.4",
@@ -12766,9 +12766,9 @@ dependencies = [

 [[package]]
 name = "tonic-prost-build"
-version = "0.14.8"
+version = "0.14.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4a05d8957fac6b3542999796cb4449d45da790751962f974a457e5e00c43d78c"
+checksum = "2ea216ddc448e08e7839ab09e20e60b06b6a1c32745ccb212c0ebd161c199f1b"
 dependencies = [
 "prettyplease 0.2.37",
 "proc-macro2",
@@ -13161,9 +13161,12 @@ checksum = "daf8dba3b7eb870caf1ddeed7bc9d2a049f3cfdfae7cb521b087cc33ae4c49da"

 [[package]]
 name = "utf8_iter"
-version = "1.0.4"
+version = "1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b6c140620e7ffbb22c2dee59cafe6084a59b5ffc27a8859a5f0d494b5d52b6be"
+checksum = "af3bd9d3e571c26fcce9d033b87ea5ab061b8d2ffe9b7a5675d810d68f03edf0"
+dependencies = [
+ "utf_types",
+]

 [[package]]
 name = "utf8parse"
@@ -13171,6 +13174,12 @@ version = "0.2.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "06abde3611657adf66d383f00b093d7faecc7fa57071cce2578660c9f1010821"

+[[package]]
+name = "utf_types"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3a3b425286980a367278453f3b6d28cdcb134b574e5a35824a6ff5eebad50bb6"
+
 [[package]]
 name = "uuid"
 version = "1.29.0"
@@ -13285,12 +13294,11 @@ dependencies = [

 [[package]]
 name = "wasm-bindgen"
-version = "0.2.129"
+version = "0.2.130"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9bb54f33acc68fd454578d9820b0bde1a1a3d17aa17bb7b6595806d02886d409"
+checksum = "a0181c14ddd6c7b8b0b0132a5f1ea2f32be0d893cd3ea97b6e3b28886b8a3d1c"
 dependencies = [
 "cfg-if",
- "once_cell",
 "rustversion",
 "wasm-bindgen-macro",
 "wasm-bindgen-shared",
@@ -13298,9 +13306,9 @@ dependencies = [

 [[package]]
 name = "wasm-bindgen-futures"
-version = "0.4.79"
+version = "0.4.80"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3cbab34de2d982e9b48e18d216d04c4a6f641066ff19ffb699980f591ee3610e"
+checksum = "5e14e0327cb5368ad60ccb22d04a9827a693c95a926d8d125e9fa39e0baec501"
 dependencies = [
 "js-sys",
 "tokio",
@@ -13309,9 +13317,9 @@ dependencies = [

 [[package]]
 name = "wasm-bindgen-macro"
-version = "0.2.129"
+version = "0.2.130"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2e29d0c35b16e224a7eeb5cd2d25e3e1968fbd65604117b44d3b789d00ee8535"
+checksum = "6e931a02a39abdbf66966fc35902b5ed58344750a70885bed4ebb3d8eaf28ed9"
 dependencies = [
 "quote",
 "wasm-bindgen-macro-support",
@@ -13319,9 +13327,9 @@ dependencies = [

 [[package]]
 name = "wasm-bindgen-macro-support"
-version = "0.2.129"
+version = "0.2.130"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6f501a8bc3719dba86ef8ae4728879c08001bea749eb1333ac5b91e040e2a6b7"
+checksum = "2ca4b54280e455bd831e33a6b8e734baf432fe63fbc35c42ac14ce67a043a53a"
 dependencies = [
 "bumpalo",
 "proc-macro2",
@@ -13332,9 +13340,9 @@ dependencies = [

 [[package]]
 name = "wasm-bindgen-shared"
-version = "0.2.129"
+version = "0.2.130"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "23f0c9c52aa7cd7d77769a4cfe2a9adb1b331f489a41d912ce14513d5ab995c6"
+checksum = "3b1f9c3798725016c6ee5f2f57869ec0831e8bbc0ab0310a86e787e97f41389e"
 dependencies = [
 "unicode-ident",
 ]
@@ -13354,9 +13362,9 @@ dependencies = [

 [[package]]
 name = "web-sys"
-version = "0.3.106"
+version = "0.3.107"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "88261b9deccee56594c11a3460c462c41f58d148598fe70ad77070126a68aba4"
+checksum = "d7d179596ff5ec0f6de4db64d54011bde6289cc49603d3a6e4ce3f329207ab88"
 dependencies = [
 "js-sys",
 "wasm-bindgen",
@@ -175,9 +175,9 @@ tokio-rustls = { default-features = false, version = "0.26.6" }
 tokio-stream = { version = "0.1.19" }
 tokio-test = "0.4.6"
 tokio-util = { version = "0.7.20" }
-tonic = { version = "0.14.8" }
-tonic-prost = { version = "0.14.8" }
-tonic-prost-build = { version = "0.14.8" }
+tonic = { version = "0.14.9" }
+tonic-prost = { version = "0.14.9" }
+tonic-prost-build = { version = "0.14.9" }
 tower = { version = "0.5.3" }
 tower-http = { version = "0.7.1" }
 h3 = "0.0.8"
@@ -319,7 +319,7 @@ rustfs-erasure-codec = { version = "9.0.0" }
 reed-solomon-simd = "3.1.0"
 regex = { version = "1.13.1" }
 rumqttc = { package = "rumqttc-next", version = "0.34.0" }
-redis = { version = "1.8.0" }
+redis = { version = "1.8.1" }
 rustify = { version = "0.7", default-features = false }
 rustix = { version = "1.1.6" }
 rust-embed = { version = "8.13.0" }
@@ -334,7 +334,7 @@ compact_str = "0.10.0"
 snap = "1.1.2"
 starshard = { version = "2.4.0" }
 strum = { version = "0.28.0" }
-sysinfo = "0.40.0"
+sysinfo = "0.40.1"
 temp-env = "0.3.6"
 tempfile = "3.27.0"
 test-case = "3.4.0"
@@ -386,7 +386,7 @@ dav-server = "0.11.0"
 # Performance Analysis and Memory Profiling
 rustfs-mimalloc = { version = "0.7.2" }
 # Preserve Unicode focus filters until rustfs/backlog#2302 is resolved.
-hotpath = { version = "0.30.1", default-features = false }
+hotpath = { version = "0.30.2", default-features = false }
 # Snapshot testing for output format regression detection
 insta = { version = "1.49" }

@@ -16,8 +16,193 @@
 mod tests {
    use crate::common::{RustFSTestEnvironment, init_logging};
    use aws_sdk_s3::Client;
+    use aws_sdk_s3::config::http::HttpResponse;
+    use aws_sdk_s3::error::{ProvideErrorMetadata, SdkError};
    use aws_sdk_s3::primitives::ByteStream;
-    use aws_sdk_s3::types::{BucketVersioningStatus, VersioningConfiguration};
+    use aws_sdk_s3::types::{BucketVersioningStatus, CompletedMultipartUpload, CompletedPart, VersioningConfiguration};
+
+    fn assert_not_found<E: ProvideErrorMetadata + std::fmt::Debug>(error: &SdkError<E, HttpResponse>) {
+        assert_eq!(error.raw_response().map(|r| r.status().as_u16()), Some(404), "{error:?}");
+        assert_eq!(
+            error.as_service_error().and_then(ProvideErrorMetadata::code),
+            Some("NoSuchKey"),
+            "{error:?}"
+        );
+    }
+
+    #[tokio::test]
+    async fn conditional_writes_cannot_replace_delete_marker_with_if_match() {
+        init_logging();
+        let mut env = RustFSTestEnvironment::new().await.expect("create test environment");
+        env.start_rustfs_server(vec![]).await.expect("start RustFS");
+        let client = env.create_s3_client();
+        let bucket = "conditional-delete-marker-proof";
+        create_versioned_bucket(&client, bucket).await;
+        client
+            .put_object()
+            .bucket(bucket)
+            .key("source")
+            .body(ByteStream::from_static(b"source"))
+            .send()
+            .await
+            .expect("write copy source");
+
+        for operation in ["put", "copy", "multipart"] {
+            let old = client
+                .put_object()
+                .bucket(bucket)
+                .key(operation)
+                .body(ByteStream::from_static(b"old"))
+                .send()
+                .await
+                .expect("write historical version");
+            let old_etag = old.e_tag().expect("historical ETag");
+            let marker = client
+                .delete_object()
+                .bucket(bucket)
+                .key(operation)
+                .send()
+                .await
+                .expect("create delete marker");
+            let marker_id = marker.version_id().expect("delete marker version");
+
+            let (upload_id, completed) = if operation == "multipart" {
+                let upload = client
+                    .create_multipart_upload()
+                    .bucket(bucket)
+                    .key(operation)
+                    .send()
+                    .await
+                    .expect("initiate multipart upload");
+                let upload_id = upload.upload_id().expect("upload ID").to_owned();
+                let part = client
+                    .upload_part()
+                    .bucket(bucket)
+                    .key(operation)
+                    .upload_id(&upload_id)
+                    .part_number(1)
+                    .body(ByteStream::from_static(b"new"))
+                    .send()
+                    .await
+                    .expect("upload part");
+                let completed = CompletedMultipartUpload::builder()
+                    .parts(
+                        CompletedPart::builder()
+                            .part_number(1)
+                            .set_e_tag(part.e_tag().map(str::to_owned))
+                            .build(),
+                    )
+                    .build();
+                (Some(upload_id), Some(completed))
+            } else {
+                (None, None)
+            };
+
+            for etag in [old_etag, "\"00000000000000000000000000000000\""] {
+                match operation {
+                    "put" => {
+                        let err = client
+                            .put_object()
+                            .bucket(bucket)
+                            .key(operation)
+                            .if_match(etag)
+                            .body(ByteStream::from_static(b"new"))
+                            .send()
+                            .await
+                            .expect_err("If-Match must reject marker");
+                        assert_not_found(&err);
+                    }
+                    "copy" => {
+                        let err = client
+                            .copy_object()
+                            .bucket(bucket)
+                            .key(operation)
+                            .copy_source(format!("{bucket}/source"))
+                            .if_match(etag)
+                            .send()
+                            .await
+                            .expect_err("If-Match copy must reject marker");
+                        assert_not_found(&err);
+                    }
+                    _ => {
+                        let err = client
+                            .complete_multipart_upload()
+                            .bucket(bucket)
+                            .key(operation)
+                            .upload_id(upload_id.as_deref().expect("upload ID"))
+                            .multipart_upload(completed.clone().expect("completed parts"))
+                            .if_match(etag)
+                            .send()
+                            .await
+                            .expect_err("If-Match completion must reject marker");
+                        assert_not_found(&err);
+                    }
+                }
+                let versions = client
+                    .list_object_versions()
+                    .bucket(bucket)
+                    .prefix(operation)
+                    .send()
+                    .await
+                    .expect("list versions after rejected write");
+                assert_eq!(versions.versions().len(), 1, "{operation}: failed write created a version");
+                assert_eq!(versions.delete_markers().len(), 1);
+                assert_eq!(versions.delete_markers()[0].version_id(), Some(marker_id));
+                assert_eq!(versions.delete_markers()[0].is_latest(), Some(true));
+            }
+
+            match operation {
+                "put" => {
+                    client
+                        .put_object()
+                        .bucket(bucket)
+                        .key(operation)
+                        .if_none_match("*")
+                        .body(ByteStream::from_static(b"new"))
+                        .send()
+                        .await
+                        .expect("If-None-Match PUT over marker");
+                }
+                "copy" => {
+                    client
+                        .copy_object()
+                        .bucket(bucket)
+                        .key(operation)
+                        .copy_source(format!("{bucket}/source"))
+                        .if_none_match("*")
+                        .send()
+                        .await
+                        .expect("If-None-Match copy over marker");
+                }
+                _ => {
+                    client
+                        .complete_multipart_upload()
+                        .bucket(bucket)
+                        .key(operation)
+                        .upload_id(upload_id.as_deref().expect("upload ID"))
+                        .multipart_upload(completed.expect("completed parts"))
+                        .if_none_match("*")
+                        .send()
+                        .await
+                        .expect("If-None-Match completion over marker");
+                }
+            }
+            let current = client
+                .get_object()
+                .bucket(bucket)
+                .key(operation)
+                .send()
+                .await
+                .expect("read successful conditional write")
+                .body
+                .collect()
+                .await
+                .expect("read object body")
+                .into_bytes();
+            let expected: &[u8] = if operation == "copy" { b"source" } else { b"new" };
+            assert_eq!(current.as_ref(), expected, "{operation}: unexpected current object");
+        }
+    }

    async fn create_versioned_bucket(client: &Client, bucket: &str) {
        client
@@ -2146,3 +2146,4 @@ mod tests {
        );
    }
 }
+// event-drill: isolated harness-only change
@@ -1112,8 +1112,9 @@ async fn wait_for_upgrade_writes(
            match response {
                Ok(Ok(_)) => break,
                Ok(Err(error)) => {
+                    let code = error.as_service_error().and_then(ProvideErrorMetadata::code);
                    if error.raw_response().map(|response| response.status().as_u16()) != Some(503)
-                        || error.as_service_error().and_then(ProvideErrorMetadata::code) != Some("ServiceUnavailable")
+                        || !matches!(code, Some("ServiceUnavailable" | "SlowDown" | "SlowDownRead"))
                    {
                        return Err(format!("{phase}: node {node} {probe} failed: {error:?}").into());
                    }
@@ -1901,6 +1901,15 @@ impl BucketMetadataSys {
        self.api.upgrade()
    }

+    /// Whether the backing `ECStore` has been dropped.
+    ///
+    /// Used by `InstanceContext::clear_bucket_metadata_sys_if_stale` during
+    /// `ECStore::drop` so a shared bootstrap context does not retain a
+    /// `BucketMetadataSys` whose weak handle is dangling.
+    pub(crate) fn is_store_stale(&self) -> bool {
+        self.api.upgrade().is_none()
+    }
+
    fn metadata_publish_lock(&self, bucket: &str) -> Arc<Mutex<MetadataPublishLockState>> {
        Self::bucket_lock_in(&self.metadata_publish_locks, bucket)
    }
@@ -5331,6 +5331,9 @@ impl LocalIoBackend for StdBackend {
                }

                if let Some(resources) = current_resource_unit() {
+                    if let Some(parent) = file_path.parent() {
+                        os::make_dir_all(parent, &volume_dir).await?;
+                    }
                    return self.open_resource_writer(file_path, mode, resources).await;
                }

@@ -941,6 +941,32 @@ impl InstanceContext {
            .clone()
    }

+    /// Remove the `BucketMetadataSys` when its backing `ECStore` is gone.
+    ///
+    /// Called from `ECStore::drop`. When test fixtures share the bootstrap
+    /// context, the `BucketMetadataSys` stores a `Weak<ECStore>` to prevent a
+    /// reference cycle; once the store drops the weak is dangling and any
+    /// `object_store()` call panics. Clearing the slot here lets the next
+    /// fixture install a fresh `BucketMetadataSys` without hitting the stale one.
+    pub fn clear_bucket_metadata_sys_if_stale(&self) {
+        let mut guard = self.bucket_metadata_sys.lock().expect("bucket_metadata_sys lock poisoned");
+        if let Some(sys) = guard.as_ref() {
+            // `read()` may block briefly; the async RwLock is acceptable here
+            // because Drop is sync and the lock is held only long enough to
+            // check the weak reference.
+            let is_stale = {
+                let s = sys.try_read();
+                match s {
+                    Ok(s) => s.is_store_stale(),
+                    Err(_) => true, // contended: treat as stale-safe to clear
+                }
+            };
+            if is_stale {
+                *guard = None;
+            }
+        }
+    }
+
    /// Set this instance's background-services cancellation token (once).
    pub fn init_background_cancel_token(&self, token: CancellationToken) -> Result<(), CancellationToken> {
        self.background_cancel_token.set(token)
@@ -6737,9 +6737,7 @@ impl SetDisks {
                        object,
                    );
                }
-                let if_none_match = http_preconditions.if_none_match_value().map(str::to_owned);
-                let if_match = http_preconditions.if_match_value().map(str::to_owned);
-                if should_prevent_write(&oi, if_none_match, if_match)
+                if should_prevent_write(&oi, http_preconditions.if_none_match_value(), http_preconditions.if_match_value())
                    && !crate::data_movement::can_replace_stale_data_movement_target(&oi, opts)
                {
                    return Some(StorageError::PreconditionFailed);
@@ -120,7 +120,6 @@ use bytesize::ByteSize;
 use futures::future::join_all;
 use http::HeaderMap;
 use md5::{Digest as Md5Digest, Md5};
-use regex::Regex;
 use rustfs_config::MI_B;
 use rustfs_filemeta::metadata_keys;
 use rustfs_filemeta::{
@@ -8036,16 +8035,29 @@ fn parts_after_marker(part_numbers: &[usize], part_number_marker: usize) -> Opti
    Some(&part_numbers[index..])
 }

-pub fn canonicalize_etag(etag: &str) -> String {
-    let re = Regex::new("\"*?([^\"]*?)\"*?$").unwrap();
-    re.replace_all(etag, "$1").to_string()
+fn canonicalized_etag(etag: &str) -> Cow<'_, str> {
+    // Preserve the legacy suffix-matching behavior for embedded quotes.
+    let trimmed = etag.trim_end_matches('"');
+    let Some(last_quote) = trimmed.rfind('"') else {
+        return Cow::Borrowed(trimmed);
+    };
+    let prefix = trimmed[..last_quote].trim_end_matches('"');
+    let suffix = &trimmed[last_quote + 1..];
+    if prefix.is_empty() {
+        Cow::Borrowed(suffix)
+    } else {
+        let mut result = String::with_capacity(prefix.len() + suffix.len());
+        result.push_str(prefix);
+        result.push_str(suffix);
+        Cow::Owned(result)
+    }
 }

 pub fn e_tag_matches(etag: &str, condition: &str) -> bool {
    if condition.trim() == "*" {
        return true;
    }
-    canonicalize_etag(etag) == canonicalize_etag(condition)
+    canonicalized_etag(etag) == canonicalized_etag(condition)
 }

 fn weak_etag_matches(etag: &str, condition: &str) -> bool {
@@ -8060,15 +8072,12 @@ fn weak_etag_matches(etag: &str, condition: &str) -> bool {
            .or_else(|| trimmed.strip_prefix("w/"))
            .unwrap_or(trimmed)
    }
-    canonicalize_etag(strip_weak(etag)) == canonicalize_etag(strip_weak(condition))
+    canonicalized_etag(strip_weak(etag)) == canonicalized_etag(strip_weak(condition))
 }

-pub fn should_prevent_write(oi: &ObjectInfo, if_none_match: Option<String>, if_match: Option<String>) -> bool {
-    let if_none_match = if_none_match
-        .as_deref()
-        .map(str::trim)
-        .filter(|condition| !condition.is_empty());
-    let if_match = if_match.as_deref().map(str::trim).filter(|condition| !condition.is_empty());
+pub fn should_prevent_write(oi: &ObjectInfo, if_none_match: Option<&str>, if_match: Option<&str>) -> bool {
+    let if_none_match = if_none_match.map(str::trim).filter(|condition| !condition.is_empty());
+    let if_match = if_match.map(str::trim).filter(|condition| !condition.is_empty());

    match &oi.etag {
        Some(etag) => {
@@ -13772,6 +13781,22 @@ mod tests {
        assert!(result2.iter().all(|d| d.is_none()));
    }

+    #[test]
+    fn canonicalized_etag_preserves_legacy_regex_semantics() {
+        let regex = regex::Regex::new("\"*?([^\"]*?)\"*?$").expect("valid legacy ETag pattern");
+        let alphabet = ['a', '"', '\n', 'é', '\0'];
+        for length in 0..=6_u32 {
+            for mut number in 0..alphabet.len().pow(length) {
+                let mut input = String::new();
+                for _ in 0..length {
+                    input.push(alphabet[number % alphabet.len()]);
+                    number /= alphabet.len();
+                }
+                assert_eq!(canonicalized_etag(&input), regex.replace_all(&input, "$1"), "input: {input:?}");
+            }
+        }
+    }
+
    #[test]
    fn test_etag_matches() {
        assert!(e_tag_matches("abc", "abc"));
@@ -14347,61 +14372,61 @@ mod tests {
            etag: Some("abc".to_string()),
            ..Default::default()
        };
-        let if_none_match = Some("abc".to_string());
+        let if_none_match = Some("abc");
        let if_match = None;
        assert!(should_prevent_write(&oi, if_none_match, if_match));

-        let if_none_match = Some("*".to_string());
+        let if_none_match = Some("*");
        let if_match = None;
        assert!(should_prevent_write(&oi, if_none_match, if_match));

        let if_none_match = None;
-        let if_match = Some("def".to_string());
+        let if_match = Some("def");
        assert!(should_prevent_write(&oi, if_none_match, if_match));

        let if_none_match = None;
-        let if_match = Some("*".to_string());
+        let if_match = Some("*");
        assert!(!should_prevent_write(&oi, if_none_match, if_match));

-        let if_none_match = Some("def".to_string());
+        let if_none_match = Some("def");
        let if_match = None;
        assert!(!should_prevent_write(&oi, if_none_match, if_match));

-        let if_none_match = Some("def".to_string());
-        let if_match = Some("*".to_string());
+        let if_none_match = Some("def");
+        let if_match = Some("*");
        assert!(!should_prevent_write(&oi, if_none_match, if_match));

-        let if_none_match = Some("def".to_string());
-        let if_match = Some("\"abc\"".to_string());
+        let if_none_match = Some("def");
+        let if_match = Some("\"abc\"");
        assert!(!should_prevent_write(&oi, if_none_match, if_match));

-        let if_none_match = Some("*".to_string());
-        let if_match = Some("\"abc\"".to_string());
+        let if_none_match = Some("*");
+        let if_match = Some("\"abc\"");
        assert!(should_prevent_write(&oi, if_none_match, if_match));

        let oi = ObjectInfo {
            etag: None,
            ..Default::default()
        };
-        let if_none_match = Some("*".to_string());
-        let if_match = Some("\"abc\"".to_string());
+        let if_none_match = Some("*");
+        let if_match = Some("\"abc\"");
        assert!(should_prevent_write(&oi, if_none_match, if_match));

        let if_none_match = None;
        let if_match = None;
        assert!(!should_prevent_write(&oi, if_none_match, if_match));

-        let if_none_match = Some(String::new());
-        let if_match = Some(" ".to_string());
+        let if_none_match = Some("");
+        let if_match = Some(" ");
        assert!(!should_prevent_write(&oi, if_none_match, if_match));

        let oi = ObjectInfo {
            etag: Some("abc".to_string()),
            ..Default::default()
        };
-        assert!(should_prevent_write(&oi, Some("W/\"abc\"".to_string()), None));
-        assert!(!should_prevent_write(&oi, Some("W/\"def\"".to_string()), None));
-        assert!(should_prevent_write(&oi, None, Some("W/\"abc\"".to_string())));
+        assert!(should_prevent_write(&oi, Some("W/\"abc\""), None));
+        assert!(!should_prevent_write(&oi, Some("W/\"def\""), None));
+        assert!(should_prevent_write(&oi, None, Some("W/\"abc\"")));
    }

    #[test]
@@ -5340,6 +5340,203 @@ mod tests {
        shutdown.cancel();
    }

+    #[cfg(feature = "test-util")]
+    #[tokio::test]
+    #[serial_test::serial(storage_class_env)]
+    async fn conditional_multipart_must_not_commit_against_an_older_readable_pool() {
+        use crate::storage_api_contracts::multipart::CompletePart;
+        use crate::storage_api_contracts::object::HTTPPreconditions;
+
+        let temp_dir = tempfile::tempdir().expect("create conditional multipart test directory");
+        let (_ctx, store, shutdown) =
+            without_storage_class_env(build_isolated_test_store(temp_dir.path(), "conditional-mpu-unreadable", &[4, 4])).await;
+        crate::bucket::metadata_sys::init_bucket_metadata_sys(store.clone(), Vec::new()).await;
+        let bucket = format!("conditional-mpu-{}", uuid::Uuid::new_v4().simple());
+        let object = "object";
+        store
+            .make_bucket(&bucket, &MakeBucketOptions::default())
+            .await
+            .expect("create conditional multipart test bucket");
+        let mut old_body = PutObjReader::from_vec(b"older-pool".to_vec());
+        let old = store.pools[0]
+            .put_object(
+                &bucket,
+                object,
+                &mut old_body,
+                &ObjectOptions {
+                    mod_time: Some(OffsetDateTime::UNIX_EPOCH + time::Duration::seconds(1)),
+                    ..Default::default()
+                },
+            )
+            .await
+            .expect("write old object to staging pool");
+        let upload = store.pools[0]
+            .new_multipart_upload(&bucket, object, &ObjectOptions::default())
+            .await
+            .expect("create multipart upload in pool 0");
+        let mut part_body = PutObjReader::from_vec(b"stale-writer".to_vec());
+        let part = store.pools[0]
+            .put_object_part(&bucket, object, &upload.upload_id, 1, &mut part_body, &ObjectOptions::default())
+            .await
+            .expect("stage multipart part in pool 0");
+        let mut new_body = PutObjReader::from_vec(b"newer-pool".to_vec());
+        let new = store.pools[1]
+            .put_object(
+                &bucket,
+                object,
+                &mut new_body,
+                &ObjectOptions {
+                    mod_time: Some(OffsetDateTime::UNIX_EPOCH + time::Duration::seconds(2)),
+                    ..Default::default()
+                },
+            )
+            .await
+            .expect("write newer object to pool 1");
+        let old_etag = old.etag.clone().expect("old object must have an ETag");
+        let before = store.get_object_info(&bucket, object, &ObjectOptions::default()).await;
+
+        let mut metadata = Vec::new();
+        for disk_index in 0..4 {
+            let path = temp_dir
+                .path()
+                .join(format!("pool1/set0/disk{disk_index}/{bucket}/{object}/xl.meta"));
+            let original = tokio::fs::read(&path)
+                .await
+                .expect("save original object metadata before fault injection");
+            metadata.push((path, original));
+        }
+        let mut fault_error = None;
+        for (path, _) in &metadata {
+            if let Err(err) = tokio::fs::write(path, b"invalid object metadata").await {
+                fault_error = Some(err);
+                break;
+            }
+        }
+        let mut fault_contents = Vec::new();
+        if fault_error.is_none() {
+            for (path, _) in &metadata {
+                fault_contents.push(tokio::fs::read(path).await);
+            }
+            store.pools[1]
+                .get_disks_by_key(object)
+                .invalidate_get_object_metadata_cache(&bucket, object)
+                .await;
+        }
+        let unreadable = if fault_error.is_none() {
+            Some(
+                store.pools[1]
+                    .get_object_info(
+                        &bucket,
+                        object,
+                        &ObjectOptions {
+                            no_lock: true,
+                            metadata_cache_safe: false,
+                            suppress_read_repair: true,
+                            ..Default::default()
+                        },
+                    )
+                    .await,
+            )
+        } else {
+            None
+        };
+        let completed = if fault_error.is_none() {
+            let completion_store = Arc::clone(&store);
+            let completion_bucket = bucket.clone();
+            let upload_id = upload.upload_id.clone();
+            let part_etag = part.etag.clone();
+            Some(
+                tokio::spawn(async move {
+                    completion_store
+                        .complete_multipart_upload(
+                            &completion_bucket,
+                            object,
+                            &upload_id,
+                            vec![CompletePart {
+                                part_num: 1,
+                                etag: part_etag,
+                                ..Default::default()
+                            }],
+                            &ObjectOptions {
+                                http_preconditions: Some(HTTPPreconditions {
+                                    if_match: Some(old_etag),
+                                    ..Default::default()
+                                }),
+                                ..Default::default()
+                            },
+                        )
+                        .await
+                })
+                .await,
+            )
+        } else {
+            None
+        };
+        let mut restore_error = None;
+        for (path, original) in &metadata {
+            if let Err(err) = tokio::fs::write(path, original).await {
+                restore_error = Some(err);
+            }
+        }
+        store.pools[1]
+            .get_disks_by_key(object)
+            .invalidate_get_object_metadata_cache(&bucket, object)
+            .await;
+        let after = store.get_object_info(&bucket, object, &ObjectOptions::default()).await;
+        let recovered_body = match store
+            .get_object_reader(&bucket, object, None, HeaderMap::new(), &ObjectOptions::default())
+            .await
+        {
+            Ok(mut reader) => {
+                let mut body = Vec::new();
+                let result = reader
+                    .read_to_end(&mut body)
+                    .await
+                    .map(|_| body)
+                    .map_err(|err| err.to_string());
+                drop(reader);
+                result
+            }
+            Err(err) => Err(err.to_string()),
+        };
+        let parts = store
+            .list_object_parts(&bucket, object, &upload.upload_id, None, 100, &ObjectOptions::default())
+            .await;
+        shutdown.cancel();
+
+        assert!(fault_error.is_none(), "failed to inject metadata fault: {fault_error:?}");
+        assert!(restore_error.is_none(), "failed to restore metadata: {restore_error:?}");
+        assert_eq!(fault_contents.len(), 4, "all four pool 1 metadata files must be inspected");
+        for observed in fault_contents {
+            assert_eq!(
+                observed.expect("read injected metadata"),
+                b"invalid object metadata",
+                "each pool 1 metadata file must contain the injected corruption"
+            );
+        }
+        assert_eq!(before.expect("latest object before fault").etag, new.etag);
+        assert_ne!(old.etag, new.etag, "fixture bodies must produce different ETags");
+        let read_error = unreadable
+            .expect("metadata fault should have been injected")
+            .expect_err("the newer pool must fail its object metadata read during the fault");
+        assert!(
+            !crate::error::is_err_object_not_found(&read_error) && !crate::error::is_err_version_not_found(&read_error),
+            "corrupt metadata must produce a non-not-found read error: {read_error:?}"
+        );
+        let completed = completed
+            .expect("completion should have been attempted")
+            .expect("completion task should not panic");
+        let Err(completion_error) = completed else {
+            panic!("stale If-Match must not commit while the newer object's metadata is unreadable");
+        };
+        assert_eq!(completion_error, read_error, "completion must propagate the unreadable pool's error");
+        assert_eq!(after.expect("newer object after recovery").etag, new.etag);
+        assert_eq!(recovered_body.expect("newer body after recovery"), b"newer-pool");
+        let parts = parts.expect("failed completion must leave the upload retryable");
+        assert_eq!(parts.parts.len(), 1);
+        assert_eq!(parts.parts[0].etag, part.etag);
+    }
+
    async fn migrate_versioned_decommission_test_object(
        store: &Arc<crate::store::ECStore>,
        bucket: &str,
@@ -498,6 +498,17 @@ pub struct ECStore {
    pub(crate) bucket_fence_registry: Arc<bucket_fence::BucketFenceRegistry>,
 }

+impl Drop for ECStore {
+    /// Clear the instance context's `BucketMetadataSys` when its backing store
+    /// is dropped. Without this, the shared bootstrap context retains a
+    /// `BucketMetadataSys` whose `Weak<ECStore>` is dangling after the store
+    /// goes away (e.g. between sequential test fixtures that share the
+    /// bootstrap), and the next `object_store()` call panics.
+    fn drop(&mut self) {
+        self.ctx.clear_bucket_metadata_sys_if_stale();
+    }
+}
+
 const METRIC_SCANNER_DATA_MOVEMENT_PAUSED: &str = "rustfs_scanner_data_movement_paused";
 const METRIC_SCANNER_DATA_MOVEMENT_PAUSE_DURATION_SECONDS: &str = "rustfs_scanner_data_movement_pause_duration_seconds";
 const METRIC_SCANNER_DATA_MOVEMENT_BACKLOG_WORK_ITEMS: &str = "rustfs_scanner_data_movement_backlog_work_items";
@@ -19,6 +19,7 @@ use crate::set_disk::get_lock_acquire_timeout;
 use crate::storage_api_contracts::multipart::MultipartOperations as _;
 use crate::storage_api_contracts::object::ObjectOperations as _;
 use futures::{StreamExt, stream};
+use rustfs_utils::path::encode_dir_object_ref;
 use std::collections::HashSet;

 const MULTIPART_LIST_SET_CONCURRENCY: usize = 4;
@@ -612,7 +613,7 @@ impl ECStore {
        }
        if opts.http_preconditions.is_some()
            && !opts.data_movement
-            && let Some(err) = self.check_write_precondition(bucket, object, &opts).await
+            && let Some(err) = self.check_write_precondition(bucket, object, &opts, false).await
        {
            return Err(err);
        }
@@ -1154,12 +1155,31 @@ impl ECStore {
        Ok(())
    }

-    async fn check_write_precondition(&self, bucket: &str, object: &str, opts: &ObjectOptions) -> Option<StorageError> {
+    async fn check_write_precondition(
+        &self,
+        bucket: &str,
+        object: &str,
+        opts: &ObjectOptions,
+        require_all_pools: bool,
+    ) -> Option<StorageError> {
        let mut lookup_opts = opts.clone();
        let http_preconditions = lookup_opts.http_preconditions?;
        lookup_opts.http_preconditions = None;
        lookup_opts.no_lock = true;
-        let oi = self.get_object_info_for_delete(bucket, object, &lookup_opts).await;
+        let oi = if require_all_pools {
+            lookup_opts.metadata_cache_safe = false;
+            lookup_opts.suppress_read_repair = true;
+            // Only completion uses this branch, after validating bucket and object.
+            let encoded_object = encode_dir_object_ref(object);
+            self.get_latest_object_info_for_conditional_write(bucket, encoded_object.as_ref(), &lookup_opts)
+                .await
+                .and_then(|(info, _)| {
+                    lookup_opts.precondition_check(&info)?;
+                    Ok(info)
+                })
+        } else {
+            self.get_object_info_for_delete(bucket, object, &lookup_opts).await
+        };
        crate::set_disk::SetDisks::evaluate_write_precondition(oi, &http_preconditions, bucket, object, opts)
    }

@@ -1186,11 +1206,13 @@ impl ECStore {
                .await;
            return enqueue_transition_after_write(self.as_ref(), result, LcEventSrc::S3CompleteMultipartUpload, opts).await;
        }
-        if opts.http_preconditions.is_some()
-            && !opts.data_movement
-            && let Some(err) = self.check_write_precondition(bucket, object, opts).await
-        {
-            return Err(err);
+        if opts.http_preconditions.is_some() && !opts.data_movement {
+            // Preserve explicitly scoped internal reads and borrowed-lock callers.
+            let require_all_pools =
+                !opts.replication_request && !opts.no_lock && !opts.skip_decommissioned && !opts.skip_rebalancing;
+            if let Some(err) = self.check_write_precondition(bucket, object, opts, require_all_pools).await {
+                return Err(err);
+            }
        }

        let result = match self.multipart_upload_pool_idx(bucket, object, upload_id, opts).await {
@@ -837,7 +837,29 @@ impl ECStore {
        object: &str,
        opts: &ObjectOptions,
    ) -> Result<(ObjectInfo, usize)> {
-        let suspended_pools = if opts.skip_decommissioned {
+        self.get_latest_object_info_with_pool_policy(bucket, object, opts, false)
+            .await
+    }
+
+    /// Observe every pool for a conditional-write preflight. This does not
+    /// hold the namespace locks needed to prove a condition at publication.
+    pub(super) async fn get_latest_object_info_for_conditional_write(
+        &self,
+        bucket: &str,
+        object: &str,
+        opts: &ObjectOptions,
+    ) -> Result<(ObjectInfo, usize)> {
+        self.get_latest_object_info_with_pool_policy(bucket, object, opts, true).await
+    }
+
+    async fn get_latest_object_info_with_pool_policy(
+        &self,
+        bucket: &str,
+        object: &str,
+        opts: &ObjectOptions,
+        require_all_pools: bool,
+    ) -> Result<(ObjectInfo, usize)> {
+        let suspended_pools = if opts.skip_decommissioned && !require_all_pools {
            let pool_meta = self.pool_meta.read().await;
            Some(
                (0..self.pools.len())
@@ -853,7 +875,7 @@ impl ECStore {
                continue;
            }

-            if opts.skip_rebalancing && self.is_pool_rebalancing(idx).await {
+            if opts.skip_rebalancing && !require_all_pools && self.is_pool_rebalancing(idx).await {
                continue;
            }

@@ -873,6 +895,9 @@ impl ECStore {
                    });
                }
                Err(e) => {
+                    if require_all_pools && !is_err_object_not_found(&e) && !is_err_version_not_found(&e) {
+                        return Err(e);
+                    }
                    candidates.push(LatestObjectInfoCandidate {
                        info: None,
                        idx,
@@ -420,6 +420,7 @@ async fn real_storage_grace_round_trip() {
            &HealOpts {
                scan_mode: rustfs_heal_contracts::heal_channel::HealScanMode::Deep,
                recreate: true,
+                remove: true,
                pool: Some(0),
                set: Some(0),
                ..Default::default()
@@ -157,7 +157,7 @@ async fn wait_for_object_copies(disks: &[PathBuf], bucket: &str, object: &str) {
 fn deep_heal_opts() -> HealOpts {
    HealOpts {
        recreate: true,
-        remove: false,
+        remove: true,
        scan_mode: HealScanMode::Deep,
        ..Default::default()
    }
@@ -633,6 +633,7 @@ mod absence_receipt_regressions {
                version_id: Some(old.to_owned()),
            },
            HealOptions {
+                remove_corrupted: true,
                scan_mode: HealScanMode::Deep,
                pool_index: Some(0),
                set_index: Some(0),
@@ -823,6 +824,7 @@ mod absence_receipt_regressions {
            },
            HealOptions {
                recursive: true,
+                remove_corrupted: true,
                scan_mode: HealScanMode::Deep,
                ..Default::default()
            },
@@ -810,7 +810,13 @@ fn admin_mixed_batch_retains_repairs_after_object_retry_exhaustion() {
                    restarted.start().await.expect("restart with retained failed batch");
                    let restored = restarted.get_task_report(&token).await.expect("original token after restart");
                    assert_eq!(restored.status, report.status);
-                    assert_eq!(restored.outcome, report.outcome);
+                    // Quorum and Deep observations are local and never persisted.
+                    let mut expected_outcome = report.outcome.as_deref().cloned().expect("mixed batch outcome");
+                    for object in &mut expected_outcome.objects {
+                        object.quorum_selected_data_dir = None;
+                        object.deep_check_observed = false;
+                    }
+                    assert_eq!(restored.outcome.as_deref(), Some(&expected_outcome));
                    assert_eq!(restarted.get_queue_length().await, 0, "terminal batch must not replay");
                    restarted.stop().await.expect("stop restarted mixed batch manager");
                });
@@ -596,9 +596,205 @@ pub struct PendingScannerHeal {
    pub last_admission_reason: String,
 }

+/// One bucket's standing in its set's service order. The wait position, the
+/// quanta granted and the last certification are separate quantities: a bucket
+/// that keeps failing moves to the tail like any other and only adds debt.
+#[derive(Clone, Copy, Debug, Default, Deserialize, PartialEq, Eq)]
+pub struct DataUsageBucketService {
+    #[serde(default)]
+    pub waiting_since: u64,
+    #[serde(default)]
+    pub service_quanta: u64,
+    #[serde(default)]
+    pub last_certified: Option<u64>,
+    #[serde(default)]
+    pub failure_debt: u64,
+    #[serde(default)]
+    pub incarnation: Option<uuid::Uuid>,
+}
+
+// Nested derives encode positionally; a map lets later fields stay optional.
+impl Serialize for DataUsageBucketService {
+    fn serialize<S: serde::Serializer>(&self, serializer: S) -> Result<S::Ok, S::Error> {
+        let field_count = 2
+            + usize::from(self.last_certified.is_some())
+            + usize::from(self.failure_debt != 0)
+            + usize::from(self.incarnation.is_some());
+        let mut map = serializer.serialize_map(Some(field_count))?;
+        map.serialize_entry("waiting_since", &self.waiting_since)?;
+        map.serialize_entry("service_quanta", &self.service_quanta)?;
+        if let Some(last_certified) = self.last_certified {
+            map.serialize_entry("last_certified", &last_certified)?;
+        }
+        if self.failure_debt != 0 {
+            map.serialize_entry("failure_debt", &self.failure_debt)?;
+        }
+        if let Some(incarnation) = self.incarnation {
+            map.serialize_entry("incarnation", &incarnation)?;
+        }
+        map.end()
+    }
+}
+
+/// Durable first-in-first-out service order of one set, in generations: every
+/// bucket at or below `generation_floor` still waits for its turn and everything
+/// above it was served, so a new bucket queues behind waiters but ahead of
+/// buckets that already had a turn. It only orders work:
+/// no entry proves coverage, authorizes a skip or releases a responsibility,
+/// so losing it restarts fairness and nothing else. Like the set cache's bucket
+/// entries and incarnations, it holds one record per bucket of the inventory.
+#[derive(Clone, Debug, Default, Deserialize, PartialEq, Eq)]
+pub struct DataUsageBucketServiceLedger {
+    /// Movement epoch the order was built under; another epoch invalidates it.
+    #[serde(default)]
+    pub publication_epoch: u64,
+    /// Leader that saved the order; an incomplete save stamps nothing else.
+    #[serde(default)]
+    pub leader_epoch: u64,
+    #[serde(default)]
+    pub next_sequence: u64,
+    #[serde(default)]
+    pub generation_floor: u64,
+    #[serde(default)]
+    pub buckets: HashMap<String, DataUsageBucketService>,
+}
+
+impl Serialize for DataUsageBucketServiceLedger {
+    fn serialize<S: serde::Serializer>(&self, serializer: S) -> Result<S::Ok, S::Error> {
+        let mut map = serializer.serialize_map(Some(5))?;
+        map.serialize_entry("publication_epoch", &self.publication_epoch)?;
+        map.serialize_entry("leader_epoch", &self.leader_epoch)?;
+        map.serialize_entry("next_sequence", &self.next_sequence)?;
+        map.serialize_entry("generation_floor", &self.generation_floor)?;
+        map.serialize_entry("buckets", &self.buckets)?;
+        map.end()
+    }
+}
+
+impl DataUsageBucketServiceLedger {
+    /// Rebuilds the order for this cycle's inventory. Decoded state that fails
+    /// validation or belongs to another movement epoch starts a new order;
+    /// a bucket whose incarnation changed is a new arrival behind all waiters.
+    pub(crate) fn restore<'a>(
+        persisted: Option<Self>,
+        publication_epoch: u64,
+        inventory: impl Iterator<Item = &'a str>,
+        incarnations: Option<&HashMap<String, uuid::Uuid>>,
+    ) -> Self {
+        let mut ledger = persisted
+            .filter(|ledger| ledger.publication_epoch == publication_epoch && ledger.is_valid())
+            .unwrap_or_else(|| Self {
+                publication_epoch,
+                ..Default::default()
+            });
+        let previous = std::mem::take(&mut ledger.buckets);
+        let mut arrivals = Vec::new();
+        for bucket in inventory {
+            let incarnation = incarnations.and_then(|current| current.get(bucket)).copied();
+            match previous.get(bucket) {
+                Some(service) if service.incarnation.is_none() || incarnation.is_none() || service.incarnation == incarnation => {
+                    ledger.buckets.insert(
+                        bucket.to_owned(),
+                        DataUsageBucketService {
+                            incarnation: incarnation.or(service.incarnation),
+                            ..*service
+                        },
+                    );
+                }
+                _ => arrivals.push((bucket, incarnation)),
+            }
+        }
+        if arrivals.is_empty() {
+            let floor = ledger.generation_floor;
+            if ledger.buckets.values().all(|service| service.waiting_since > floor) {
+                ledger.generation_floor = ledger.next_sequence;
+            }
+            return ledger;
+        }
+        // Open one position between the waiters and the served buckets.
+        let floor = ledger.generation_floor;
+        ledger.generation_floor = floor.saturating_add(1);
+        ledger.next_sequence = ledger.next_sequence.saturating_add(1);
+        for service in ledger.buckets.values_mut().filter(|service| service.waiting_since > floor) {
+            service.waiting_since = service.waiting_since.saturating_add(1);
+        }
+        for (bucket, incarnation) in arrivals {
+            ledger.buckets.insert(
+                bucket.to_owned(),
+                DataUsageBucketService {
+                    waiting_since: ledger.generation_floor,
+                    incarnation,
+                    ..Default::default()
+                },
+            );
+        }
+        ledger
+    }
+
+    fn is_valid(&self) -> bool {
+        self.generation_floor <= self.next_sequence
+            && self
+                .buckets
+                .iter()
+                .all(|(bucket, service)| !bucket.is_empty() && service.waiting_since <= self.next_sequence)
+    }
+
+    /// Smaller positions have waited longer; an untracked bucket queues last.
+    pub(crate) fn wait_position(&self, bucket: &str) -> u64 {
+        self.buckets.get(bucket).map_or(u64::MAX, |service| service.waiting_since)
+    }
+
+    /// Moves a bucket to the tail and returns its previous wait position.
+    pub(crate) fn record_service(&mut self, bucket: &str) -> Option<u64> {
+        let service = self.buckets.get_mut(bucket)?;
+        self.next_sequence = self.next_sequence.saturating_add(1);
+        let previous = std::mem::replace(&mut service.waiting_since, self.next_sequence);
+        service.service_quanta = service.service_quanta.saturating_add(1);
+        Some(previous)
+    }
+
+    /// Undoes `record_service` for an admission a resource veto turned back.
+    pub(crate) fn return_service(&mut self, bucket: &str, waiting_since: u64) {
+        if let Some(service) = self.buckets.get_mut(bucket) {
+            service.waiting_since = waiting_since;
+            service.service_quanta = service.service_quanta.saturating_sub(1);
+        }
+    }
+
+    pub(crate) fn record_certified(&mut self, bucket: &str) {
+        if let Some(service) = self.buckets.get_mut(bucket) {
+            service.last_certified = Some(service.waiting_since);
+            service.failure_debt = 0;
+        }
+    }
+
+    pub(crate) fn record_failure(&mut self, bucket: &str) {
+        if let Some(service) = self.buckets.get_mut(bucket) {
+            service.failure_debt = service.failure_debt.saturating_add(1);
+        }
+    }
+
+    /// Buckets holding unpaid failures and the first of them by name.
+    pub(crate) fn failure_debt(&self) -> (usize, Option<&str>) {
+        let mut debtors = self
+            .buckets
+            .iter()
+            .filter(|(_, service)| service.failure_debt > 0)
+            .map(|(bucket, _)| bucket.as_str());
+        let first = debtors.next();
+        let (count, first) = debtors.fold((usize::from(first.is_some()), first), |(count, first), bucket| {
+            (count + 1, first.min(Some(bucket)))
+        });
+        (count, first)
+    }
+}
+
 /// Data usage cache info
 #[derive(Clone, Debug, Default, Deserialize)]
 pub struct DataUsageCacheInfo {
+    /// In-memory only: this partial stopped on admission pressure, not a failure.
+    #[serde(skip)]
+    pub scan_resource_deferred: bool,
    pub name: String,
    pub next_cycle: u64,
    pub last_update: Option<SystemTime>,
@@ -615,6 +811,11 @@ pub struct DataUsageCacheInfo {
    pub scan_raw_enumeration_cursor: Option<DataUsageRawEnumerationCursor>,
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub scan_raw_enumeration_page_index: Option<RawEnumerationPageIndex>,
+    /// Indexes of the other directories on the active walk path. A restart
+    /// must replay every wide ancestor before it reaches the selected one, and
+    /// recharging those replays would stop a fixed budget from ever advancing.
+    #[serde(default, skip_serializing_if = "Vec::is_empty")]
+    pub scan_raw_enumeration_path_page_indexes: Vec<RawEnumerationPageIndex>,
    #[serde(default)]
    pub scan_identity: Option<DataUsageScanIdentity>,
    #[serde(default)]
@@ -674,6 +875,9 @@ pub struct DataUsageCacheInfo {
    /// skipping an unselected bucket in a later scoped set scan.
    #[serde(default, skip_serializing_if = "HashMap::is_empty")]
    pub scan_bucket_incarnations: HashMap<String, uuid::Uuid>,
+    /// Bucket service order of a set cache; absent from bucket caches.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub scan_bucket_service: Option<DataUsageBucketServiceLedger>,
 }

 impl Serialize for DataUsageCacheInfo {
@@ -686,6 +890,7 @@ impl Serialize for DataUsageCacheInfo {
        let field_count = 16
            + usize::from(self.scan_raw_enumeration_cursor.is_some())
            + usize::from(self.scan_raw_enumeration_page_index.is_some())
+            + usize::from(!self.scan_raw_enumeration_path_page_indexes.is_empty())
            + usize::from(self.scan_identity.is_some())
            + usize::from(self.scan_progress.is_some())
            + usize::from(self.scan_coverage_receipt.is_some())
@@ -699,7 +904,8 @@ impl Serialize for DataUsageCacheInfo {
            + usize::from(self.lkg_scan_plan_digest.is_some())
            + usize::from(self.scan_execution_digest.is_some())
            + usize::from(self.segment_invalidation_proof.is_some())
-            + usize::from(!self.scan_bucket_incarnations.is_empty());
+            + usize::from(!self.scan_bucket_incarnations.is_empty())
+            + usize::from(self.scan_bucket_service.is_some());
        let mut state = serializer.serialize_map(Some(field_count))?;
        state.serialize_entry("name", &self.name)?;
        state.serialize_entry("next_cycle", &self.next_cycle)?;
@@ -717,6 +923,9 @@ impl Serialize for DataUsageCacheInfo {
        if let Some(index) = &self.scan_raw_enumeration_page_index {
            state.serialize_entry("scan_raw_enumeration_page_index", index)?;
        }
+        if !self.scan_raw_enumeration_path_page_indexes.is_empty() {
+            state.serialize_entry("scan_raw_enumeration_path_page_indexes", &self.scan_raw_enumeration_path_page_indexes)?;
+        }
        if let Some(identity) = self.scan_identity {
            state.serialize_entry("scan_identity", &identity)?;
        }
@@ -765,6 +974,9 @@ impl Serialize for DataUsageCacheInfo {
        if !self.scan_bucket_incarnations.is_empty() {
            state.serialize_entry("scan_bucket_incarnations", &self.scan_bucket_incarnations)?;
        }
+        if let Some(ledger) = &self.scan_bucket_service {
+            state.serialize_entry("scan_bucket_service", ledger)?;
+        }
        state.end()
    }
 }
@@ -902,6 +1114,30 @@ impl DataUsageCache {
        }
    }

+    /// Identifies how far durable resume state has advanced. Discovery alone
+    /// does not change it; only committed raw pages or coverage frontier do.
+    pub(crate) fn durable_scan_position(&self) -> (Option<String>, Option<String>, u64) {
+        let raw_entries = self
+            .info
+            .scan_raw_enumeration_page_index
+            .iter()
+            .chain(&self.info.scan_raw_enumeration_path_page_indexes)
+            .map(|index| match index.status() {
+                RawEnumerationPageOwnerStatus::Unsupported => 0,
+                RawEnumerationPageOwnerStatus::Building { indexed_entries, .. }
+                | RawEnumerationPageOwnerStatus::Ready { indexed_entries, .. } => indexed_entries,
+            })
+            .fold(0, u64::saturating_add);
+        (
+            self.info.scan_resume_after.clone(),
+            self.info
+                .scan_coverage_receipt
+                .as_ref()
+                .map(|receipt| receipt.through.clone()),
+            raw_entries,
+        )
+    }
+
    pub(crate) fn has_scan_position(&self) -> bool {
        self.info.scan_resume_after.is_some()
            || self.info.scan_checkpoint.is_some()
@@ -1044,7 +1280,14 @@ impl DataUsageCache {
        }
        if self.validated_raw_enumeration_page_index().is_none() {
            self.info.scan_raw_enumeration_page_index = None;
+            self.info.scan_raw_enumeration_path_page_indexes.clear();
        }
+        let path_indexes = std::mem::take(&mut self.info.scan_raw_enumeration_path_page_indexes);
+        self.info.scan_raw_enumeration_path_page_indexes = path_indexes
+            .into_iter()
+            .take(MAX_DATA_USAGE_CACHE_DEPTH)
+            .filter(|index| self.raw_enumeration_page_index_is_valid(index))
+            .collect();
        let cursor_is_valid = !self.has_scan_position()
            || self.validated_scan_frontier().is_some()
            || self.info.scan_raw_enumeration_cursor.is_some()
@@ -1087,6 +1330,7 @@ impl DataUsageCache {
            self.info.scan_checkpoint = None;
            self.info.scan_raw_enumeration_cursor = None;
            self.info.scan_raw_enumeration_page_index = None;
+            self.info.scan_raw_enumeration_path_page_indexes.clear();
            self.info.scan_coverage_receipt = None;
        }
        // Old readers do not understand coverage sweeps. An absent plan makes
@@ -1230,22 +1474,37 @@ impl DataUsageCache {
    }

    pub(crate) fn validated_raw_enumeration_page_index(&self) -> Option<&RawEnumerationPageIndex> {
-        let index = self.info.scan_raw_enumeration_page_index.as_ref()?;
+        self.info
+            .scan_raw_enumeration_page_index
+            .as_ref()
+            .filter(|index| self.raw_enumeration_page_index_is_valid(index))
+    }
+
+    /// The durable index of one directory on the saved walk path.
+    pub(crate) fn validated_raw_enumeration_page_index_for_parent(&self, parent: &str) -> Option<&RawEnumerationPageIndex> {
+        self.info
+            .scan_raw_enumeration_page_index
+            .iter()
+            .chain(&self.info.scan_raw_enumeration_path_page_indexes)
+            .find(|index| index.parent() == Some(parent))
+            .filter(|index| self.raw_enumeration_page_index_is_valid(index))
+    }
+
+    fn raw_enumeration_page_index_is_valid(&self, index: &RawEnumerationPageIndex) -> bool {
        if self.info.scan_progress.is_none()
            || !self.info.scan_identity.is_some_and(|identity| identity.is_valid())
            || self.info.source.is_none()
            || index.committed_entries().is_err()
            || index.indexed_entries().is_err()
        {
-            return None;
+            return false;
        }
-        let parent = match index.status() {
-            RawEnumerationPageOwnerStatus::Unsupported => return None,
+        match index.status() {
+            RawEnumerationPageOwnerStatus::Unsupported => false,
            RawEnumerationPageOwnerStatus::Building { parent, .. } | RawEnumerationPageOwnerStatus::Ready { parent, .. } => {
-                parent
+                path_is_in_bucket_scope(&self.info.name, &parent)
            }
-        };
-        path_is_in_bucket_scope(&self.info.name, &parent).then_some(index)
+        }
    }

    /// Seal only the frontier supplied by completed traversal, never a restored cursor.
@@ -57,6 +57,66 @@ fn scoped_scan_coverage_metadata_preserves_map_compatibility() {
    assert_eq!(decoded.scan_coverage_digest, Some(TEST_PLAN_DIGEST));
 }

+#[test]
+fn raw_enumeration_path_indexes_preserve_map_compatibility_and_validation() {
+    #[derive(serde::Deserialize)]
+    struct LegacyInfo {
+        name: String,
+        scan_raw_enumeration_page_index: Option<RawEnumerationPageIndex>,
+    }
+    let index_for = |parent: &str| RawEnumerationPageIndex::new(parent, 8).expect("fixture index");
+    let mut cache = DataUsageCache {
+        info: DataUsageCacheInfo {
+            name: "bucket".to_string(),
+            scan_progress: Some(DataUsageScanProgress {
+                started_plan: TEST_PLAN_DIGEST,
+                requested_plan: TEST_PLAN_DIGEST,
+            }),
+            scan_identity: Some(DataUsageScanIdentity {
+                version: 1,
+                bucket_incarnation: uuid::Uuid::from_u128(1),
+                set_layout: DataUsageScanPlanDigest([2; 32]),
+                publication_epoch: 1,
+                tier_registry_generation: 0,
+                scan_mode: HealScanMode::Normal,
+            }),
+            source: Some(DataUsageCacheSource::new(0, 0)),
+            scan_raw_enumeration_page_index: Some(index_for("bucket/wide")),
+            scan_raw_enumeration_path_page_indexes: vec![index_for("bucket"), index_for("other-bucket/wide")],
+            ..Default::default()
+        },
+        cache: HashMap::new(),
+    };
+    assert!(cache.validated_raw_enumeration_page_index_for_parent("bucket").is_some());
+    assert!(
+        cache
+            .validated_raw_enumeration_page_index_for_parent("other-bucket/wide")
+            .is_none(),
+        "a saved path index must stay inside its bucket"
+    );
+
+    let encoded = rmp_serde::to_vec(&cache.info).expect("path indexes should remain map encoded");
+    let legacy: LegacyInfo = rmp_serde::from_slice(&encoded).expect("old map readers should ignore the path indexes");
+    assert_eq!(legacy.name, "bucket");
+    assert_eq!(
+        legacy
+            .scan_raw_enumeration_page_index
+            .and_then(|index| index.parent().map(str::to_owned)),
+        Some("bucket/wide".to_string())
+    );
+    let decoded: DataUsageCacheInfo = rmp_serde::from_slice(&encoded).expect("new reader should restore the path indexes");
+    assert_eq!(decoded.scan_raw_enumeration_path_page_indexes.len(), 2);
+
+    cache.info.scan_raw_enumeration_path_page_indexes.clear();
+    let encoded = rmp_serde::to_vec(&cache.info).expect("empty path indexes should encode");
+    assert!(
+        !encoded
+            .windows(b"scan_raw_enumeration_path_page_indexes".len())
+            .any(|window| window == b"scan_raw_enumeration_path_page_indexes"),
+        "the default must stay absent from the map"
+    );
+}
+
 #[derive(Debug, PartialEq, Eq)]
 struct CachePutRecord {
    object: String,
@@ -80,6 +80,7 @@ impl RemoteScannerBudget {
            max_duration: self.max_duration_ms.map(Duration::from_millis),
            max_objects: self.max_objects,
            max_directories: self.max_directories,
+            ..Default::default()
        }
    }
 }
@@ -743,6 +743,7 @@ pub(crate) fn lookup_scanner_runtime_config(
        max_duration: cycle_max_duration.filter(|duration| !duration.is_zero()),
        max_objects: cycle_max_objects,
        max_directories: cycle_max_directories,
+        ..Default::default()
    };

    let (bitrot_cycle, bitrot_cycle_source) = if let Some(value) = rustfs_utils::get_env_opt_str(ENV_SCANNER_BITROT_CYCLE_SECS) {
@@ -1171,6 +1172,7 @@ mod tests {
                max_duration: Some(Duration::from_secs(1800)),
                max_objects: Some(1000),
                max_directories: Some(8000),
+                ..Default::default()
            },
            ..Default::default()
        };
@@ -474,14 +474,17 @@ fn scan_cycle_partial_reason(reason: Option<ScannerCycleBudgetReason>) -> ScanCy
    match reason {
        Some(ScannerCycleBudgetReason::Runtime) => ScanCyclePartialReason::Runtime,
        Some(ScannerCycleBudgetReason::Objects) => ScanCyclePartialReason::Objects,
-        Some(ScannerCycleBudgetReason::Directories) => ScanCyclePartialReason::Directories,
+        // Raw enumeration is directory work; the reason set is a stable metric label.
+        Some(ScannerCycleBudgetReason::Directories | ScannerCycleBudgetReason::Entries) => ScanCyclePartialReason::Directories,
        None => ScanCyclePartialReason::Unknown,
    }
 }

 fn scan_cycle_partial_source(reason: Option<ScannerCycleBudgetReason>) -> Option<ScannerWorkSource> {
    match reason {
-        Some(ScannerCycleBudgetReason::Objects | ScannerCycleBudgetReason::Directories) => Some(ScannerWorkSource::Usage),
+        Some(ScannerCycleBudgetReason::Objects | ScannerCycleBudgetReason::Directories | ScannerCycleBudgetReason::Entries) => {
+            Some(ScannerWorkSource::Usage)
+        }
        Some(ScannerCycleBudgetReason::Runtime) | None => None,
    }
 }
@@ -24,13 +24,51 @@ const BUDGET_REASON_NONE: u8 = 0;
 const BUDGET_REASON_RUNTIME: u8 = 1;
 const BUDGET_REASON_OBJECTS: u8 = 2;
 const BUDGET_REASON_DIRECTORIES: u8 = 3;
+const BUDGET_REASON_ENTRIES: u8 = 4;
 const PROGRESS_CLOCK_SAMPLE_INTERVAL: u64 = 128;
+/// One raw-enumeration page, so a directory stop always commits durable work.
+const DIRECTORY_ENTRY_BUDGET_FLOOR: u64 = 128;
+/// Directory entries one object or directory budget unit pays for. A forward
+/// sweep classifies in sorted order and so needs a whole listing first; a
+/// directory a few times wider than the budget must still reach objects in
+/// its first round, while a far wider one builds its index across rounds.
+const DIRECTORY_ENTRIES_PER_COUNT_UNIT: u64 = 16;

 #[derive(Clone, Copy, Debug, Default, PartialEq, Eq)]
 pub(crate) struct ScannerCycleBudgetConfig {
    pub max_duration: Option<Duration>,
    pub max_objects: Option<u64>,
    pub max_directories: Option<u64>,
+    /// Raw directory entries first observed under this budget. Entries replayed
+    /// from a validated page index are not charged.
+    pub max_entries: Option<u64>,
+    /// Cumulative name bytes of the charged raw entries.
+    pub max_entry_name_bytes: Option<u64>,
+    /// One bucket's share. `None` lets a bucket consume the whole budget.
+    pub bucket_quantum: Option<ScannerBucketQuantum>,
+}
+
+/// Limits of one bucket admission, charged to the owning cycle budget as well.
+#[derive(Clone, Copy, Debug, Default, PartialEq, Eq)]
+pub(crate) struct ScannerBucketQuantum {
+    pub max_duration: Option<Duration>,
+    pub max_objects: Option<u64>,
+    pub max_directories: Option<u64>,
+    pub max_entries: Option<u64>,
+    pub max_entry_name_bytes: Option<u64>,
+}
+
+impl From<ScannerBucketQuantum> for ScannerCycleBudgetConfig {
+    fn from(quantum: ScannerBucketQuantum) -> Self {
+        Self {
+            max_duration: quantum.max_duration,
+            max_objects: quantum.max_objects,
+            max_directories: quantum.max_directories,
+            max_entries: quantum.max_entries,
+            max_entry_name_bytes: quantum.max_entry_name_bytes,
+            bucket_quantum: None,
+        }
+    }
 }

 #[derive(Clone, Copy, Debug, PartialEq, Eq)]
@@ -38,6 +76,7 @@ pub(crate) enum ScannerCycleBudgetReason {
    Runtime,
    Objects,
    Directories,
+    Entries,
 }

 impl ScannerCycleBudgetReason {
@@ -46,6 +85,7 @@ impl ScannerCycleBudgetReason {
            Self::Runtime => BUDGET_REASON_RUNTIME,
            Self::Objects => BUDGET_REASON_OBJECTS,
            Self::Directories => BUDGET_REASON_DIRECTORIES,
+            Self::Entries => BUDGET_REASON_ENTRIES,
        }
    }

@@ -54,12 +94,15 @@ impl ScannerCycleBudgetReason {
            BUDGET_REASON_RUNTIME => Some(Self::Runtime),
            BUDGET_REASON_OBJECTS => Some(Self::Objects),
            BUDGET_REASON_DIRECTORIES => Some(Self::Directories),
+            BUDGET_REASON_ENTRIES => Some(Self::Entries),
            _ => None,
        }
    }
 }

 pub struct ScannerCycleBudget {
+    /// The cycle budget a bucket quantum also charges.
+    parent: Option<Arc<ScannerCycleBudget>>,
    token: CancellationToken,
    reason: Arc<AtomicU8>,
    started_at: Instant,
@@ -67,11 +110,17 @@ pub struct ScannerCycleBudget {
    max_duration: Option<Duration>,
    max_objects: Option<u64>,
    max_directories: Option<u64>,
+    max_entries: Option<u64>,
+    max_entry_name_bytes: Option<u64>,
+    directory_entry_limit: Option<u64>,
+    bucket_quantum: Option<ScannerBucketQuantum>,
    track_progress: bool,
    track_unbounded_counts: bool,
    objects_scanned: AtomicU64,
    directories_started: AtomicU64,
    entries_visited: AtomicU64,
+    entries_charged: AtomicU64,
+    entry_name_bytes_charged: AtomicU64,
    last_progress_millis: AtomicU64,
    cycle_state_persisted: AtomicBool,
    remote_scan_progress: Arc<RemoteScanProgress>,
@@ -80,16 +129,16 @@ pub struct ScannerCycleBudget {
 impl ScannerCycleBudget {
    #[cfg(test)]
    pub(crate) fn new(parent: &CancellationToken, config: ScannerCycleBudgetConfig) -> Arc<Self> {
-        Self::new_inner(parent, config, false, false)
+        Self::new_inner(parent, config, false, false, None)
    }

    pub(crate) fn new_with_progress_tracking(parent: &CancellationToken, config: ScannerCycleBudgetConfig) -> Arc<Self> {
-        Self::new_inner(parent, config, true, true)
+        Self::new_inner(parent, config, true, true, None)
    }

    pub(crate) fn new_with_runtime_progress_tracking(parent: &CancellationToken, config: ScannerCycleBudgetConfig) -> Arc<Self> {
        let track_progress = config.max_duration.is_some();
-        Self::new_inner(parent, config, track_progress, false)
+        Self::new_inner(parent, config, track_progress, false, None)
    }

    fn new_inner(
@@ -97,6 +146,7 @@ impl ScannerCycleBudget {
        config: ScannerCycleBudgetConfig,
        track_progress: bool,
        track_unbounded_counts: bool,
+        cycle_budget: Option<Arc<ScannerCycleBudget>>,
    ) -> Arc<Self> {
        let token = parent.child_token();
        let reason = Arc::new(AtomicU8::new(BUDGET_REASON_NONE));
@@ -124,7 +174,11 @@ impl ScannerCycleBudget {
            });
        }

+        let remote_scan_progress = cycle_budget
+            .as_ref()
+            .map_or_else(|| Arc::new(RemoteScanProgress::default()), |budget| budget.remote_scan_progress());
        Arc::new(Self {
+            parent: cycle_budget,
            token,
            reason,
            started_at,
@@ -132,14 +186,20 @@ impl ScannerCycleBudget {
            max_duration: config.max_duration,
            max_objects: config.max_objects,
            max_directories: config.max_directories,
+            max_entries: config.max_entries,
+            max_entry_name_bytes: config.max_entry_name_bytes,
+            directory_entry_limit: directory_entry_limit(&config),
+            bucket_quantum: config.bucket_quantum,
            track_progress,
            track_unbounded_counts,
            objects_scanned: AtomicU64::new(0),
            directories_started: AtomicU64::new(0),
            entries_visited: AtomicU64::new(0),
+            entries_charged: AtomicU64::new(0),
+            entry_name_bytes_charged: AtomicU64::new(0),
            last_progress_millis: AtomicU64::new(0),
            cycle_state_persisted: AtomicBool::new(false),
-            remote_scan_progress: Arc::new(RemoteScanProgress::default()),
+            remote_scan_progress,
        })
    }

@@ -147,12 +207,31 @@ impl ScannerCycleBudget {
        self.token.clone()
    }

+    /// Budget and cancellation scope of one bucket scan. Without a quantum the
+    /// bucket shares this budget; a quantum stops only its own scan token.
+    pub(crate) fn for_bucket(self: &Arc<Self>, ctx: &CancellationToken) -> (Arc<Self>, CancellationToken) {
+        let Some(quantum) = self.bucket_quantum else {
+            return (self.clone(), ctx.child_token());
+        };
+        let budget = Self::new_inner(ctx, quantum.into(), self.track_progress, self.track_unbounded_counts, Some(self.clone()));
+        let token = budget.token();
+        (budget, token)
+    }
+
+    /// True when only this bucket's share ended and the cycle can continue.
+    pub(crate) fn quantum_exhausted(&self) -> bool {
+        self.parent.as_ref().is_some_and(|parent| !parent.budget_elapsed())
+            && self.reason.load(Ordering::Relaxed) != BUDGET_REASON_NONE
+    }
+
    pub(crate) fn budget_elapsed(&self) -> bool {
        self.reason.load(Ordering::Relaxed) != BUDGET_REASON_NONE
+            || self.parent.as_ref().is_some_and(|parent| parent.budget_elapsed())
    }

    pub(crate) fn reason(&self) -> Option<ScannerCycleBudgetReason> {
        ScannerCycleBudgetReason::from_code(self.reason.load(Ordering::Relaxed))
+            .or_else(|| self.parent.as_ref().and_then(|parent| parent.reason()))
    }

    pub(crate) fn max_duration(&self) -> Option<Duration> {
@@ -176,7 +255,10 @@ impl ScannerCycleBudget {
    }

    pub(crate) fn requires_serial_progress_accounting(&self) -> bool {
-        self.max_objects.is_some() || self.max_directories.is_some()
+        self.max_objects.is_some()
+            || self.max_directories.is_some()
+            || self.max_entries.is_some()
+            || self.max_entry_name_bytes.is_some()
    }

    pub(crate) fn remaining_config(&self) -> ScannerCycleBudgetConfig {
@@ -195,6 +277,13 @@ impl ScannerCycleBudget {
            max_directories: self
                .max_directories
                .map(|max| max.saturating_sub(self.directories_started.load(Ordering::Relaxed))),
+            max_entries: self
+                .max_entries
+                .map(|max| max.saturating_sub(self.entries_charged.load(Ordering::Relaxed))),
+            max_entry_name_bytes: self
+                .max_entry_name_bytes
+                .map(|max| max.saturating_sub(self.entry_name_bytes_charged.load(Ordering::Relaxed))),
+            bucket_quantum: None,
        }
    }

@@ -234,6 +323,9 @@ impl ScannerCycleBudget {
    }

    pub(crate) fn record_entries_visited(&self, entries_visited: u64) {
+        if let Some(parent) = &self.parent {
+            parent.record_entries_visited(entries_visited);
+        }
        if self.track_progress {
            let entries = saturating_fetch_add(&self.entries_visited, entries_visited);
            self.record_progress_sample(entries);
@@ -245,7 +337,11 @@ impl ScannerCycleBudget {
    }

    pub(crate) fn record_remote_progress(&self, objects_scanned: u64, directories_started: u64) {
-        self.remote_scan_progress.record(objects_scanned, directories_started);
+        // A quantum shares the cycle's progress record; its parent writes it.
+        match &self.parent {
+            Some(parent) => parent.record_remote_progress(objects_scanned, directories_started),
+            None => self.remote_scan_progress.record(objects_scanned, directories_started),
+        }
        if self.track_progress || self.max_objects.is_some() {
            let objects = saturating_fetch_add(&self.objects_scanned, objects_scanned);
            if self.track_progress {
@@ -271,6 +367,9 @@ impl ScannerCycleBudget {
    }

    pub(crate) fn cancel_after_unreported_remote_progress(&self) {
+        if let Some(parent) = &self.parent {
+            parent.cancel_after_unreported_remote_progress();
+        }
        if self.max_objects.is_some() {
            self.cancel_for(ScannerCycleBudgetReason::Objects);
        } else if self.max_directories.is_some() {
@@ -279,6 +378,11 @@ impl ScannerCycleBudget {
    }

    pub(crate) fn try_start_directory(&self) -> bool {
+        let parent_allows = self.parent.as_ref().is_none_or(|parent| parent.try_start_directory());
+        self.try_start_own_directory() && parent_allows
+    }
+
+    fn try_start_own_directory(&self) -> bool {
        if self.max_directories.is_none() && !self.track_unbounded_counts {
            return true;
        }
@@ -298,7 +402,35 @@ impl ScannerCycleBudget {
        true
    }

+    /// Charges one raw entry first observed in this scan. `directory_entries`
+    /// counts the charged entries of the current directory: a count budget is
+    /// a total work limit, so one listing cannot read past it.
+    ///
+    /// Returns `false` after charging the entry that exhausts a limit; the
+    /// caller stops with the entry already recorded in its durable index.
+    pub(crate) fn try_charge_raw_entry(&self, name_bytes: u64, directory_entries: u64) -> bool {
+        let parent_allows = self
+            .parent
+            .as_ref()
+            .is_none_or(|parent| parent.try_charge_raw_entry(name_bytes, directory_entries));
+        let entries = self
+            .max_entries
+            .is_some_and(|max| saturating_fetch_add(&self.entries_charged, 1) >= max);
+        let name_bytes = self
+            .max_entry_name_bytes
+            .is_some_and(|max| saturating_fetch_add(&self.entry_name_bytes_charged, name_bytes) >= max);
+        let directory = self.directory_entry_limit.is_some_and(|limit| directory_entries >= limit);
+        if entries || name_bytes || directory {
+            self.cancel_for(ScannerCycleBudgetReason::Entries);
+            return false;
+        }
+        parent_allows
+    }
+
    pub(crate) fn record_object_scanned(&self) {
+        if let Some(parent) = &self.parent {
+            parent.record_object_scanned();
+        }
        if self.max_objects.is_none() && !self.track_unbounded_counts {
            return;
        }
@@ -337,6 +469,21 @@ fn saturating_fetch_add(value: &AtomicU64, delta: u64) -> u64 {
    }
 }

+fn directory_entry_limit(config: &ScannerCycleBudgetConfig) -> Option<u64> {
+    if config.max_objects.is_none() && config.max_directories.is_none() {
+        return None;
+    }
+    let total = config
+        .max_objects
+        .unwrap_or(0)
+        .saturating_add(config.max_directories.unwrap_or(0));
+    Some(
+        total
+            .saturating_mul(DIRECTORY_ENTRIES_PER_COUNT_UNIT)
+            .max(DIRECTORY_ENTRY_BUDGET_FLOOR),
+    )
+}
+
 fn directory_budget_exhausted(directories: u64, max_directories: u64) -> bool {
    // Saturation hides a remote max+1 update when the configured limit is the
    // largest representable counter. Treat that boundary as exhausted rather
@@ -354,6 +501,127 @@ impl Drop for ScannerCycleBudget {
 mod tests {
    use super::*;

+    #[tokio::test]
+    async fn fair_prefix_quantum_budget_limits_entries_and_name_bytes_with_one_reason() {
+        let parent = CancellationToken::new();
+        let by_entries = ScannerCycleBudget::new(
+            &parent,
+            ScannerCycleBudgetConfig {
+                max_entries: Some(2),
+                ..Default::default()
+            },
+        );
+        assert!(by_entries.try_charge_raw_entry(1, 1));
+        assert!(!by_entries.try_charge_raw_entry(1, 2));
+        assert_eq!(by_entries.reason(), Some(ScannerCycleBudgetReason::Entries));
+        assert!(by_entries.token().is_cancelled());
+
+        let by_bytes = ScannerCycleBudget::new(
+            &parent,
+            ScannerCycleBudgetConfig {
+                max_entry_name_bytes: Some(10),
+                ..Default::default()
+            },
+        );
+        assert!(by_bytes.try_charge_raw_entry(9, 1));
+        assert!(!by_bytes.try_charge_raw_entry(1, 2));
+        assert_eq!(by_bytes.reason(), Some(ScannerCycleBudgetReason::Entries));
+        assert!(!parent.is_cancelled(), "a budget stop must not cancel its parent token");
+    }
+
+    #[tokio::test]
+    async fn fair_prefix_quantum_budget_derives_a_directory_limit_only_from_count_budgets() {
+        let parent = CancellationToken::new();
+        let runtime_only = ScannerCycleBudget::new(&parent, ScannerCycleBudgetConfig::default());
+        assert!(runtime_only.try_charge_raw_entry(1, u64::MAX));
+
+        let small = ScannerCycleBudget::new(
+            &parent,
+            ScannerCycleBudgetConfig {
+                max_objects: Some(1),
+                ..Default::default()
+            },
+        );
+        assert!(small.try_charge_raw_entry(1, DIRECTORY_ENTRY_BUDGET_FLOOR - 1));
+        assert!(!small.try_charge_raw_entry(1, DIRECTORY_ENTRY_BUDGET_FLOOR));
+
+        let large = ScannerCycleBudget::new(
+            &parent,
+            ScannerCycleBudgetConfig {
+                max_objects: Some(1000),
+                max_directories: Some(24),
+                ..Default::default()
+            },
+        );
+        assert!(large.try_charge_raw_entry(1, 1024 * DIRECTORY_ENTRIES_PER_COUNT_UNIT - 1));
+        assert!(!large.try_charge_raw_entry(1, 1024 * DIRECTORY_ENTRIES_PER_COUNT_UNIT));
+    }
+
+    #[tokio::test]
+    async fn fair_prefix_quantum_bucket_share_stops_only_its_own_scan() {
+        let ctx = CancellationToken::new();
+        let cycle = ScannerCycleBudget::new_with_progress_tracking(
+            &ctx,
+            ScannerCycleBudgetConfig {
+                max_objects: Some(3),
+                bucket_quantum: Some(ScannerBucketQuantum {
+                    max_objects: Some(2),
+                    ..Default::default()
+                }),
+                ..Default::default()
+            },
+        );
+        let (first, first_token) = cycle.for_bucket(&cycle.token());
+        first.record_object_scanned();
+        first.record_object_scanned();
+        assert!(first.quantum_exhausted());
+        assert!(first_token.is_cancelled());
+        assert_eq!(first.reason(), Some(ScannerCycleBudgetReason::Objects));
+        assert!(!cycle.budget_elapsed(), "a bucket share leaves the cycle running");
+        assert!(!cycle.token().is_cancelled());
+        assert_eq!(cycle.progress().0, 2, "bucket work is charged to the cycle");
+
+        let (second, second_token) = cycle.for_bucket(&cycle.token());
+        assert!(!second.budget_elapsed());
+        second.record_object_scanned();
+        assert!(cycle.budget_elapsed(), "the total budget still bounds every share");
+        assert!(second_token.is_cancelled());
+        assert!(second.budget_elapsed());
+        assert!(!second.quantum_exhausted(), "a cycle stop is not a quantum handoff");
+    }
+
+    #[tokio::test]
+    async fn fair_prefix_quantum_bucket_share_runtime_expires_independently() {
+        let ctx = CancellationToken::new();
+        let cycle = ScannerCycleBudget::new(
+            &ctx,
+            ScannerCycleBudgetConfig {
+                bucket_quantum: Some(ScannerBucketQuantum {
+                    max_duration: Some(Duration::ZERO),
+                    ..Default::default()
+                }),
+                ..Default::default()
+            },
+        );
+        let (bucket, token) = cycle.for_bucket(&cycle.token());
+        tokio::time::timeout(Duration::from_secs(5), token.cancelled())
+            .await
+            .expect("quantum deadline should cancel the bucket scan");
+        assert_eq!(bucket.reason(), Some(ScannerCycleBudgetReason::Runtime));
+        assert!(!cycle.budget_elapsed());
+    }
+
+    #[tokio::test]
+    async fn bucket_without_a_quantum_shares_the_cycle_budget() {
+        let ctx = CancellationToken::new();
+        let cycle = ScannerCycleBudget::new(&ctx, ScannerCycleBudgetConfig::default());
+        let (bucket, token) = cycle.for_bucket(&cycle.token());
+        assert!(Arc::ptr_eq(&bucket, &cycle));
+        cycle.cancel_for_runtime();
+        assert!(token.is_cancelled());
+        assert!(!bucket.quantum_exhausted());
+    }
+
    #[tokio::test]
    async fn runtime_budget_cancels_child_token() {
        let parent = CancellationToken::new();
@@ -441,6 +709,7 @@ mod tests {
                max_duration: Some(Duration::from_secs(60)),
                max_objects: Some(10),
                max_directories: Some(5),
+                ..Default::default()
            },
        );

@@ -498,7 +498,10 @@ fn checkpoint_reason_from_budget(reason: Option<ScannerCycleBudgetReason>) -> Da
    match reason {
        Some(ScannerCycleBudgetReason::Runtime) => DataUsageScanCheckpointReason::Runtime,
        Some(ScannerCycleBudgetReason::Objects) => DataUsageScanCheckpointReason::Objects,
-        Some(ScannerCycleBudgetReason::Directories) => DataUsageScanCheckpointReason::Directories,
+        // This enum is persisted and older readers reject unknown variants.
+        Some(ScannerCycleBudgetReason::Directories | ScannerCycleBudgetReason::Entries) => {
+            DataUsageScanCheckpointReason::Directories
+        }
        None => DataUsageScanCheckpointReason::Unknown,
    }
 }
@@ -1302,9 +1305,11 @@ impl FolderScanner {
        }
    }

-    fn record_raw_enumeration_entry(&mut self, parent: &str, entry: &str) {
+    /// Records one raw entry. Returns whether a durable index holds it, which
+    /// is what makes stopping at this entry recoverable.
+    fn record_raw_enumeration_entry(&mut self, parent: &str, entry: &str) -> bool {
        if self.old_cache.info.scan_progress.is_none() {
-            return;
+            return false;
        }
        if let Some(position) = self
            .raw_enumeration_progress
@@ -1317,18 +1322,14 @@ impl FolderScanner {
            self.raw_enumeration_progress
                .push(RawEnumerationProgress::new(parent, page_index));
        }
-        if let Some(progress) = self.raw_enumeration_progress.last_mut() {
+        self.raw_enumeration_progress.last_mut().is_some_and(|progress| {
            progress.record_entry(entry);
-        }
+            progress.page_index.is_some()
+        })
    }

    fn raw_enumeration_page_index_for_parent(&self, parent: &str) -> Option<&RawEnumerationPageIndex> {
-        self.old_cache
-            .info
-            .scan_raw_enumeration_page_index
-            .as_ref()
-            .filter(|index| index.parent() == Some(parent))?;
-        self.old_cache.validated_raw_enumeration_page_index()
+        self.old_cache.validated_raw_enumeration_page_index_for_parent(parent)
    }

    fn raw_enumeration_committed_entry_oracle(&self, parent: &str) -> HashSet<String> {
@@ -1372,23 +1373,36 @@ impl FolderScanner {
        if self.raw_enumeration_progress.is_empty() {
            return (None, None);
        }
-        let progress_index = self
-            .raw_enumeration_progress
-            .iter()
-            .enumerate()
-            .max_by_key(|(index, progress)| (progress.checkpointable_entry_count(), std::cmp::Reverse(*index)))
-            .map(|(index, _)| index)
-            .unwrap_or(0);
+        let progress_index = self.selected_raw_enumeration_progress().unwrap_or(0);
        let progress = self.raw_enumeration_progress.swap_remove(progress_index);
        self.raw_enumeration_progress.clear();
        (progress.cursor(), progress.page_index())
    }

-    fn peek_raw_enumeration_resume_state(&self) -> (Option<DataUsageRawEnumerationCursor>, Option<RawEnumerationPageIndex>) {
+    fn selected_raw_enumeration_progress(&self) -> Option<usize> {
        self.raw_enumeration_progress
            .iter()
-            .max_by_key(|progress| progress.checkpointable_entry_count())
-            .map_or((None, None), |progress| (progress.cursor(), progress.page_index()))
+            .enumerate()
+            .max_by_key(|(index, progress)| (progress.checkpointable_entry_count(), std::cmp::Reverse(*index)))
+            .map(|(index, _)| index)
+    }
+
+    /// The walk path except the directory the resume state selects.
+    fn raw_enumeration_path_page_indexes(&self) -> Vec<RawEnumerationPageIndex> {
+        let selected = self.selected_raw_enumeration_progress();
+        self.raw_enumeration_progress
+            .iter()
+            .enumerate()
+            .filter(|(index, _)| Some(*index) != selected)
+            .filter_map(|(_, progress)| progress.page_index())
+            .collect()
+    }
+
+    fn peek_raw_enumeration_resume_state(&self) -> (Option<DataUsageRawEnumerationCursor>, Option<RawEnumerationPageIndex>) {
+        self.selected_raw_enumeration_progress().map_or((None, None), |index| {
+            let progress = &self.raw_enumeration_progress[index];
+            (progress.cursor(), progress.page_index())
+        })
    }

    async fn scan_child_folder(
@@ -1480,6 +1494,7 @@ impl FolderScanner {
        snapshot.info.last_update = Some(SystemTime::now());
        snapshot.info.snapshot_complete = false;
        let (cursor, page_index) = self.peek_raw_enumeration_resume_state();
+        snapshot.info.scan_raw_enumeration_path_page_indexes = self.raw_enumeration_path_page_indexes();
        snapshot.info.scan_raw_enumeration_cursor = cursor;
        snapshot.info.scan_raw_enumeration_page_index = page_index;
        snapshot.seal_scan_frontier(self.coverage_frontier.as_deref()).ok()?;
@@ -1976,6 +1991,9 @@ impl FolderScanner {
            let mut last_entry_progress = Instant::now();
            let mut raw_enumeration_complete = false;
            let raw_enumeration_committed_entries = self.raw_enumeration_committed_entry_oracle(&folder.name);
+            let raw_replay_floor = u64::try_from(raw_enumeration_committed_entries.len()).unwrap_or(u64::MAX);
+            let mut raw_entries_observed = 0_u64;
+            let mut raw_entries_charged = 0_u64;

            let mut candidate_unclassified = mode != FolderScanMode::Namespace;
            let mut deferred_metadata = None;
@@ -2061,8 +2079,13 @@ impl FolderScanner {
                    continue;
                }
                if !replayed_metadata {
-                    let raw_entry_consumed_by_owner_index = raw_enumeration_committed_entries.contains(&file_name);
-                    if !raw_entry_consumed_by_owner_index {
+                    // A restored index appends one pending name per entry past
+                    // its old size, so charging only that tail keeps each
+                    // budget unit durable even if the listing order changed.
+                    raw_entries_observed = raw_entries_observed.saturating_add(1);
+                    let raw_entry_is_new =
+                        raw_entries_observed > raw_replay_floor && !raw_enumeration_committed_entries.contains(&file_name);
+                    if raw_entry_is_new {
                        #[cfg(test)]
                        tests::enumeration_restart::observe_raw_entry(&dir_path, &entry.file_name(), &self.budget);
                        pending_entry_progress = pending_entry_progress.saturating_add(1);
@@ -2074,7 +2097,18 @@ impl FolderScanner {
                            last_entry_progress = Instant::now();
                        }
                    }
-                    self.record_raw_enumeration_entry(&folder.name, &file_name);
+                    let raw_entry_is_durable = self.record_raw_enumeration_entry(&folder.name, &file_name);
+                    // Object metadata and the entries behind it are charged to
+                    // the object budget; this one covers listing work.
+                    let object_entry = file_name == STORAGE_FORMAT_FILE || deferred_metadata.is_some();
+                    if raw_entry_is_new && raw_entry_is_durable && !object_entry {
+                        raw_entries_charged = raw_entries_charged.saturating_add(1);
+                        let name_bytes = u64::try_from(file_name.len()).unwrap_or(u64::MAX);
+                        if !self.budget.try_charge_raw_entry(name_bytes, raw_entries_charged) {
+                            self.budget.record_entries_visited(pending_entry_progress);
+                            return Err(ScannerError::Other("Operation cancelled".to_string()));
+                        }
+                    }
                    self.maybe_send_checkpoint(&folder, &this_hash, into);
                }
                let is_storage_format_entry = file_name == STORAGE_FORMAT_FILE;
@@ -2474,7 +2508,9 @@ impl FolderScanner {
                }
            }
            self.budget.record_entries_visited(pending_entry_progress);
-            if raw_enumeration_complete {
+            // A directory with queued children keeps its index until they end:
+            // a restart replays this listing to reach the unfinished child.
+            if raw_enumeration_complete && queued_folders.is_empty() {
                self.finish_raw_enumeration_parent(&folder.name);
            }

@@ -2683,10 +2719,12 @@ impl FolderScanner {
                                "Scanner child folder scan failed"
                            );
                            self.coverage_gap |= forward_sweep;
+                            self.finish_raw_enumeration_parent(&folder_item.name);
                            continue;
                        }
                    }
                };
+                self.finish_raw_enumeration_parent(&folder_item.name);
                if outcome == FolderScanOutcome::Vanished {
                    self.new_cache.delete_recursive(&h);
                    if let Some(updates) = &mut self.usage_updates {
@@ -3405,6 +3443,7 @@ pub(crate) async fn scan_data_folder_scoped(
            new_cache.info.scan_checkpoint = None;
            new_cache.info.scan_raw_enumeration_cursor = None;
            new_cache.info.scan_raw_enumeration_page_index = None;
+            new_cache.info.scan_raw_enumeration_path_page_indexes.clear();
            new_cache.info.scan_coverage_receipt = None;
            if had_scan_checkpoint {
                global_metrics().record_scanner_checkpoint_cleared();
@@ -3443,6 +3482,7 @@ pub(crate) async fn scan_data_folder_scoped(
                let root_hash = hash_path(&bucket_name);
                let root_has_progress = data_usage_root_has_progress(&root);
                let pending_heals_changed = scanner.pending_heals_changed;
+                let raw_enumeration_path_page_indexes = scanner.raw_enumeration_path_page_indexes();
                let (raw_enumeration_cursor, raw_enumeration_page_index) = scanner.take_raw_enumeration_resume_state();
                let carry_forward_cache = ((raw_enumeration_cursor.is_some() || raw_enumeration_page_index.is_some())
                    && !root_has_progress)
@@ -3465,6 +3505,7 @@ pub(crate) async fn scan_data_folder_scoped(
                }
                if raw_enumeration_page_index.is_some() {
                    new_cache.info.scan_raw_enumeration_page_index = raw_enumeration_page_index;
+                    new_cache.info.scan_raw_enumeration_path_page_indexes = raw_enumeration_path_page_indexes;
                    new_cache.info.scan_checkpoint = None;
                    new_cache.info.scan_resume_after = None;
                    new_cache.info.scan_coverage_receipt = None;
@@ -3495,6 +3536,7 @@ pub(crate) async fn scan_data_folder_scoped(
                            global_metrics().record_scanner_checkpoint_cleared();
                        }
                    }
+                    new_cache.info.scan_resource_deferred = matches!(&e, ScannerError::ResourceDeferred);
                    close_disk_guard.close().await;
                    return Err(ScannerError::PartialCache(Box::new(std::mem::take(new_cache))));
                }
@@ -3524,6 +3566,7 @@ pub(crate) async fn scan_data_folder_scoped(
                        .insert(hash_path(&bucket_name).0, DataUsageEntry::default());
                }
                partial_cache.info.snapshot_complete = false;
+                partial_cache.info.scan_resource_deferred = true;
                close_disk_guard.close().await;
                return Err(ScannerError::PartialCache(Box::new(partial_cache)));
            }
@@ -30,6 +30,7 @@ use std::sync::Mutex;

 pub(super) mod checkpoint_fixture;
 pub(super) mod enumeration_restart;
+mod fair_prefix_quantum;
 mod incremental_enumeration;
 mod listing_completion;
 mod metadata_visits;
@@ -51,6 +51,10 @@ impl Drop for ObservationGuard {
    }
 }

+pub(in crate::scanner_folder) fn install_raw_entry_observer(root: PathBuf) -> ObservationGuard {
+    install_raw_entry_budget(root, u64::MAX)
+}
+
 pub(in crate::scanner_folder) fn install_raw_entry_budget(root: PathBuf, limit: u64) -> ObservationGuard {
    *OBSERVATION.lock().expect("install raw-entry observation") = Some(Observation {
        root,
@@ -83,6 +87,45 @@ pub(super) async fn read_bounded(path: &Path) -> Vec<u8> {
    bytes
 }

+/// Creates a flat synthetic bucket and the checkpointable cache a first sweep
+/// starts from.
+pub(super) async fn seed_flat_bucket(disk_root: &Path, objects: usize) -> DataUsageCache {
+    tokio::fs::create_dir(disk_root).await.expect("create fresh synthetic disk");
+    for index in 0..objects {
+        let object = format!("object-{index:04}");
+        let version = Uuid::from_u128(u128::try_from(index).expect("fixture index") + 1);
+        let bytes = metadata_for_object_version("bucket", &object, Some(version));
+        write_test_object_metadata_bytes(disk_root, "bucket", &object, &bytes).await;
+    }
+    let mut initial = DataUsageCache::default();
+    initial.info.name = "bucket".to_string();
+    let source = crate::data_usage_define::DataUsageCacheSource::new(0, 0);
+    let plan = crate::data_usage_define::DataUsageScanPlanDigest([31; 32]);
+    let identity = crate::data_usage_define::DataUsageScanIdentity {
+        version: 1,
+        bucket_incarnation: Uuid::from_u128(31),
+        set_layout: crate::data_usage_define::DataUsageScanPlanDigest([32; 32]),
+        publication_epoch: 1,
+        tier_registry_generation: 0,
+        scan_mode: HealScanMode::Normal,
+    };
+    assert_eq!(
+        initial.prepare_bucket_checkpoint("bucket", 1, 0, source, plan, identity),
+        crate::data_usage_define::DataUsageCachePrepareOutcome::Reset
+    );
+    initial.info.skip_healing = true;
+    initial.replace("bucket", "", DataUsageEntry::default());
+    initial
+}
+
+pub(super) fn observed_raw_entries() -> u64 {
+    OBSERVATION
+        .lock()
+        .expect("read raw-entry observation")
+        .as_ref()
+        .map_or(0, |observation| observation.entries)
+}
+
 async fn round(request: &Request) -> serde_json::Value {
    assert!((1..=1024).contains(&request.objects));
    assert!((1..=4096).contains(&request.raw_entry_budget));
@@ -90,31 +133,7 @@ async fn round(request: &Request) -> serde_json::Value {
    let disk_root = request.workspace.join("disk");
    let cache_path = request.workspace.join("cache.bin");
    if request.round == 0 {
-        tokio::fs::create_dir(&disk_root).await.expect("create fresh synthetic disk");
-        for index in 0..request.objects {
-            let object = format!("object-{index:04}");
-            let version = Uuid::from_u128(u128::try_from(index).expect("fixture index") + 1);
-            let bytes = metadata_for_object_version("bucket", &object, Some(version));
-            write_test_object_metadata_bytes(&disk_root, "bucket", &object, &bytes).await;
-        }
-        let mut initial = DataUsageCache::default();
-        initial.info.name = "bucket".to_string();
-        let source = crate::data_usage_define::DataUsageCacheSource::new(0, 0);
-        let plan = crate::data_usage_define::DataUsageScanPlanDigest([31; 32]);
-        let identity = crate::data_usage_define::DataUsageScanIdentity {
-            version: 1,
-            bucket_incarnation: Uuid::from_u128(31),
-            set_layout: crate::data_usage_define::DataUsageScanPlanDigest([32; 32]),
-            publication_epoch: 1,
-            tier_registry_generation: 0,
-            scan_mode: HealScanMode::Normal,
-        };
-        assert_eq!(
-            initial.prepare_bucket_checkpoint("bucket", 1, 0, source, plan, identity),
-            crate::data_usage_define::DataUsageCachePrepareOutcome::Reset
-        );
-        initial.info.skip_healing = true;
-        initial.replace("bucket", "", DataUsageEntry::default());
+        let initial = seed_flat_bucket(&disk_root, request.objects).await;
        tokio::fs::write(&cache_path, initial.marshal_msg().expect("initial cache codec"))
            .await
            .expect("persist initial cache");
@@ -137,10 +156,11 @@ async fn round(request: &Request) -> serde_json::Value {
        &parent,
        crate::scanner_budget::ScannerCycleBudgetConfig {
            max_objects: Some(request.raw_entry_budget),
+            max_entries: Some(request.raw_entry_budget),
            ..Default::default()
        },
    );
-    let _observation_guard = install_raw_entry_budget(disk.path(), request.raw_entry_budget);
+    let _observation_guard = install_raw_entry_observer(disk.path());
    let result = scan_data_folder(
        budget.token(),
        budget.clone(),
@@ -0,0 +1,233 @@
+// Copyright 2026 RustFS Team
+// Licensed under the Apache License, Version 2.0.
+
+use super::enumeration_restart::{install_raw_entry_observer, observed_raw_entries, seed_flat_bucket};
+use super::*;
+use crate::scanner_budget::ScannerCycleBudgetConfig;
+
+async fn open_fixture_disk(disk_root: &std::path::Path) -> Arc<Disk> {
+    let endpoint = Endpoint::try_from(disk_root.to_string_lossy().as_ref()).expect("fixture endpoint");
+    new_disk(
+        &endpoint,
+        &DiskOption {
+            cleanup: false,
+            health_check: false,
+        },
+    )
+    .await
+    .expect("open synthetic disk")
+}
+
+/// A count budget is the operator's total work limit. It must also stop the
+/// first listing of a directory far wider than that budget, instead of letting
+/// one read_dir pass finish before the first object is charged.
+#[tokio::test]
+#[serial]
+async fn fair_prefix_quantum_count_budget_bounds_the_first_directory_build() {
+    const OBJECTS: usize = 300;
+    const FIRST_BUILD_FLOOR: u64 = 128;
+    let temp = tempfile::tempdir().expect("fixture directory");
+    let disk_root = temp.path().join("disk");
+    let cache = seed_flat_bucket(&disk_root, OBJECTS).await;
+    let disk = open_fixture_disk(&disk_root).await;
+    let parent = CancellationToken::new();
+    let budget = ScannerCycleBudget::new_with_progress_tracking(
+        &parent,
+        ScannerCycleBudgetConfig {
+            max_objects: Some(8),
+            ..Default::default()
+        },
+    );
+    let _observation = install_raw_entry_observer(disk.path());
+
+    let result = scan_data_folder(
+        budget.token(),
+        budget.clone(),
+        vec![disk.clone()],
+        disk,
+        cache,
+        None,
+        HealScanMode::Normal,
+        SCANNER_SLEEPER.clone(),
+    )
+    .await;
+
+    assert!(
+        matches!(result, Err(ScannerError::PartialCache(_))),
+        "an exhausted first build must return recoverable progress"
+    );
+    assert!(
+        observed_raw_entries() <= FIRST_BUILD_FLOOR,
+        "first build read {} raw entries under an 8-object budget",
+        observed_raw_entries()
+    );
+}
+
+struct RestartRound {
+    outcome: DataUsageCache,
+    finished: bool,
+    observed_entries: u64,
+}
+
+/// One scanner lifetime: the input was decoded from persisted bytes, and the
+/// result is encoded and decoded again before the next round may use it.
+async fn scan_one_restart_round(
+    disk_root: &std::path::Path,
+    cache: DataUsageCache,
+    config: ScannerCycleBudgetConfig,
+) -> RestartRound {
+    let disk = open_fixture_disk(disk_root).await;
+    let parent = CancellationToken::new();
+    let budget = ScannerCycleBudget::new_with_progress_tracking(&parent, config);
+    let _observation = install_raw_entry_observer(disk.path());
+    let result = scan_data_folder(
+        budget.token(),
+        budget.clone(),
+        vec![disk.clone()],
+        disk,
+        cache.clone(),
+        None,
+        HealScanMode::Normal,
+        SCANNER_SLEEPER.clone(),
+    )
+    .await;
+    let observed_entries = observed_raw_entries();
+    let (returned, finished) = match result {
+        Ok(cache) => (cache, true),
+        Err(ScannerError::PartialCache(cache)) => (*cache, false),
+        Err(error) => panic!("a budget stop must keep recoverable progress: {error}"),
+    };
+    let encoded = returned.marshal_msg().expect("encode returned cache");
+    RestartRound {
+        outcome: DataUsageCache::unmarshal(&encoded).expect("decode returned cache"),
+        finished,
+        observed_entries,
+    }
+}
+
+async fn run_until_finished(
+    disk_root: &std::path::Path,
+    mut cache: DataUsageCache,
+    config: ScannerCycleBudgetConfig,
+    rounds: usize,
+) -> DataUsageCache {
+    for round in 0..rounds {
+        let result = scan_one_restart_round(disk_root, cache, config).await;
+        if let Some(limit) = config.max_entries {
+            assert!(result.observed_entries <= limit, "round {round} read {} entries", result.observed_entries);
+        }
+        cache = result.outcome;
+        if result.finished {
+            assert!(cache.info.snapshot_complete, "a finished sweep must certify its bucket");
+            return cache;
+        }
+    }
+    panic!("the sweep did not finish in {rounds} restarts");
+}
+
+/// Both a wide bucket root and a wide nested prefix must keep their indexes:
+/// losing either one recharges its replay and a fixed budget stops advancing.
+#[tokio::test]
+#[serial]
+async fn fair_prefix_quantum_nested_wide_directories_converge_across_restarts() {
+    const WIDTH: usize = 40;
+    let temp = tempfile::tempdir().expect("fixture directory");
+    let disk_root = temp.path().join("disk");
+    let cache = seed_flat_bucket(&disk_root, WIDTH).await;
+    for index in 0..WIDTH {
+        let object = format!("wide/nested-{index:04}");
+        let version = Uuid::from_u128(u128::try_from(index).expect("fixture index") + 1000);
+        let bytes = metadata_for_object_version("bucket", &object, Some(version));
+        write_test_object_metadata_bytes(&disk_root, "bucket", &object, &bytes).await;
+    }
+    let config = ScannerCycleBudgetConfig {
+        max_objects: Some(8),
+        max_entries: Some(8),
+        ..Default::default()
+    };
+    // 41 root and 40 prefix entries at 8 per round, then 80 objects at the 7
+    // that survive each object-budget stop. Rebuilding a dropped index costs
+    // a full prefix enumeration per classification round and overruns this.
+    const ROUND_BOUND: usize = 6 + 5 + 12 + 2;
+    let finished = run_until_finished(&disk_root, cache, config, ROUND_BOUND).await;
+    let totals = finished.checked_flatten("bucket").expect("bucket root");
+    let expected = u64::try_from(WIDTH * 2).expect("fixture size");
+    assert_eq!((totals.objects as u64, totals.versions as u64), (expected, expected));
+    assert!(finished.info.scan_raw_enumeration_page_index.is_none());
+    assert!(finished.info.scan_raw_enumeration_path_page_indexes.is_empty());
+}
+
+/// A name-byte share stops a listing the same way an entry share does, and the
+/// bytes kept for the next restart grow only by what each round charged.
+#[tokio::test]
+#[serial]
+async fn fair_prefix_quantum_name_bytes_bound_each_round_and_its_checkpoint_growth() {
+    const OBJECTS: usize = 64;
+    const NAME_BYTES_PER_ROUND: u64 = 88;
+    const INDEX_BYTES_PER_NAME_BYTE: usize = 16;
+    let temp = tempfile::tempdir().expect("fixture directory");
+    let disk_root = temp.path().join("disk");
+    let mut cache = seed_flat_bucket(&disk_root, OBJECTS).await;
+    let config = ScannerCycleBudgetConfig {
+        max_entry_name_bytes: Some(NAME_BYTES_PER_ROUND),
+        ..Default::default()
+    };
+    let mut indexed = 0;
+    let mut encoded_before = cache.marshal_msg().expect("encode initial cache").len();
+    for _ in 0..8 {
+        let result = scan_one_restart_round(&disk_root, cache, config).await;
+        assert!(!result.finished);
+        assert_eq!(result.observed_entries, 8, "each entry name in this fixture is 11 bytes");
+        cache = result.outcome;
+        let committed = cache
+            .validated_raw_enumeration_page_index()
+            .expect("durable index")
+            .committed_entries()
+            .expect("committed entries")
+            .len();
+        assert_eq!(committed, indexed + 8, "every charged entry must become durable");
+        indexed = committed;
+        let encoded = cache.marshal_msg().expect("encode cache").len();
+        let growth = encoded.saturating_sub(encoded_before);
+        assert!(
+            growth <= usize::try_from(NAME_BYTES_PER_ROUND).expect("fixture size") * INDEX_BYTES_PER_NAME_BYTE,
+            "checkpoint grew {growth} bytes in one round"
+        );
+        encoded_before = encoded;
+    }
+}
+
+/// Stopping for an entry share must leave the same exact totals a full sweep
+/// produces, and a Deep request must not inherit Normal raw coverage.
+#[tokio::test]
+#[serial]
+async fn fair_prefix_quantum_budget_stop_keeps_progress_without_certifying_it() {
+    const OBJECTS: usize = 24;
+    let temp = tempfile::tempdir().expect("fixture directory");
+    let disk_root = temp.path().join("disk");
+    let cache = seed_flat_bucket(&disk_root, OBJECTS).await;
+    let config = ScannerCycleBudgetConfig {
+        max_objects: Some(4),
+        max_entries: Some(4),
+        ..Default::default()
+    };
+    let round = scan_one_restart_round(&disk_root, cache, config).await;
+    assert!(!round.finished);
+    assert!(!round.outcome.info.snapshot_complete, "budget stops are progress-only");
+    assert!(round.outcome.info.scan_plan_digest.is_none(), "a partial sweep must not be reusable");
+    assert!(round.outcome.has_scan_position(), "the saved cache must carry the resume position");
+
+    let mut deep = round.outcome.clone();
+    let mut identity = deep.info.scan_identity.expect("checkpoint identity");
+    identity.scan_mode = HealScanMode::Deep;
+    let plan = crate::data_usage_define::DataUsageScanPlanDigest([31; 32]);
+    let source = crate::data_usage_define::DataUsageCacheSource::new(0, 0);
+    deep.prepare_bucket_checkpoint("bucket", 2, 0, source, plan, identity);
+    assert!(!deep.has_scan_position(), "Normal raw coverage must not carry into a Deep sweep");
+    assert!(deep.info.scan_raw_enumeration_path_page_indexes.is_empty());
+
+    let finished = run_until_finished(&disk_root, round.outcome, config, 16).await;
+    let totals = finished.checked_flatten("bucket").expect("bucket root");
+    let expected = u64::try_from(OBJECTS).expect("fixture size");
+    assert_eq!((totals.objects as u64, totals.versions as u64), (expected, expected));
+}
@@ -497,6 +497,7 @@ async fn scanner_node_admission_mid_walk_shrink_preserves_partial_and_resumes_al
        panic!("deferral below root cannot certify completion: {partial:?}");
    };
    assert!(!partial.info.snapshot_complete);
+    assert!(partial.info.scan_resource_deferred);
    assert_eq!(
        partial
            .size_recursive("bucket")
@@ -610,6 +611,7 @@ async fn check_early_admission_deferral(node_open: bool, physical_limit: u32) {
        panic!("resource pressure is a partial census, not a disk error: {result:?}");
    };
    assert!(!partial.info.snapshot_complete);
+    assert!(partial.info.scan_resource_deferred);
    let totals = partial.size_recursive("bucket").expect("old tree retained");
    assert_eq!((totals.objects, totals.size), (7, 19));
    assert_eq!(gate.completed(), Some(0));
@@ -18,9 +18,9 @@ use crate::scanner_budget::ScannerCycleBudget;
 use crate::scanner_folder::{ScannerBucketPrefixScanScope, ScannerItem, scan_data_folder_scoped};
 use crate::sleeper::SCANNER_SLEEPER;
 use crate::{
-    DATA_USAGE_CACHE_NAME, DATA_USAGE_ROOT, DataUsageCache, DataUsageCacheInfo, DataUsageCachePrepareOutcome,
-    DataUsageCacheSource, DataUsageEntry, DataUsageEntryInfo, DataUsageInfo, DataUsageScanPlanDigest, DataUsageSnapshotSetState,
-    ScannerError, SizeSummary, TierStats,
+    DATA_USAGE_CACHE_NAME, DATA_USAGE_ROOT, DataUsageBucketServiceLedger, DataUsageCache, DataUsageCacheInfo,
+    DataUsageCachePrepareOutcome, DataUsageCacheSource, DataUsageEntry, DataUsageEntryInfo, DataUsageInfo,
+    DataUsageScanPlanDigest, DataUsageSnapshotSetState, ScannerError, SizeSummary, TierStats,
 };
 use bytes::Bytes;
 use futures::future::join_all;
@@ -1200,6 +1200,84 @@ fn log_missing_set_snapshot_metadata(store: &SetDisks, info: &DataUsageCacheInfo
    );
 }

+/// Saves a set's service order over its unchanged cache, which an incomplete
+/// cycle otherwise never writes. Under the set cache lock and its revisions the
+/// save cannot replace newer coverage; a failed save costs fairness only.
+pub(super) async fn persist_scanner_service_ledger(
+    store: Arc<SetDisks>,
+    source: DataUsageCacheSource,
+    mut ledger: DataUsageBucketServiceLedger,
+    cycle: u64,
+    leader_epoch: u64,
+    expected_publication_epoch: u64,
+) -> bool {
+    let log_skipped = |state: &str, error: &dyn std::fmt::Display| {
+        warn!(
+            target: "rustfs::scanner::io",
+            event = EVENT_SCANNER_CACHE_PERSIST_STATE,
+            component = LOG_COMPONENT_SCANNER,
+            subsystem = LOG_SUBSYSTEM_IO,
+            state,
+            pool = source.pool_index,
+            set = source.set_index,
+            cycle,
+            leader_epoch,
+            cache_name = DATA_USAGE_CACHE_NAME,
+            error = %error,
+            "Scanner kept the previous bucket service order"
+        );
+    };
+    let guard = match acquire_scanner_cache_locks(store.as_ref(), DATA_USAGE_CACHE_NAME, source).await {
+        Ok(guard) => guard,
+        Err(error) => {
+            log_skipped(error.state(), &error);
+            return false;
+        }
+    };
+    let mut persisted = DataUsageCache::default();
+    let revisions = match persisted.load_with_revisions(store.clone(), DATA_USAGE_CACHE_NAME).await {
+        Ok(revisions) => revisions,
+        Err(error) => {
+            log_skipped("service_order_load_failed", &error);
+            return false;
+        }
+    };
+    if persisted.info.next_cycle > cycle
+        || persisted.info.leader_epoch > leader_epoch
+        || persisted
+            .info
+            .scan_bucket_service
+            .as_ref()
+            .is_some_and(|saved| saved.leader_epoch > leader_epoch)
+    {
+        log_skipped("service_order_stale", &"a newer scanner owns the set cache");
+        return false;
+    }
+    if guard.is_lock_lost() {
+        log_skipped("service_order_lock_lost", &"set cache lock was lost");
+        return false;
+    }
+    if persisted.info.name.is_empty() {
+        // First incomplete cycle of a set: the order is its only content.
+        persisted.info.name = DATA_USAGE_ROOT.to_string();
+        persisted.info.source = Some(source);
+        persisted.info.leader_epoch = leader_epoch;
+        persisted.info.cache_key_format = DATA_USAGE_CACHE_KEY_FORMAT;
+    }
+    ledger.leader_epoch = leader_epoch;
+    persisted.info.scan_bucket_service = Some(ledger);
+    match persisted
+        .save_with_revisions_for_epoch(store, DATA_USAGE_CACHE_NAME, &revisions, expected_publication_epoch)
+        .await
+    {
+        Ok(()) => true,
+        Err(error) => {
+            log_skipped("service_order_save_failed", &error);
+            false
+        }
+    }
+}
+
 pub(super) async fn persist_and_publish_cache_snapshot(
    store: Arc<SetDisks>,
    updates: &mpsc::Sender<DataUsageCache>,
@@ -1638,6 +1638,7 @@ pub(super) async fn requeue_bucket_work(
    bucket: &BucketInfo,
    work_guard: &mut BucketWorkGuard,
 ) -> bool {
+    work_guard.settle_service_for_requeue();
    if bucket_tx.send(bucket.clone()).await.is_err() {
        return false;
    }
@@ -307,6 +307,33 @@ impl ScannerServiceCohort {
    }
 }

+/// Publishes one aggregate per set: each failure is already logged where it
+/// happened, and this keeps the unpaid total visible after a restart.
+pub(super) fn record_bucket_failure_debt(source: DataUsageCacheSource, cycle: u64, ledger: &DataUsageBucketServiceLedger) {
+    let (debtors, first_bucket) = ledger.failure_debt();
+    metrics::gauge!(
+        "rustfs_scanner_bucket_failure_debt",
+        "pool" => source.pool_index.to_string(),
+        "set" => source.set_index.to_string()
+    )
+    .set(debtors as f64);
+    if debtors > 0 {
+        warn!(
+            target: "rustfs::scanner::io",
+            event = EVENT_SCANNER_SET_STATE,
+            component = LOG_COMPONENT_SCANNER,
+            subsystem = LOG_SUBSYSTEM_IO,
+            state = "bucket_failure_debt",
+            pool = source.pool_index,
+            set = source.set_index,
+            cycle,
+            debtors,
+            first_bucket,
+            "Scanner buckets still owe a successful sweep"
+        );
+    }
+}
+
 pub(super) async fn wait_for_bucket_scan_permit(
    semaphore: &Arc<Semaphore>,
    ctx: &CancellationToken,
@@ -408,10 +435,102 @@ pub(super) struct DiskBucketScanActiveGuard {
    set: String,
 }

+#[derive(Default)]
+struct ScannerBucketServiceRoundState {
+    ledger: DataUsageBucketServiceLedger,
+    claimed: HashMap<String, u64>,
+    interrupted: HashSet<String>,
+}
+
+/// One cycle's view of a set's durable service order. Lock order: taken alone,
+/// and never held across an await.
+pub(super) struct ScannerBucketServiceRound(StdMutex<ScannerBucketServiceRoundState>);
+
+impl ScannerBucketServiceRound {
+    pub(super) fn new(ledger: DataUsageBucketServiceLedger) -> Self {
+        Self(StdMutex::new(ScannerBucketServiceRoundState {
+            ledger,
+            ..Default::default()
+        }))
+    }
+
+    fn state(&self) -> std::sync::MutexGuard<'_, ScannerBucketServiceRoundState> {
+        self.0.lock().unwrap_or_else(|poisoned| poisoned.into_inner())
+    }
+
+    pub(super) fn order_buckets(&self, buckets: &mut [BucketInfo]) {
+        // The stable sort keeps the caller's order for equal positions.
+        let state = self.state();
+        buckets.sort_by_key(|bucket| state.ledger.wait_position(&bucket.name));
+    }
+
+    fn claim(&self, bucket: &str) {
+        let mut state = self.state();
+        if let Some(previous) = state.ledger.record_service(bucket) {
+            // A second claim in one cycle keeps the position before the first.
+            state.claimed.entry(bucket.to_owned()).or_insert(previous);
+        }
+    }
+
+    fn release(&self, bucket: &str) {
+        let mut state = self.state();
+        if let Some(previous) = state.claimed.remove(bucket) {
+            state.ledger.return_service(bucket, previous);
+        }
+    }
+
+    fn interrupt(&self, bucket: &str) {
+        self.state().interrupted.insert(bucket.to_owned());
+    }
+
+    /// Closes the cycle. Only a real worker completion clears debt; a claimed
+    /// bucket that failed or stayed partial adds debt unless a budget stopped
+    /// it. `None` means no bucket was served, so nothing needs persisting.
+    pub(super) fn settle(
+        &self,
+        completed: &HashSet<String>,
+        failed: &HashSet<String>,
+        partial: &HashSet<String>,
+    ) -> Option<DataUsageBucketServiceLedger> {
+        let mut state = self.state();
+        let state = &mut *state;
+        if state.claimed.is_empty() {
+            return None;
+        }
+        for bucket in state.claimed.keys() {
+            if completed.contains(bucket) {
+                state.ledger.record_certified(bucket);
+            } else if (failed.contains(bucket) || partial.contains(bucket)) && !state.interrupted.contains(bucket) {
+                state.ledger.record_failure(bucket);
+            }
+        }
+        state.claimed.clear();
+        Some(std::mem::take(&mut state.ledger))
+    }
+}
+
+struct BucketServiceClaim {
+    round: Arc<ScannerBucketServiceRound>,
+    bucket: String,
+    ctx: CancellationToken,
+    budget: Arc<ScannerCycleBudget>,
+}
+
+impl BucketServiceClaim {
+    fn settle(self, requeued: bool) {
+        if self.budget.budget_elapsed() || self.ctx.is_cancelled() {
+            self.round.interrupt(&self.bucket);
+        } else if requeued {
+            self.round.release(&self.bucket);
+        }
+    }
+}
+
 pub(super) struct BucketWorkGuard {
    remaining: Arc<AtomicUsize>,
    complete: CancellationToken,
    requeued: bool,
+    service: Option<BucketServiceClaim>,
 }

 impl BucketWorkGuard {
@@ -420,16 +539,53 @@ impl BucketWorkGuard {
            remaining,
            complete,
            requeued: false,
+            service: None,
        }
    }

    pub(super) fn mark_requeued(&mut self) {
        self.requeued = true;
    }
+
+    /// Settles the claim before the bucket is visible to another worker, whose
+    /// own claim a later release would otherwise undo.
+    pub(super) fn settle_service_for_requeue(&mut self) {
+        if let Some(claim) = self.service.take() {
+            claim.settle(true);
+        }
+    }
+
+    /// Records a stop that is neither service nor failure, such as a resource veto.
+    pub(super) fn mark_service_interrupted(&self) {
+        if let Some(claim) = &self.service {
+            claim.round.interrupt(&claim.bucket);
+        }
+    }
+
+    /// Spends this bucket's service turn. The guard settles it at the end of
+    /// the admission: a requeue without a spent budget hands the turn back.
+    pub(super) fn claim_service(
+        &mut self,
+        round: Arc<ScannerBucketServiceRound>,
+        bucket: &str,
+        ctx: CancellationToken,
+        budget: Arc<ScannerCycleBudget>,
+    ) {
+        round.claim(bucket);
+        self.service = Some(BucketServiceClaim {
+            round,
+            bucket: bucket.to_owned(),
+            ctx,
+            budget,
+        });
+    }
 }

 impl Drop for BucketWorkGuard {
    fn drop(&mut self) {
+        if let Some(claim) = self.service.take() {
+            claim.settle(self.requeued);
+        }
        if !self.requeued && self.remaining.fetch_sub(1, Ordering::AcqRel) == 1 {
            self.complete.cancel();
        }
@@ -348,10 +348,21 @@ impl ScannerIOCache for SetDisks {
                None
            }
        };
+        let persisted_bucket_service = old_cache
+            .info
+            .scan_bucket_service
+            .take()
+            .filter(|_| old_cache.info.source == Some(source));
        // Captured before `prepare_for_scan` clears the mark: only a complete
        // snapshot may stand in for a bucket whose walk stops early.
        let old_cache_certified = old_cache.info.snapshot_complete && old_cache.info.last_update.is_some();
        let current_bucket_incarnations = scanner_current_bucket_incarnations(self.as_ref(), &all_buckets).await;
+        let service_round = Arc::new(ScannerBucketServiceRound::new(DataUsageBucketServiceLedger::restore(
+            clone_cache_value(&persisted_bucket_service),
+            expected_publication_epoch,
+            all_buckets.iter().map(|bucket| bucket.name.as_str()),
+            current_bucket_incarnations.as_ref(),
+        )));
        let scoped_scan = prepare_scoped_set_scan(
            &old_cache,
            &buckets,
@@ -412,6 +423,7 @@ impl ScannerIOCache for SetDisks {
            };
            cache.info.last_update = Some(now);
            cache.info.snapshot_complete = true;
+            cache.info.scan_bucket_service = persisted_bucket_service;
            let replication_execution = super::cache::scanner_replication_execution_digest(execution_digest, &cache);
            cache.info.scan_execution_digest = Some(replication_execution);
            cache.info.segment_invalidation_proof = completed_segment_invalidation_proof;
@@ -753,6 +765,9 @@ impl ScannerIOCache for SetDisks {
                .unwrap_or_else(|poisoned| poisoned.into_inner())
                .order_buckets(source, &mut scan_order);
        }
+        // Durable age outranks both orders above; they only break its ties,
+        // so a restart cannot hand the budget back to the same first buckets.
+        service_round.order_buckets(&mut scan_order);

        for bucket in scan_order.iter() {
            if let Some(c) = old_cache.find(&bucket.name) {
@@ -790,6 +805,7 @@ impl ScannerIOCache for SetDisks {
        } in walkers
        {
            let service_cohort_clone = service_cohort.clone();
+            let service_round_clone = service_round.clone();
            let bucket_rx_mutex_clone = bucket_rx_mutex.clone();
            let bucket_tx_clone = bucket_tx.clone();
            let remaining_bucket_work_clone = remaining_bucket_work.clone();
@@ -874,6 +890,13 @@ impl ScannerIOCache for SetDisks {
                            .unwrap_or_else(|poisoned| poisoned.into_inner())
                            .record_admitted(source, &bucket.name);
                    }
+                    let (bucket_budget, scan_ctx) = budget_clone.for_bucket(&ctx_clone);
+                    work_guard.claim_service(
+                        service_round_clone.clone(),
+                        &bucket.name,
+                        ctx_clone.clone(),
+                        bucket_budget.clone(),
+                    );

                    debug!(
                        target: "rustfs::scanner::io",
@@ -915,8 +938,8 @@ impl ScannerIOCache for SetDisks {
                        remote_session_sequence = next_sequence;
                        let remote_scan = crate::remote_scanner::scan_remote_bucket(
                            &disk,
-                            ctx_clone.clone(),
-                            budget_clone.clone(),
+                            scan_ctx.clone(),
+                            bucket_budget.clone(),
                            crate::remote_scanner::RemoteScannerScanSpec {
                                bucket: &bucket.name,
                                next_cycle: want_cycle,
@@ -959,6 +982,11 @@ impl ScannerIOCache for SetDisks {
                                }
                            }
                            Ok(crate::remote_scanner::RemoteScannerOutcome::Partial) => {
+                                // A remote count budget stops on entries it does
+                                // not report back, so the partial proves no failure.
+                                if bucket_budget.max_objects().is_some() || bucket_budget.max_directories().is_some() {
+                                    work_guard.mark_service_interrupted();
+                                }
                                record_partial_dirty_bucket(&partial_dirty_buckets_clone, &bucket.name).await;
                                debug!(
                                    target: "rustfs::scanner::io",
@@ -1096,6 +1124,11 @@ impl ScannerIOCache for SetDisks {
                    };
                    #[cfg(test)]
                    super::tests::observe_coordinator_bucket_scan_admitted(worker_index, &bucket.name).await;
+                    #[cfg(test)]
+                    if super::tests::coordinator_bucket_scan_fails(&bucket.name) {
+                        record_failed_dirty_bucket(&failed_dirty_buckets_clone, &bucket.name).await;
+                        continue;
+                    }

                    // Lock order: scanner leader fence -> set-scoped per-bucket cache lock ->
                    // cache object read/write.
@@ -1331,7 +1364,7 @@ impl ScannerIOCache for SetDisks {
                    let (checkpoint_tx, mut checkpoint_rx) = mpsc::channel::<DataUsageCache>(1);
                    let (node_tx, mut node_rx) = crate::workload_admission::scanner_node_request_channel();

-                    let scan_ctx = ctx_clone.child_token();
+                    let scan_position_before = cache.durable_scan_position();
                    #[cfg(feature = "e2e-test-hooks")]
                    {
                        let disk_uuid = if crate::e2e_barrier::worker_observation::enabled() {
@@ -1351,7 +1384,7 @@ impl ScannerIOCache for SetDisks {
                    }
                    let scan = crate::workload_admission::with_scanner_node_requests(node_tx, disk.clone().nsscanner_disk(
                        scan_ctx.clone(),
-                        budget_clone.clone(),
+                        bucket_budget.clone(),
                        set_disk_inventory_clone.as_ref().clone(),
                        cache,
                        None,
@@ -1501,6 +1534,20 @@ impl ScannerIOCache for SetDisks {
                    }
                    let scan_outcome = match scan_result {
                        Ok(scan_outcome) => scan_outcome,
+                        Err(e) if bucket_budget.quantum_exhausted() => {
+                            record_partial_dirty_bucket(&partial_dirty_buckets_clone, &bucket.name).await;
+                            debug!(
+                                target: "rustfs::scanner::io",
+                                event = EVENT_SCANNER_DISK_BUCKET_STATE,
+                                component = LOG_COMPONENT_SCANNER,
+                                subsystem = LOG_SUBSYSTEM_IO,
+                                bucket = %bucket.name,
+                                state = "quantum_exhausted_without_progress",
+                                error = %e,
+                                "Scanner bucket quantum ended before durable progress"
+                            );
+                            continue;
+                        }
                        Err(e) => {
                            record_failed_dirty_bucket(&failed_dirty_buckets_clone, &bucket.name).await;
                            if ctx_clone.is_cancelled() {
@@ -1542,7 +1589,12 @@ impl ScannerIOCache for SetDisks {
                            }
                            (completed_cache, false)
                        }
-                        ScannerDiskScanOutcome::Partial(partial_cache) => (partial_cache, true),
+                        ScannerDiskScanOutcome::Partial(partial_cache) => {
+                            if partial_cache.info.scan_resource_deferred {
+                                work_guard.mark_service_interrupted();
+                            }
+                            (partial_cache, true)
+                        }
                        ScannerDiskScanOutcome::NamespaceNotFound(_) => {
                            if requeue_bucket_work(&bucket_tx_clone, &bucket, &mut work_guard).await {
                                increment_disk_bucket_scans_queued(
@@ -1566,7 +1618,6 @@ impl ScannerIOCache for SetDisks {
                        }
                    };
                    if partial {
-                        record_partial_dirty_bucket(&partial_dirty_buckets_clone, &bucket.name).await;
                        let done_save = Metrics::time(Metric::SaveUsage);
                        let partial_saved = if cache_guard.is_lock_lost() {
                            false
@@ -1604,6 +1655,21 @@ impl ScannerIOCache for SetDisks {
                        if partial_saved {
                            log_saved_partial_bucket_cache(&cache, &cache_name);
                        }
+                        // Only saved forward motion earns another turn in this
+                        // cycle; otherwise the bucket waits for the next one.
+                        if partial_saved
+                            && bucket_budget.quantum_exhausted()
+                            && cache.durable_scan_position() != scan_position_before
+                            && requeue_bucket_work(&bucket_tx_clone, &bucket, &mut work_guard).await
+                        {
+                            increment_disk_bucket_scans_queued(
+                                &queued_disk_bucket_scans_clone,
+                                &pool_label_clone,
+                                &set_label_clone,
+                            );
+                            continue;
+                        }
+                        record_partial_dirty_bucket(&partial_dirty_buckets_clone, &bucket.name).await;

                        continue;
                    }
@@ -1824,6 +1890,14 @@ impl ScannerIOCache for SetDisks {
                .await
                .extend(carried_buckets.iter().cloned());
        }
+        let service_ledger = {
+            let failed = bucket_failures.hard.lock().await;
+            let partial = bucket_failures.partial.lock().await;
+            service_round.settle(&completed_buckets, &failed, &partial)
+        };
+        if let Some(ledger) = &service_ledger {
+            record_bucket_failure_debt(source, want_cycle, ledger);
+        }
        let completed_count = completed_buckets.len();
        let covered_count = completed_count.saturating_add(carried_buckets.len());
        let coverage_complete =
@@ -1851,6 +1925,7 @@ impl ScannerIOCache for SetDisks {
            if cold_zero_walk_reuse_candidate {
                cold_zero_walk_reuse_observed.store(true, Ordering::Release);
            }
+            cache.info.scan_bucket_service = service_ledger.or(persisted_bucket_service);
            let _ = persist_and_publish_cache_snapshot(
                self.clone(),
                &updates,
@@ -1908,6 +1983,20 @@ impl ScannerIOCache for SetDisks {
                cancelled = ctx.is_cancelled(),
                "Scanner set cache publish skipped because cycle did not complete cleanly"
            );
+            // Publish the scope first: a contended cache lock must not delay it.
+            // A stopped owner leaves the set cache untouched; only a budget stop
+            // or a finished incomplete cycle hands its order to the next one.
+            if let Some(ledger) = service_ledger.filter(|_| !ctx.is_cancelled() || budget.budget_elapsed()) {
+                persist_scanner_service_ledger(
+                    self.clone(),
+                    source,
+                    ledger,
+                    want_cycle,
+                    leader_epoch,
+                    expected_publication_epoch,
+                )
+                .await;
+            }
        }

        debug!(
@@ -45,6 +45,7 @@ use time::OffsetDateTime;
 use uuid::Uuid;

 mod checkpoint_coverage_identity;
+mod cold_bucket_service;
 mod collector_lifecycle;
 mod cycle_collector_diagnostics;
 mod expiry_lock;
@@ -5176,6 +5177,35 @@ pub(super) async fn observe_coordinator_bucket_scan_admitted(worker_index: usize
    probe.active.fetch_sub(1, Ordering::SeqCst);
 }

+static FAILING_COORDINATOR_BUCKETS: std::sync::LazyLock<StdMutex<HashSet<String>>> =
+    std::sync::LazyLock::new(|| StdMutex::new(HashSet::new()));
+
+pub(super) fn coordinator_bucket_scan_fails(bucket: &str) -> bool {
+    FAILING_COORDINATOR_BUCKETS
+        .lock()
+        .unwrap_or_else(std::sync::PoisonError::into_inner)
+        .contains(bucket)
+}
+
+struct FailingCoordinatorBucket(String);
+
+impl Drop for FailingCoordinatorBucket {
+    fn drop(&mut self) {
+        FAILING_COORDINATOR_BUCKETS
+            .lock()
+            .unwrap_or_else(std::sync::PoisonError::into_inner)
+            .remove(&self.0);
+    }
+}
+
+fn fail_coordinator_bucket_scan(bucket: &str) -> FailingCoordinatorBucket {
+    FAILING_COORDINATOR_BUCKETS
+        .lock()
+        .unwrap_or_else(std::sync::PoisonError::into_inner)
+        .insert(bucket.to_string());
+    FailingCoordinatorBucket(bucket.to_string())
+}
+
 pub(super) async fn observe_coordinator_bucket_worker_started(worker_index: usize) {
    collector_lifecycle::observe_worker_start(worker_index).await;
 }
@@ -94,15 +94,15 @@ async fn checkpoint_resumes_across_a_maintenance_publication() {
    assert!(result.clear_verified_usage().is_empty());
    assert!(dirty_usage_buckets_for_tests().is_empty());

-    // Cycle 2: the written bucket is the only dirty one, so it is walked
-    // first and the object budget stops its sweep with a checkpoint; the
-    // cycle itself is incomplete.
+    // Cycle 2: the object budget stops the written bucket's sweep with a
+    // checkpoint; the cycle itself is incomplete. Service order follows the
+    // wait, so the budget leaves it two objects even behind the idle bucket.
    for object in ["p6/g", "p7/h"] {
        put_fixture_object(&store, "hot-bucket", object).await;
    }
    record_dirty_usage_bucket("hot-bucket");
    wait_for_namespace_commit_tails(store.as_ref()).await;
-    let (result, _, budget) = run_full_cycle(&store, 2, Some(2)).await;
+    let (result, _, budget) = run_full_cycle(&store, 2, Some(3)).await;
    assert_eq!(result.status, ScannerCycleStatus::Incomplete);
    assert!(budget.budget_elapsed());
    let set = Arc::clone(&store.pools[0].disk_set[0]);
@@ -0,0 +1,380 @@
+// Copyright 2026 RustFS Team
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+use super::*;
+use std::path::Path;
+
+const BUCKETS: usize = 17;
+const QUANTA: usize = 4;
+const ROUND_BOUND: usize = BUCKETS.div_ceil(QUANTA);
+const HOT: &str = "bucket-00";
+const FAILING: &str = "bucket-01";
+const ROUND_REQUEST_ENV: &str = "RUSTFS_COLD_BUCKET_SERVICE_ROUND";
+const EPOCH: u64 = 9;
+
+fn inventory() -> Vec<BucketInfo> {
+    (0..BUCKETS)
+        .map(|index| BucketInfo {
+            name: format!("bucket-{index:02}"),
+            ..Default::default()
+        })
+        .collect()
+}
+
+fn restore(persisted: Option<DataUsageBucketServiceLedger>, buckets: &[BucketInfo]) -> DataUsageBucketServiceLedger {
+    DataUsageBucketServiceLedger::restore(persisted, EPOCH, buckets.iter().map(|bucket| bucket.name.as_str()), None)
+}
+
+/// One scheduler lifetime over the production order and queue accounting.
+/// `persisted` is decoded from durable bytes; the result is encoded again.
+fn serve_round(persisted: &[u8]) -> (Vec<u8>, Vec<String>) {
+    let buckets = inventory();
+    let decoded = DataUsageCache::unmarshal(persisted).expect("decode saved order");
+    let round = Arc::new(ScannerBucketServiceRound::new(restore(decoded.info.scan_bucket_service, &buckets)));
+    let dirty = DirtyUsageBuckets::from([(HOT.to_string(), 1)]);
+    let mut order = bucket_usage_scan_order(&buckets, &DataUsageCache::default(), &dirty);
+    round.order_buckets(&mut order);
+    let served = order
+        .iter()
+        .take(QUANTA)
+        .map(|bucket| bucket.name.clone())
+        .collect::<Vec<_>>();
+    let mut completed = HashSet::new();
+    let mut failed = HashSet::new();
+    let ctx = CancellationToken::new();
+    let budget = ScannerCycleBudget::new(&ctx, Default::default());
+    for bucket in &served {
+        let mut work = BucketWorkGuard::new(Arc::new(AtomicUsize::new(2)), CancellationToken::new());
+        work.claim_service(round.clone(), bucket, ctx.clone(), budget.clone());
+        drop(work);
+        if bucket == FAILING {
+            failed.insert(bucket.clone());
+        } else {
+            completed.insert(bucket.clone());
+        }
+    }
+    let ledger = round.settle(&completed, &failed, &HashSet::new()).expect("served buckets");
+    let mut cache = DataUsageCache::default();
+    cache.info.scan_bucket_service = Some(ledger);
+    (cache.marshal_msg().expect("encode saved order"), served)
+}
+
+fn assert_service_bound(rounds: &[Vec<String>]) {
+    for bucket in inventory() {
+        let mut waited = 0;
+        for (index, served) in rounds.iter().enumerate() {
+            waited = if served.contains(&bucket.name) { 0 } else { waited + 1 };
+            assert!(waited < ROUND_BOUND, "{} waited {waited} rounds at round {index}", bucket.name);
+        }
+    }
+}
+
+#[test]
+fn cold_bucket_service_bound_holds_through_the_saved_codec() {
+    let mut saved = DataUsageCache::default().marshal_msg().expect("empty cache");
+    let mut rounds = Vec::new();
+    for _ in 0..(ROUND_BOUND * 4) {
+        let (next, served) = serve_round(&saved);
+        saved = next;
+        rounds.push(served);
+    }
+    assert_service_bound(&rounds);
+    let ledger = DataUsageCache::unmarshal(&saved)
+        .expect("decode final order")
+        .info
+        .scan_bucket_service
+        .expect("saved order");
+    let failing = ledger.buckets[FAILING];
+    assert!(failing.failure_debt >= 4, "every failed turn must stay visible: {failing:?}");
+    assert_eq!(failing.last_certified, None, "failure is not certification");
+    assert!(failing.service_quanta >= 4, "a failing bucket still spends real turns");
+    assert_eq!(ledger.failure_debt(), (1, Some(FAILING)));
+    assert_eq!(ledger.buckets[HOT].failure_debt, 0);
+    let hot_quanta = ledger.buckets[HOT].service_quanta;
+    assert!(
+        ledger
+            .buckets
+            .values()
+            .all(|service| service.service_quanta.abs_diff(hot_quanta) <= 1),
+        "a hot bucket must not earn more turns than a cold one: {ledger:?}"
+    );
+}
+
+/// The driver and each round are separate OS processes, so the only carrier
+/// between rounds is the saved cache file.
+#[test]
+fn cold_bucket_service_bound_holds_across_fresh_os_processes() {
+    let temp = tempfile::tempdir().expect("fixture directory");
+    let order = temp.path().join("order.bin");
+    std::fs::write(&order, DataUsageCache::default().marshal_msg().expect("empty cache")).expect("seed order");
+    let test = format!(
+        "{}::cold_bucket_service_process_round_worker",
+        module_path!().split_once("::").expect("crate path").1
+    );
+    let binary = std::env::current_exe().expect("test binary");
+    let listed = std::process::Command::new(&binary)
+        .args([test.as_str(), "--exact", "--list"])
+        .output()
+        .expect("list worker");
+    assert!(
+        String::from_utf8_lossy(&listed.stdout).contains(&format!("{test}: test")),
+        "the restart driver must select a real worker"
+    );
+    let mut rounds = Vec::new();
+    let mut pids = HashSet::new();
+    for round in 0..(ROUND_BOUND * 2) {
+        let status = std::process::Command::new(&binary)
+            .args([test.as_str(), "--exact", "--test-threads=1"])
+            .env(ROUND_REQUEST_ENV, &order)
+            .stdout(std::process::Stdio::null())
+            .status()
+            .expect("start worker round");
+        assert!(status.success(), "worker round {round} failed");
+        let report = std::fs::read_to_string(order.with_extension("served")).expect("worker report");
+        let (pid, served) = report.split_once('\n').expect("worker report shape");
+        assert!(pids.insert(pid.to_string()), "round {round} reused a process");
+        rounds.push(served.lines().map(str::to_owned).collect::<Vec<_>>());
+    }
+    assert_service_bound(&rounds);
+}
+
+#[test]
+fn cold_bucket_service_process_round_worker() {
+    let Some(order) = std::env::var_os(ROUND_REQUEST_ENV) else {
+        let empty = DataUsageCache::default().marshal_msg().expect("empty cache");
+        assert_eq!(serve_round(&empty).1.len(), QUANTA);
+        return;
+    };
+    let order = Path::new(&order);
+    let (saved, served) = serve_round(&std::fs::read(order).expect("read saved order"));
+    std::fs::write(order, saved).expect("save order");
+    std::fs::write(order.with_extension("served"), format!("{}\n{}", std::process::id(), served.join("\n")))
+        .expect("write worker report");
+}
+
+#[test]
+fn cold_bucket_service_new_bucket_joins_behind_existing_waiters() {
+    let buckets = inventory();
+    let mut ledger = restore(None, &buckets);
+    ledger.record_service("bucket-00");
+    let with_new = buckets
+        .iter()
+        .cloned()
+        .chain([BucketInfo {
+            name: "a-new-bucket".to_string(),
+            ..Default::default()
+        }])
+        .collect::<Vec<_>>();
+    let ledger = restore(Some(ledger), &with_new);
+    let mut order = with_new;
+    order.sort_by(|left, right| left.name.cmp(&right.name));
+    ScannerBucketServiceRound::new(ledger.clone()).order_buckets(&mut order);
+    assert_eq!(order[0].name, "bucket-01", "a stream of new buckets must not displace waiters");
+    let arrival = ledger.buckets["a-new-bucket"].waiting_since;
+    assert!(arrival > ledger.buckets["bucket-01"].waiting_since);
+    assert!(
+        arrival < ledger.buckets["bucket-00"].waiting_since,
+        "an arrival must not wait behind a bucket that already had its turn"
+    );
+}
+
+#[test]
+fn cold_bucket_service_scope_change_invalidates_the_saved_order() {
+    let buckets = inventory();
+    let mut ledger = restore(None, &buckets);
+    ledger.record_service(FAILING);
+    ledger.record_failure(FAILING);
+
+    let moved = DataUsageBucketServiceLedger::restore(
+        Some(ledger.clone()),
+        EPOCH + 1,
+        buckets.iter().map(|bucket| bucket.name.as_str()),
+        None,
+    );
+    assert_eq!(moved.publication_epoch, EPOCH + 1);
+    assert_eq!(moved.buckets[FAILING].failure_debt, 0, "another movement epoch starts a new order");
+
+    let mut corrupt = ledger.clone();
+    corrupt.next_sequence = 0;
+    let rebuilt = restore(Some(corrupt), &buckets);
+    assert_eq!(rebuilt.buckets[FAILING].service_quanta, 0, "an impossible wait position is not trusted");
+
+    let remaining = restore(Some(ledger.clone()), &buckets[..1]);
+    assert_eq!(remaining.buckets.len(), 1, "a deleted bucket leaves the order");
+}
+
+#[test]
+fn cold_bucket_service_recreated_bucket_loses_its_old_standing() {
+    let buckets = inventory();
+    let first = Uuid::from_u128(1);
+    let incarnations = HashMap::from([(FAILING.to_string(), first)]);
+    let names = || buckets.iter().map(|bucket| bucket.name.as_str());
+    let mut ledger = DataUsageBucketServiceLedger::restore(None, EPOCH, names(), Some(&incarnations));
+    ledger.record_failure(FAILING);
+    let same = DataUsageBucketServiceLedger::restore(Some(ledger.clone()), EPOCH, names(), Some(&incarnations));
+    assert_eq!(same.buckets[FAILING].failure_debt, 1);
+
+    let unknown = DataUsageBucketServiceLedger::restore(Some(ledger.clone()), EPOCH, names(), None);
+    assert_eq!(
+        unknown.buckets[FAILING].incarnation,
+        Some(first),
+        "a transient identity gap must not erase debt"
+    );
+
+    let recreated = HashMap::from([(FAILING.to_string(), Uuid::from_u128(2))]);
+    let replaced = DataUsageBucketServiceLedger::restore(Some(ledger), EPOCH, names(), Some(&recreated));
+    assert_eq!(replaced.buckets[FAILING].failure_debt, 0, "a recreated bucket does not inherit debt");
+    assert_eq!(replaced.buckets[FAILING].incarnation, Some(Uuid::from_u128(2)));
+}
+
+#[test]
+fn cold_bucket_service_budget_stop_and_resource_veto_add_no_debt() {
+    let buckets = inventory();
+    let ledger = restore(None, &buckets);
+    let before = ledger.buckets["bucket-02"].waiting_since;
+    let round = Arc::new(ScannerBucketServiceRound::new(ledger));
+    let ctx = CancellationToken::new();
+    let budget = ScannerCycleBudget::new(&ctx, Default::default());
+    let work = || BucketWorkGuard::new(Arc::new(AtomicUsize::new(2)), CancellationToken::new());
+
+    let mut vetoed = work();
+    vetoed.claim_service(round.clone(), "bucket-02", ctx.clone(), budget.clone());
+    vetoed.mark_requeued();
+    drop(vetoed);
+
+    let mut stopped = work();
+    stopped.claim_service(round.clone(), "bucket-03", ctx, budget.clone());
+    budget.cancel_for_runtime();
+    drop(stopped);
+
+    let names = |names: &[&str]| names.iter().map(|name| name.to_string()).collect::<HashSet<_>>();
+    let ledger = round
+        .settle(&HashSet::new(), &names(&["bucket-02", "bucket-03"]), &HashSet::new())
+        .expect("one bucket was served");
+    assert_eq!(ledger.buckets["bucket-02"].waiting_since, before, "a veto hands the turn back");
+    assert_eq!(ledger.buckets["bucket-02"].service_quanta, 0);
+    assert_eq!(ledger.buckets["bucket-03"].service_quanta, 1, "the budget was really spent");
+    assert_eq!(ledger.failure_debt(), (0, None), "budget-cancelled work is progress-only");
+}
+
+#[tokio::test]
+async fn cold_bucket_service_requeue_cannot_undo_the_next_workers_claim() {
+    let buckets = inventory();
+    let ledger = restore(None, &buckets);
+    let before = ledger.buckets["bucket-02"].waiting_since;
+    let round = Arc::new(ScannerBucketServiceRound::new(ledger));
+    let ctx = CancellationToken::new();
+    let budget = ScannerCycleBudget::new(&ctx, Default::default());
+    let work = || BucketWorkGuard::new(Arc::new(AtomicUsize::new(2)), CancellationToken::new());
+    let (bucket_tx, mut bucket_rx) = tokio::sync::mpsc::channel(1);
+
+    let mut first = work();
+    first.claim_service(round.clone(), "bucket-02", ctx.clone(), budget.clone());
+    assert!(requeue_bucket_work(&bucket_tx, &buckets[2], &mut first).await);
+
+    // The next worker takes the bucket while the first guard is still alive.
+    bucket_rx.recv().await.expect("requeued bucket");
+    let mut second = work();
+    second.claim_service(round.clone(), "bucket-02", ctx, budget);
+    drop(first);
+    drop(second);
+
+    let completed = HashSet::from(["bucket-02".to_string()]);
+    let ledger = round
+        .settle(&completed, &HashSet::new(), &HashSet::new())
+        .expect("the second claim served the bucket");
+    let service = &ledger.buckets["bucket-02"];
+    assert!(service.waiting_since > before, "the completed bucket returns to the tail");
+    assert_eq!(service.service_quanta, 1, "only the completed turn counts");
+}
+
+#[test]
+fn cold_bucket_service_partial_resource_veto_adds_no_debt() {
+    let buckets = inventory();
+    let round = Arc::new(ScannerBucketServiceRound::new(restore(None, &buckets)));
+    let ctx = CancellationToken::new();
+    let budget = ScannerCycleBudget::new(&ctx, Default::default());
+    let work = || BucketWorkGuard::new(Arc::new(AtomicUsize::new(2)), CancellationToken::new());
+
+    let mut vetoed = work();
+    vetoed.claim_service(round.clone(), "bucket-02", ctx.clone(), budget.clone());
+    vetoed.mark_service_interrupted();
+    drop(vetoed);
+    let mut failed = work();
+    failed.claim_service(round.clone(), "bucket-03", ctx, budget);
+    drop(failed);
+
+    let partial = HashSet::from(["bucket-02".to_string(), "bucket-03".to_string()]);
+    let ledger = round
+        .settle(&HashSet::new(), &HashSet::new(), &partial)
+        .expect("two buckets were served");
+    assert_eq!(ledger.buckets["bucket-02"].failure_debt, 0, "a resource block is not a failure");
+    assert_eq!(ledger.buckets["bucket-03"].failure_debt, 1, "an uninterrupted partial stays visible");
+}
+
+#[test]
+fn cold_bucket_service_resource_deferral_marker_is_never_persisted() {
+    let mut cache = DataUsageCache::default();
+    cache.info.name = DATA_USAGE_ROOT.to_string();
+    cache.info.scan_resource_deferred = true;
+    let decoded = DataUsageCache::unmarshal(&cache.marshal_msg().expect("encode")).expect("decode");
+    assert!(!decoded.info.scan_resource_deferred);
+}
+
+#[test]
+fn cold_bucket_service_order_is_an_optional_map_field_for_old_readers() {
+    #[derive(serde::Deserialize)]
+    struct LegacyInfo {
+        name: String,
+        next_cycle: u64,
+    }
+    #[derive(serde::Deserialize)]
+    struct LegacyCache {
+        info: LegacyInfo,
+        #[serde(rename = "cache")]
+        _cache: serde::de::IgnoredAny,
+    }
+    let mut cache = DataUsageCache::default();
+    cache.info.name = DATA_USAGE_ROOT.to_string();
+    cache.info.next_cycle = 7;
+    let absent = cache.marshal_msg().expect("encode cache");
+    let field = b"scan_bucket_service";
+    assert!(
+        !absent.windows(field.len()).any(|window| window == field),
+        "an unused order must not change the encoded cache"
+    );
+
+    let buckets = inventory();
+    let mut ledger = restore(None, &buckets);
+    ledger.record_service(FAILING);
+    ledger.record_failure(FAILING);
+    cache.info.scan_bucket_service = Some(ledger.clone());
+    let encoded = cache.marshal_msg().expect("encode order");
+    let legacy: LegacyCache = rmp_serde::from_slice(&encoded).expect("old readers must ignore the order");
+    assert_eq!((legacy.info.name.as_str(), legacy.info.next_cycle), (DATA_USAGE_ROOT, 7));
+    assert_eq!(
+        DataUsageCache::unmarshal(&encoded)
+            .expect("decode order")
+            .info
+            .scan_bucket_service,
+        Some(ledger)
+    );
+    assert!(
+        DataUsageCache::unmarshal(&absent)
+            .expect("decode a cache from an older writer")
+            .info
+            .scan_bucket_service
+            .is_none()
+    );
+}
@@ -337,3 +337,221 @@ async fn service_cohort_cancelled_dispatch_does_not_consume_waiters_or_leak_perm
    assert_eq!(usage.expect("retry aggregate").objects_total_count, 2);
    clear_dirty_usage_buckets_for_tests();
 }
+
+/// N=17, q=4: every bucket reaches a worker within ceil(17/4)=5 rounds while
+/// one bucket stays hot and another fails forever, with leader-local state
+/// discarded after each round as a restart would.
+#[tokio::test]
+#[serial]
+async fn cold_bucket_service_bound_survives_restart_with_hot_and_failing_bucket() {
+    const BUCKETS: usize = 17;
+    const QUANTA: u64 = 4;
+    const ROUND_BOUND: usize = 5;
+    let (_dir, store) = setup_local_scanner_store(1, 4).await;
+    clear_dirty_usage_buckets_for_tests();
+    let names = (0..BUCKETS).map(|index| format!("cold-{index:02}")).collect::<Vec<_>>();
+    for name in &names {
+        create_cohort_bucket(&store, name).await;
+    }
+    let hot = names[0].clone();
+    let _failing = fail_coordinator_bucket_scan(&names[1]);
+    let mut waited = [0_usize; BUCKETS];
+    for round in 1..=(ROUND_BOUND * 3) {
+        record_dirty_usage_bucket(&hot);
+        let cohort = Arc::new(StdMutex::new(ScannerServiceCohort::default()));
+        let ctx = CancellationToken::new();
+        let budget = ScannerCycleBudget::new_with_progress_tracking(
+            &ctx,
+            ScannerCycleBudgetConfig {
+                max_objects: Some(QUANTA),
+                ..Default::default()
+            },
+        );
+        run_cohort_cycle(&store, cohort.clone(), u64::try_from(round).expect("round"), budget).await;
+        let admitted = cohort
+            .lock()
+            .expect("cohort lock")
+            .admitted_members()
+            .into_iter()
+            .map(|(_, bucket)| bucket)
+            .collect::<HashSet<_>>();
+        for (index, name) in names.iter().enumerate() {
+            waited[index] = if admitted.contains(name) { 0 } else { waited[index] + 1 };
+            assert!(
+                waited[index] < ROUND_BOUND,
+                "{name} waited {} rounds at round {round}; admitted {admitted:?}",
+                waited[index]
+            );
+        }
+    }
+    let saved = load_set_cache(&store).await;
+    let ledger = saved
+        .info
+        .scan_bucket_service
+        .expect("incomplete cycles must save the service order");
+    assert!(ledger.buckets[&names[1]].failure_debt > 0, "the failing bucket must keep visible debt");
+    assert_eq!(ledger.buckets[&names[1]].last_certified, None);
+    assert_eq!(ledger.failure_debt().0, 1, "only the failing bucket owes a sweep");
+    assert!(!saved.info.snapshot_complete, "the saved order must not certify the set");
+    clear_dirty_usage_buckets_for_tests();
+}
+
+async fn load_set_cache(store: &Arc<ECStore>) -> DataUsageCache {
+    let mut cache = DataUsageCache::default();
+    cache
+        .load(store.all_set_disks()[0].clone(), DATA_USAGE_CACHE_NAME)
+        .await
+        .expect("load set cache");
+    cache
+}
+
+fn quantum_budget(quantum: crate::scanner_budget::ScannerBucketQuantum) -> Arc<ScannerCycleBudget> {
+    ScannerCycleBudget::new_with_progress_tracking(
+        &CancellationToken::new(),
+        ScannerCycleBudgetConfig {
+            bucket_quantum: Some(quantum),
+            ..Default::default()
+        },
+    )
+}
+
+#[tokio::test]
+#[serial]
+async fn fair_prefix_quantum_spent_bucket_returns_behind_waiting_buckets() {
+    let (_dir, store) = setup_local_scanner_store(1, 4).await;
+    clear_dirty_usage_buckets_for_tests();
+    create_cohort_bucket_objects(&store, "a-flat", 6).await;
+    create_cohort_bucket(&store, "z-cold-one").await;
+    create_cohort_bucket(&store, "z-cold-two").await;
+    let cohort = Arc::new(StdMutex::new(ScannerServiceCohort::default()));
+    let budget = quantum_budget(crate::scanner_budget::ScannerBucketQuantum {
+        max_objects: Some(2),
+        ..Default::default()
+    });
+    let (result, usage) = run_cohort_cycle(&store, cohort, 1, budget.clone()).await;
+    assert_eq!(result.status, ScannerCycleStatus::Complete, "shares must add up to one whole sweep");
+    assert_eq!(usage.expect("complete aggregate").objects_total_count, 8);
+    assert!(!budget.budget_elapsed(), "only the bucket shares ended");
+
+    let ledger = load_set_cache(&store).await.info.scan_bucket_service.expect("saved order");
+    assert!(ledger.buckets["a-flat"].service_quanta >= 3, "{ledger:?}");
+    assert_eq!(ledger.buckets["z-cold-one"].service_quanta, 1, "{ledger:?}");
+    assert_eq!(ledger.buckets["z-cold-two"].service_quanta, 1, "{ledger:?}");
+    assert!(
+        ledger.buckets["a-flat"].waiting_since > ledger.buckets["z-cold-two"].waiting_since,
+        "the wide bucket must finish behind the buckets it yielded to: {ledger:?}"
+    );
+    assert_eq!(ledger.failure_debt(), (0, None), "a spent share is not a failure");
+    clear_dirty_usage_buckets_for_tests();
+}
+
+#[tokio::test]
+#[serial]
+async fn fair_prefix_quantum_without_durable_motion_ends_the_bucket_turn() {
+    let (_dir, store) = setup_local_scanner_store(1, 4).await;
+    clear_dirty_usage_buckets_for_tests();
+    create_cohort_bucket_objects(&store, "a-flat", 6).await;
+    let cohort = Arc::new(StdMutex::new(ScannerServiceCohort::default()));
+    let budget = quantum_budget(crate::scanner_budget::ScannerBucketQuantum {
+        max_duration: Some(Duration::ZERO),
+        ..Default::default()
+    });
+    let (result, usage) = run_cohort_cycle(&store, cohort, 1, budget).await;
+    assert_eq!(result.status, ScannerCycleStatus::Incomplete);
+    assert!(usage.is_none());
+    let ledger = load_set_cache(&store).await.info.scan_bucket_service.expect("saved order");
+    assert_eq!(
+        ledger.buckets["a-flat"].service_quanta, 1,
+        "a share that saved nothing must not requeue itself: {ledger:?}"
+    );
+    assert_eq!(ledger.failure_debt(), (0, None));
+    clear_dirty_usage_buckets_for_tests();
+}
+
+/// A one-object share stops inside its first child, so the frontier never
+/// moves. Requeuing that bucket would spin until the cycle deadline.
+#[tokio::test]
+#[serial]
+async fn fair_prefix_quantum_repeated_share_without_a_new_frontier_stops_requeuing() {
+    let (_dir, store) = setup_local_scanner_store(1, 4).await;
+    clear_dirty_usage_buckets_for_tests();
+    create_cohort_bucket_objects(&store, "a-flat", 3).await;
+    let cohort = Arc::new(StdMutex::new(ScannerServiceCohort::default()));
+    let budget = quantum_budget(crate::scanner_budget::ScannerBucketQuantum {
+        max_objects: Some(1),
+        ..Default::default()
+    });
+    let (result, usage) = run_cohort_cycle(&store, cohort, 1, budget).await;
+    assert_eq!(result.status, ScannerCycleStatus::Incomplete);
+    assert!(usage.is_none());
+    let ledger = load_set_cache(&store).await.info.scan_bucket_service.expect("saved order");
+    assert!(
+        ledger.buckets["a-flat"].service_quanta <= 3,
+        "turns without durable motion must end: {ledger:?}"
+    );
+    assert_eq!(ledger.failure_debt(), (0, None));
+    clear_dirty_usage_buckets_for_tests();
+}
+
+#[tokio::test]
+#[serial]
+async fn cold_bucket_service_saved_order_keeps_coverage_and_rejects_older_owners() {
+    let (_dir, store) = setup_local_scanner_store(1, 4).await;
+    clear_dirty_usage_buckets_for_tests();
+    create_cohort_bucket(&store, "cold-only").await;
+    let ctx = CancellationToken::new();
+    let cohort = Arc::new(StdMutex::new(ScannerServiceCohort::default()));
+    let (result, _) = run_cohort_cycle(&store, cohort, 3, ScannerCycleBudget::new(&ctx, Default::default())).await;
+    assert_eq!(result.status, ScannerCycleStatus::Complete);
+    let certified = load_set_cache(&store).await;
+    assert!(certified.info.snapshot_complete);
+    let set = store.all_set_disks()[0].clone();
+    let epoch = scanner_publication_epoch(set.clone()).await.expect("publication epoch");
+    let source = DataUsageCacheSource::new(set.pool_index, set.set_index);
+    let mut ledger = certified.info.scan_bucket_service.clone().expect("saved order");
+    ledger.next_sequence += 1;
+    ledger.leader_epoch = 11;
+
+    assert!(persist_scanner_service_ledger(set.clone(), source, ledger.clone(), 3, 11, epoch).await);
+    let saved = load_set_cache(&store).await;
+    assert_eq!(saved.info.scan_bucket_service.as_ref(), Some(&ledger));
+    assert_eq!(saved.info.snapshot_complete, certified.info.snapshot_complete);
+    assert_eq!(saved.info.scan_plan_digest, certified.info.scan_plan_digest);
+    assert_eq!(saved.info.scan_execution_digest, certified.info.scan_execution_digest);
+    assert_eq!(saved.info.next_cycle, certified.info.next_cycle);
+    assert_eq!(saved.info.leader_epoch, certified.info.leader_epoch);
+    assert_eq!(saved.cache.len(), certified.cache.len());
+
+    let mut stale = ledger.clone();
+    stale.next_sequence += 1;
+    assert!(
+        !persist_scanner_service_ledger(set.clone(), source, stale.clone(), 3, 10, epoch).await,
+        "a late write from an older leader must not replace the order"
+    );
+    assert!(
+        !persist_scanner_service_ledger(set.clone(), source, stale, 2, 11, epoch).await,
+        "a late write from an older cycle must not replace the order"
+    );
+    assert_eq!(load_set_cache(&store).await.info.scan_bucket_service.as_ref(), Some(&ledger));
+
+    // An incomplete save leaves the cache stamps at epoch 11, so only the order
+    // itself can reject the leader it replaced.
+    let mut newer = ledger.clone();
+    newer.next_sequence += 1;
+    assert!(persist_scanner_service_ledger(set.clone(), source, newer.clone(), 3, 12, epoch).await);
+    let saved = load_set_cache(&store).await;
+    assert_eq!(saved.info.leader_epoch, certified.info.leader_epoch);
+    assert!(
+        !persist_scanner_service_ledger(set.clone(), source, ledger.clone(), 3, 11, epoch).await,
+        "a late write must not replace an order saved by a newer leader"
+    );
+    assert_eq!(
+        load_set_cache(&store)
+            .await
+            .info
+            .scan_bucket_service
+            .map(|saved| saved.next_sequence),
+        Some(newer.next_sequence)
+    );
+    clear_dirty_usage_buckets_for_tests();
+}
@@ -0,0 +1,49 @@
+# Event-class drills and retained evidence
+
+**Use this when:** you need to confirm that a CI event class has been exercised end to end, locate its retained run evidence, or repeat the drill. **Source of truth:** the live `main` ruleset for required status; `.github/workflows/ci.yml` for event triggers; `scripts/ci_gate.py` for per-event selection and expected results; the run URLs below for observed outcomes.
+
+Every event class the planner serves must have at least one reviewable drill: an actual run whose plan, job set and gate result can be re-inspected. A drill proves the wiring for that event, not product quality and not a cost saving. Static fixtures in `scripts/test_ci_plan.py` and `scripts/test_ci_merge_queue.py` cover the negative cases (missing, cancelled, mismatched, combined-candidate conflicts) and are not substitutes for the live drills listed here.
+
+## Event classes and expected selection
+
+| Event | Selection | Expected gate behavior |
+|---|---|---|
+| `pull_request` (ordinary code) | reverse-dependency closure + fixed core inventory; shared/unknown inputs expand to full | `Test and Lint` requires exactly the planned job results |
+| `pull_request` (documentation only) | `docs` mode: no code jobs | Quick Checks and Typos run; expensive jobs are required **skipped** |
+| `pull_request` (isolated E2E) | `e2e` mode: workspace + server build + E2E smoke + S3 lanes | Connect boundary, serial ILM, protocol/rio-v2, real io_uring required **skipped** |
+| `pull_request` (closed) | `Cancel Closed PR Runs` only | in-flight validation for that PR is cancelled; no new validation is claimed |
+| `pull_request` (merged) | entry into `merge_group` | combined candidate is validated as its own SHA/tree with the full matrix |
+| `push` to `main` | full | complete validation; no reuse inferred from tree equality |
+| `push` of a release tag | `build.yml` release matrix | build and publication path (not the PR planner) |
+| `schedule` | registry-selected cadence plan | suites run under their resource locks; failures feed the health monitors |
+| `workflow_dispatch` | full unless an explicit narrow input is passed | manual runs without a plan stay visible as unverified |
+| `workflow_run` | monitor/filter through the responsibility registry | independent health layer reports expected SHA, attempt and evidence completeness |
+
+## Retained evidence index
+
+Run URLs are `https://github.com/rustfs/rustfs/actions/runs/<id>`. Re-open the run and its `Select CI scope` job log to read the planner's recorded mode, reasons and expected job results.
+
+| Class | Drill | Run | Observed |
+|---|---|---|---|
+| Ordinary PR | `test(heal): align cleanup tests with removal-disabled heals` | [41153190859](https://github.com/rustfs/rustfs/actions/runs/41153190859) | full scope (12 real jobs: workspace build/tests, E2E, S3, core contract, io_uring); gate accepted exact planned results |
+| PR closed | `test(heal): align cleanup tests…` closure handler | [41160735383](https://github.com/rustfs/rustfs/actions/runs/41160735383) | only `Cancel Closed PR Runs` executed; every validation job required **skipped** |
+| `push` to `main` | `chore(deps): refresh workspace dependencies (#9080)` | [41160768241](https://github.com/rustfs/rustfs/actions/runs/41160768241) | full matrix on the merge commit; no selection shortcut |
+| Release tag | `1.0.4` | [40198812318](https://github.com/rustfs/rustfs/actions/runs/40198812318) | `Build and Release` release matrix succeeded on the tag ref |
+| `schedule` | `Functional chain health` | [41159991473](https://github.com/rustfs/rustfs/actions/runs/41159991473) | monitor refused to advance freshness on an incomplete chain attempt (failure is the expected answer while the chain is unhealthy) |
+| `workflow_dispatch` | manual full validation | [41152382212](https://github.com/rustfs/rustfs/actions/runs/41152382212) | full suite set ran and the aggregate accepted the complete plan (85 min) |
+| `workflow_run` | `Scheduled Validation Watchdog` | [41161431618](https://github.com/rustfs/rustfs/actions/runs/41161431618) | independent filter/monitor path executed against the registry |
+| `merge_group` | first queued candidate after queue enablement | see below | live evidence attached after the first queue entry completes |
+| Documentation-only PR | PR #9088, this document's own PR | [41162871854](https://github.com/rustfs/rustfs/actions/runs/41162871854) | `docs` mode: `Select CI scope` recorded `mode: docs`; `Test and Lint` accepted in 8 s with every expensive job required **skipped** |
+| Isolated E2E PR | PR #9089, comment-only change under `crates/e2e_test/src/` | [41163203959](https://github.com/rustfs/rustfs/actions/runs/41163203959) | `e2e` mode: Connect boundary, serial ILM, rio-v2/protocol lanes and real io_uring required **skipped**; workspace build, E2E and both S3 lanes retained |
+
+## Repeating a drill
+
+Ordinary, docs and E2E classes: open a pull request containing only that class's paths and inspect `Select CI scope` → the planner's `mode` and `reasons`, then the aggregate's expected-vs-actual comparison. Close the PR without merging to leave no product change; the closure handler itself is the closed-event drill.
+
+Merge-group class: queue a pull request through the enabled `merge_queue` rule (see [verification plans and artifacts](ci-verification-pipeline.md) for the switch record and rollback payload). The `merge_group` run validates the combined candidate's own SHA/tree. Two individually passing changes whose combination fails stay blocked until their combined candidate passes; that negative case is fixed in `scripts/test_ci_merge_queue.py`.
+
+Schedule and `workflow_run` classes cannot be forced on demand without an event; use the retained runs above and the registry's own `python3 scripts/validation_registry.py check` output. Tag class requires a real tag push; use the retained release runs or the preview-tag rehearsal described in [CI gate matrix](ci-gates.md).
+
+## Boundaries
+
+A completed drill is evidence that the event wiring behaves as planned for that candidate. It is not release certification, not a latency or cost result (use [CI timing samples](ci-timing.md) and [resource accounting](ci-resource-accounting.md)), and not a substitute for the required checks' own product coverage. Do not edit this file to claim a drill that has no run URL; attach the run first.
@@ -18,7 +18,7 @@ Every PR enters `ci.yml`. The `classify-changes` job uses the base revision of `

 PRs changing only Rust sources under `crates/e2e_test/src/` and known E2E selection digests (optionally with those documentation paths) use the `e2e` scope. They keep workspace validation, the server build, E2E smoke, and both S3 lanes; independent workflows retain their path selection. Connect boundary, serial ILM, optional protocol/rio-v2, and real io_uring jobs are skipped because their sources and test inputs are unchanged. Manifests, fixtures, shared nextest configuration, scripts, production sources, and unknown paths still select `full`. A dependency on `e2e_test` from another workspace member or reachable local dependency disables this shortcut. All non-PR events retain their full selection. The structured planner enforces affected-package and Connect selection from the trusted base policy, retaining fixed core coverage and full validation for shared or unknown inputs. See [verification plans and artifacts](ci-verification-pipeline.md) for identity, rollout and queue-switch contracts.

-Alternate-feature unit tests and Clippy for rio-v2, Swift, SFTP, and HTTP/3 run on merge groups and on scheduled (nightly) or manual validation. PRs and main pushes run the default workspace and retain ILM, S3, real io_uring, and Connect security boundaries in their applicable scopes. The aggregate requires the alternate-feature jobs to be skipped on PRs and main pushes and successful on merge-group, scheduled, and manual events. This avoids repeating four feature builds on every PR revision and on every merge; feature-specific regressions are detected by the nightly run when the merge queue is not used. For changes to these features, dispatch `ci.yml` against the candidate branch before merging when that signal is needed, including PRs targeting `gateway/integration`, which has no automatic push trigger in this workflow. Scheduled results supplement the main baseline and do not replace it.
+Specialized boundary, hardware and alternate-feature lanes run only on the scheduled (nightly) and manual full-validation runs: `Connect Feature Boundaries`, `io_uring Integration (real)`, and the rio-v2, Swift, SFTP and HTTP/3 feature lanes. They do not gate a merge. The nightly run reports their regressions within a day, and repeating these builds on every PR revision and merge group bought no earlier signal worth the runner occupancy (Connect alone measured 53.5 median minutes per run and occasionally set the wall). PRs, merge groups and main pushes run the default workspace and retain ILM, S3, E2E smoke, the short core contract and the debug build. The aggregate requires the specialized lanes to be skipped on pull-request, merge-group and push events and successful on scheduled and manual events. For changes to these features, dispatch `ci.yml` against the candidate branch before merging when that signal is needed, including PRs targeting `gateway/integration`, which has no automatic push trigger in this workflow. Scheduled results supplement the main baseline and do not replace it.

 Workspace Clippy runs on every event with a selected workspace Rust job, pull requests included, in `Workspace Lint and Build`. That job also creates the exact test archive and runs doctests; `Workspace tests` consumes the archive without rebuilding it. `cache-warm.yml` warms Clippy's check artifacts under `ci-dev` with the same invocation to reuse compatible dependency artifacts. `make pre-commit` does not run Clippy. Select local Clippy targets, features, and documentation exemptions from the root `AGENTS.md` verification tier; the workspace command below reproduces the CI lane and is not a universal pre-push requirement.

@@ -50,13 +50,13 @@ The four site-replication state-writer concurrency proofs reserve the available
 | Event | Check name | Workflow / job | Merge status | Reproduce |
 |---|---|---|---|---|
 | PR, non-doc change | `Quick Checks` | `ci.yml` `quick-checks` | Required | `make pre-commit` |
-| PR, non-doc change, and every non-PR event | `Workspace Lint and Build`, `Workspace tests` | `ci.yml` `test-and-lint` / `workspace-tests` | Via aggregate | `cargo clippy --all-targets -- -D warnings`; `cargo nextest run --profile ci --all --exclude e2e_test`; `cargo test --all --exclude e2e_test --doc`; migration evidence check described below |
+| PR, non-doc change, and every non-PR event | `Workspace Lint and Build`, `Workspace tests` | `ci.yml` `workspace-lint-and-build` / `workspace-tests` | Via aggregate | `cargo clippy --all-targets -- -D warnings`; `cargo nextest run --profile ci --all --exclude e2e_test`; `cargo test --all --exclude e2e_test --doc`; migration evidence check described below |
 | PR, non-doc change | `Typos` | `ci.yml` `typos` | Via aggregate | `typos` |
 | Full selection | `Workspace tests` (serial ILM step) | `ci.yml` `workspace-tests` | Via aggregate | exact `Run ignored ILM integration tests serially` command in the job |
-| Merge group, nightly schedule, manual dispatch | `Test and Lint (rio-v2)`, `Test and Lint (swift)`, `Test and Lint (sftp)`, `Test and Lint (http3)` | `ci.yml` `test-and-lint-rio-v2`, `test-and-lint-protocols` | Via aggregate on these events; skipped on PRs and main pushes | `cargo nextest run` with the job's `--features` |
-| PR, full selection | `Connect Feature Boundaries` | `ci.yml` `connect-feature-boundaries` | Via aggregate | `cargo test -p rustfs --test connect_registration --features connect-e2e-short-credentials`; `cargo check -p rustfs --release --features connect-e2e-short-credentials` must fail; `scripts/check_offline_enrollment_e2e.sh` |
+| Nightly schedule, manual dispatch | `Test and Lint (rio-v2)`, `Test and Lint (swift)`, `Test and Lint (sftp)`, `Test and Lint (http3)` | `ci.yml` `test-and-lint-rio-v2`, `test-and-lint-protocols` | Via aggregate on these events; skipped on PRs, merge groups and main pushes | `cargo nextest run` with the job's `--features` |
+| Nightly schedule, manual dispatch, full selection | `Connect Feature Boundaries` | `ci.yml` `connect-feature-boundaries` | Via aggregate on these events; skipped on PRs, merge groups and main pushes | `cargo test -p rustfs --test connect_registration --features connect-e2e-short-credentials`; `cargo check -p rustfs --release --features connect-e2e-short-credentials` must fail; `scripts/check_offline_enrollment_e2e.sh` |
 | PR, non-doc change | `Build RustFS Debug Binary` | `ci.yml` `build-rustfs-debug-binary` | Via aggregate; prerequisite for black-box jobs | `python3 scripts/e2e_binary.py build --bins --features e2e-test-hooks` (binary plus its `rustfs.e2e.json` sidecar) |
-| PR, full selection | `io_uring Integration (real)` | `ci.yml` `uring-integration` | Via aggregate | `cargo test -p rustfs-ecstore --lib uring_ -- --test-threads=1 --nocapture` |
+| Nightly schedule, manual dispatch, full selection | `io_uring Integration (real)` | `ci.yml` `uring-integration` | Via aggregate on these events; skipped on PRs, merge groups and main pushes | `cargo test -p rustfs-ecstore --lib uring_ -- --test-threads=1 --nocapture` |
 | PR, non-doc change | `End-to-End Tests` | `ci.yml` `e2e-tests` | Via aggregate | `python3 scripts/e2e_binary.py run --features e2e-test-hooks -- cargo nextest run --profile e2e-smoke -p e2e_test`, then `./scripts/e2e-run.sh ./target/debug/rustfs <data-dir>` under the same wrapper; membership guards `scripts/check_test_wiring.py --check-profile e2e-smoke <listing.json>` and `scripts/check_security_smoke_count.sh check <listing.json>` |
 | PR, non-doc change | `Core contract` | `ci.yml` `core-contract` | Via aggregate | existing write/read, anonymous denial and restart-byte tests via `core-contract` profile and the E2E archive |
 | PR, non-doc change | `S3 Implemented Tests` | `ci.yml` `s3-implemented-tests` | Via aggregate | build `rustfs`, then `scripts/s3-tests/run.sh` with the job's `DEPLOY_MODE` / `TEST_MODE` / `MAXFAIL` env |
@@ -117,18 +117,40 @@ Functional-chain health runs on a hosted runner independently of the lab fleet.

 ## Release validation

-Post-merge and tag-driven; not a substitute for a PR gate.
+Post-merge and tag-driven; not a substitute for a PR gate. Every public publication exit consumes the release certification described here; this certification path is separate from the reusable CI artifact contract in [verification plans](ci-verification-pipeline.md), whose archives expire after one day and are never used as release certification.
+
+The versioned plan is `.config/release-validation-plan.json` (`schema_version=1`): release types, target OS/arch/ABI, supported features, a fixed harness SHA per lane, required case IDs, environment capabilities, timeouts, applicability conditions, and an explicit `upgrade_sources` list carrying the real artifact digests of the supported N-1/N-2 sources plus a stated rollback basis — compatibility and rollback are never invented or defaulted. `scripts/release/release_gate.py validate` expands and freezes `plan_sha256` and the required case set before reading results, then binds that plan, a `candidate.json` (product 40-character SHA, version, release profile, features, immutable deliverable locations with SHA256 and wrapped-binary SHA256, image digest) and the shared G01 evidence-envelope set (rustfs/backlog#2658) of one parent candidate batch, and writes machine JSON, JUnit and a summary. Within a batch the unique key is `(lane, platform{os,arch,abi}, case_id)`; the top-level run/attempt is the parent batch and the nested workflow run/attempt is the child workflow identity, and both are validated separately (workflow SHA and product build SHA are bound independently and need not be equal). Missing, duplicate or extra cases, stale attempts, wrong digests, wrong platforms, wrong harness SHAs, zero tests, cancellation, timeout, untrusted sources and any non-PASS required item block with classified errors; only a complete legal success returns 0. `verify-promotion` re-checks the exact bytes about to be published against the passed list and fails on a swapped package or an edited plan after verification. preview, prerelease and stable all require an explicit plan; preview may use the plan's smaller pre-declared set but never bypasses artifact identity and startup checks. development artifacts are explicitly uncertified and never touch official or latest channels.

 | Trigger | Workflow / job | Result |
 |---|---|---|
-| Nightly schedule, dispatch | `build.yml` `build-rustfs` (development build over the full platform matrix) | build artifacts and the dev download channel; no release publication |
-| Valid release or preview tag | `build.yml` `build-rustfs`, `create-release`, `upload-release-assets`, `publish-release` | draft release, checksummed assets, publish |
-| Successful non-preview release-tag build (`workflow_run`) | `docker.yml` `build-docker`, `scan-docker-image` | multi-architecture images and vulnerability report |
-| Successful release-tag build (`workflow_run`) | `package.yml` `package` | DEB/RPM packages and checksums uploaded to the release |
-| Successful non-preview release-tag build (`workflow_run`) | `helm-package.yml` `build-helm-package`, `publish-helm-package` | versioned chart and repository index |
+| Nightly schedule, dispatch | `build.yml` `build-rustfs` (development build over the full platform matrix) | build artifacts and the uncertified dev download channel; no release publication |
+| Valid release or preview tag | `build.yml` `build-rustfs`, `release-certification`, `create-release`, `upload-release-assets`, `publish-release`, `promote-release-artifacts` | staged binaries, draft release, checksummed assets, then certified publish and promotion of the same bytes |
+| Successful non-preview release-tag build (`workflow_run`) | `docker.yml` `release-certification`, `build-docker`, `scan-docker-image` | multi-architecture images staged, verified against the certification and promoted, plus vulnerability report |
+| Successful release-tag build (`workflow_run`) | `package.yml` `release-certification`, `package`, `promote-packages` | DEB/RPM packages with wrapped-binary verification, staged then promoted with checksums |
+| Successful non-preview release-tag build (`workflow_run`) | `helm-package.yml` `release-certification`, `build-helm-package`, `publish-helm-package` | versioned chart and repository index, only over a certified image promotion record |
 | Final tag's release published | `build.yml` `cleanup-preview-releases` | deletes every `<target>-preview.<N>` Release for that target; the tags are kept |

-Use an exact preview tag for an end-to-end release rehearsal. Manual dispatches are backfill/debug paths and do not prove the automatic `workflow_run` chain.
+Publication exits and their gate:
+
+| Exit | Writer | Certification consumed |
+|---|---|---|
+| GitHub Release draft → public | `build.yml` `publish-release` | `release-certification` success and per-asset `verify-promotion` |
+| Official R2 binary path `artifacts/rustfs/release/` | `build.yml` `promote-release-artifacts` | `release-certification` plus `verify-promotion`; the build job itself only writes `artifacts/rustfs/staging/<run>/<attempt>/` |
+| `latest.json` version pointer | `build.yml` `update-latest-version` | transitively through `publish-release` |
+| Image channels (Docker Hub, GHCR, Quay tags) | `docker.yml` `build-docker` promotion step | certified input digests, staged image binary identity and `verify-promotion`, then promotion of the same digest with `imagetools create` |
+| Official R2 package paths `packages/release` and `packages/latest` | `package.yml` `promote-packages` | `release-certification` and wrapped-binary `verify-promotion`; the package job only stages |
+| GitHub release package assets | `package.yml` `package` | `release-certification` and wrapped-binary `verify-promotion` before upload |
+| Helm chart repository (`rustfs/helm` push) | `helm-package.yml` `publish-helm-package` | `release-certification` plus the Docker workflow's image-promotion record bound to the same candidate |
+
+Downstream workflows fail closed when the trusted certification is absent: a manual dispatch without certification fails and pushes no official tag. Only results from the trusted verification sources listed in the plan (currently the `rustfs/s3chaos` `release-gate.yml` envelope runs) carry release authority; a PR-uploaded JSON set cannot certify a release. Retries reuse the same candidate, only the staged bytes are promoted (no rebuild-after-verify), and no downstream step re-resolves a mutable `latest`.
+
+Use an exact preview tag for an end-to-end release rehearsal. Manual dispatches are backfill/debug paths and do not prove the automatic `workflow_run` chain. The committed fixtures under `testdata/release-gate/` and the commands below are contract rehearsals of this orchestration; they are explicitly not product release evidence and not live verifier results.
+
+```bash
+python3 -m unittest discover -s scripts/release -p 'test_release_gate.py'
+python3 scripts/release/release_gate.py validate --plan testdata/release-gate/plan.json --candidate testdata/release-gate/candidate.json --results testdata/release-gate/pass --output target/release-gate-check
+bash scripts/security/check_preview_release_workflow.sh
+```

 ## Change checklist

@@ -136,7 +158,7 @@ Update this file in the same PR when a job or check name changes, a workflow gai

 ## ECStore invariant selection

-The existing `ci.yml` test-and-lint job runs the ordinary ECStore and filemeta tests. After that run, `scripts/check_test_wiring.py --check-core` checks the same nextest profile and package selection against `.config/ecstore-required-tests.json`. Every named test must exist, match the filter, and be non-ignored; the job also requires a nonempty JUnit report. This checks membership without running the tests twice. `core-test-listing.json`, JUnit, and the run log are retained in the existing test-and-lint artifact.
+The existing `ci.yml` `workspace-tests` job runs the ordinary ECStore and filemeta tests. After that run, `scripts/check_test_wiring.py --check-core` checks the same nextest profile and package selection against `.config/ecstore-required-tests.json`. Every named test must exist, match the filter, and be non-ignored; the job also requires a nonempty JUnit report. This checks membership without running the tests twice. `core-test-listing.json`, JUnit, and the run log are retained in the existing `artifacts/workspace` evidence directory.

 The manifest records a minimum set of invariants: write quorum, metadata rollback, stale-writer lock loss, plaintext Range content, multipart cancellation, hiding uncommitted LIST versions, real MinIO metadata, corrupt part arrays, and the shared on-demand-migration source-backend contract for each provider dialect (S3, Azure, native GCS). The three contract entries live in the `rustfs` suite and reach the lane through that package's default features, so dropping `gcs` from `rustfs`'s defaults fails this check instead of silently deselecting the GCS contract (rustfs/backlog#2323). Renaming or moving a required test must update the manifest in the same change after checking the compiled listing. Extend this list as new deterministic regressions land; it is not a claim that all storage invariants are covered.

@@ -0,0 +1,72 @@
+# CI timing sample 2026-10-31 (backlog #2963 CI01 measurement)
+
+Operational measurement of ordinary-code PR feedback and runner occupancy against the CI01 experimental targets (feedback median 15–20 min, P95 ≤ 30 min, paid occupancy median 50–60 runner minutes). Methodology: [ci-timing.md](ci-timing.md) and [ci-resource-accounting.md](ci-resource-accounting.md). Raw snapshots: `/tmp/ci-timing.json` (limit 30 reproduction), `/tmp/ci-timing-200.json` (analysis sample), `/tmp/ci-acc-w{1,3}.json`. Nothing in this report is an acceptance result; the targets are **not met** by the measured sample.
+
+## Sample window and n
+
+| Item | Value |
+|---|---|
+| Collection time | 2026-10-31 ~02:50–03:15 UTC |
+| Window | completed `pull_request` runs of `ci.yml` created in the last 7 days |
+| Runs sampled | 30 (reproduction) and 200 (analysis, script max) |
+| Successful-code runs (classifier) | 1 of 30; **39 of 200** |
+| Other outcomes in 200-run sample | 68 cancelled (34 %), 36 failed, remainder non-code greens/closure handlers |
+| Lane shapes in sample | 24 combined-lane runs (`Workspace Test and Lint`), 15 split-lane runs (`Workspace Lint and Build` + `Workspace tests` + `Core contract`) |
+
+The limit-30 reproduction reports median wall 76.85 min and median job-sum 133.33 runner-min on n=1 (per methodology, an absent/small median is not zero). All medians/P95 below are from the n=39 analysis sample. Two of the 39 are rerun continuations (run_attempt > 1, wall 7.0 and 22.6 min re-executing only failed jobs under the rerun-start convention); they do not move the median.
+
+## Measured feedback and occupancy (ordinary successful code runs, n=39)
+
+| Metric | Median | P90 | P95 | Max |
+|---|---|---|---|---|
+| Wall feedback (created/rerun-start → last job end) | **76.3 min** | 94.5 | **97.0** | 103.2 |
+| Runner-minute job sum per run | **179.5** | 206.5 | **213.6** | 220.4 |
+
+Independent accounting cross-check (`scripts/ci/actions_cost_report.py`, 2026-10-30T00–12Z window, 547 attempts, collection **incomplete** — see gaps): successful-code PR feedback median 88.34 min (n=12), runner_sum median 199.68 min (n=12). A complete half-day window (2026-10-31T00–12Z, 78 attempts) shows total known runner occupancy 1379.72 min with 42 jobs of unknown occupancy; queue wait summed 28.43 min, so queueing is not the dominant cost.
+
+## Per-job critical path breakdown
+
+Execution minutes across the 39 runs (known only):
+
+| Job | n | Median | P95 |
+|---|---|---|---|
+| Workspace Test and Lint (combined lane) | 24 | 63.6 | 73.9 |
+| Connect Feature Boundaries | 38 | 53.5 | 70.4 |
+| Workspace Lint and Build (split lane) | 15 | 43.3 | 56.5 |
+| Workspace tests (split lane) | 15 | 29.2 | 43.0 |
+| Build RustFS Debug Binary | 39 | 18.5 | 24.9 |
+| End-to-End Tests | 39 | 11.4 | 16.7 |
+| S3 Implemented Tests | 39 | 9.8 | 11.1 |
+| io_uring Integration (real) | 39 | 7.7 | 8.8 |
+| Quick Checks | 39 | 7.2 | 9.2 |
+
+Per-run chain timeline (start = attempt start; see `/tmp/per-run-jobs.json`):
+
+- Split lane (15 runs): `Quick Checks` (~7–10) → `Workspace Lint and Build` (ends ~46–67) → `Workspace tests` (ends ~71–103) → shard evidence → aggregator `Test and Lint`/`required-checks`. The lint→tests chain sets the wall in most split runs.
+- Combined lane (24 runs): `Quick Checks` → `Workspace Test and Lint` alone runs 63–86 min and sets the wall.
+- `Connect Feature Boundaries` (median 53.5, P95 70.4) runs parallel to the lint chain and occasionally becomes the tail (e.g. runs 41021787700, 40750122159: connect end within 0.2 min of wall).
+- `Build RustFS Debug Binary` → E2E/Core-contract/S3 chain finishes with 30–60 min of slack in every sampled run.
+- The required-check aggregator `Test and Lint` (`required-checks`, `ci_gate.py verify`) finishes last by construction (~0.2 min).
+
+## Against the CI01 targets
+
+| Target | Measured | Verdict |
+|---|---|---|
+| Feedback median 15–20 min | 76.3 min (n=39) | **not met** (~3.8–5× over) |
+| Feedback P95 ≤ 30 min | 97.0 min | **not met** (~3.2× over) |
+| Occupancy median 50–60 runner-min | 179.5 runner-min | **not met** (~3–3.6× over) |
+
+These are the experimental-target measurements. The full merge-lifecycle cost is separate and was not established here (the accounting PR-allocation buckets were empty in the partial window; see gaps).
+
+## Bottlenecks (honest list)
+
+1. **Workspace lint+test compile/test chain (critical path):** combined `Workspace Test and Lint` median 63.6 min, or split `Workspace Lint and Build` 43.3 + `Workspace tests` 29.2 ≈ 72.5 min after Quick Checks. This is the wall clock.
+2. **Connect Feature Boundaries (parallel near-critical):** median 53.5 min on its own lane with `CARGO_BUILD_JOBS: "2"` limiting build concurrency on the credential-test step; becomes the tail when the lint chain is fast.
+3. **Duplicate compilation across lanes:** `Workspace Lint and Build` builds workspace test binaries; `Build RustFS Debug Binary` separately builds the debug binary + E2E binaries on another runner; Connect builds again. `cache-save-if: 'false'` on the Connect lane means that lane never warms the shared `ci-dev` cache.
+4. Runner queueing is small (28.43 queue-min vs 1379.72 runner-min in the complete half-day window) — not the bottleneck.
+
+## Gaps and caveats
+
+- Accounting windows: 2026-10-30T00–12Z collected 547 attempts but is flagged incomplete; 2026-10-30T12–24Z collection did not finish (timeout) and has no report; 2026-10-31T12–24Z was empty at collection time. Occupancy figures are per-window partial sums and must not be summed as a bill.
+- No CI workflow or selection change was made in this pass; strict gate semantics unchanged. No savings are claimed. Candidate fixes (build-artifact reuse between lanes, enabling cache save on the Connect lane, finer affected-selection granularity in shadow mode per ci-timing.md) are **unmeasured proposals**, not results.
+- Timing data alone does not establish functional coverage or escaped-regression rate; the 15–20 min target remains an experiment that currently misses by a wide margin.
@@ -32,7 +32,7 @@ Periodic and manual suites use the responsibility registry and retain the existi

 ## Merge-queue preparation and rollback

-The merge-group event plans and validates its actual combined SHA/tree with the full Linux and feature configuration matrix. Main pushes keep complete validation; no reuse is inferred from tree equality because commit identity and build inputs can matter. CLA remains an independent queue-entry requirement.
+The merge-group event plans and validates its actual combined SHA/tree with the default workspace matrix: workspace lint and tests, the short core contract, the debug build, E2E smoke, both S3 lanes and the full merge-gate E2E. The specialized boundary, hardware and alternate-feature lanes (Connect Feature Boundaries, real io_uring, rio-v2, Swift, SFTP, HTTP/3) run only in the scheduled and manual full-validation runs and are required to be skipped here. Main pushes keep complete validation; no reuse is inferred from tree equality because commit identity and build inputs can matter. CLA remains an independent queue-entry requirement.

 `scripts/ci_merge_queue.py` prepares a bounded queue proposal from a live ruleset snapshot without calling a mutation API. It preserves all existing checks, reviews, bypass actors and branch conditions, adds an `ALLGREEN` squash queue with at most two concurrent builds/two merged entries, and produces the original rollback payload. Its timeout accommodates the existing full gate while measurements are collected. API fields follow [GitHub's ruleset contract](https://docs.github.com/en/rest/repos/rules).

@@ -142,7 +142,7 @@ filtered and malformed listing cases, and missing or altered required fixtures.
 Those cases must fail; an optional legacy fixture test that returns early is
 not evidence for a required fixture.

-The `test-and-lint` artifact contains the native log, listing, JUnit and
+The `artifacts/workspace` evidence directory contains the native log, listing, JUnit and
 execution receipt. A native test that reopens a disk in the same process does
 not establish process-crash or power-loss durability.

@@ -16,20 +16,32 @@ Use the `executable` from the scanner library test `compiler-artifact` JSON reco
 python3 scripts/diagnose_scanner_enumeration_restart.py \
  --test-binary /path/to/compiled/scanner-libtest \
  --output /tmp/scanner-enumeration-new-run \
-  --objects 128 --raw-entry-budget 8 --rounds 8
+  --objects 128 --raw-entry-budget 8 --rounds 40
 ```

+The round count must cover both stages: at `E` first-seen entries and `O` objects with budget `B`, enumeration takes `E/B` rounds and classification about `O/(B-1)` more, so 128 objects at budget 8 converge in 35 rounds. `--rounds 8` cannot converge at that budget on any correct scanner and reports exit 2 because no round reached classification.
+
 The output directory must not exist. Each round starts a new OS test-worker process, opens the same synthetic disk, decodes the preceding cache, invokes the real scanner, encodes the returned cache, and decodes it again. When cancellation returns no useful partial cache, it preserves the previous cache. Reports identify the actual child PID, round, raw entries and name bytes observed, raw page-index parent/entries, processed/classified objects, retained object/version/byte counts, and completeness. The driver rejects retained coverage that advances beyond classified object work, root raw page indexes that outrun the fixture namespace, committed page coverage that exceeds indexed coverage, same-parent committed coverage regressions before completion, and any process-restart regression in retained coverage. No observed-name set, `readdir` offset, or assumed stable ordering is used as durable progress. Namespace creation happens only during fixture setup, before scan accounting.

-The `cfg(test)` hook observes actual entries delivered by `read_dir` and cancels the existing cycle token at the fixed entry limit. This is a deterministic injected **raw-entry work budget**, not a wall-clock performance measurement or a claim that kernel prefetch, probes, allocations, name bytes, or cache I/O are independently budgeted. The watchdog timeout only bounds worker lifetime. The hook does not replace enumeration, classification, or recursion, and does not exist in production builds. In particular, `xl.meta` object-boundary classification is unchanged.
+The worker sets `max_entries` on the production `ScannerCycleBudget`, and the `cfg(test)` hook only observes actual entries delivered by `read_dir`. This is a deterministic injected **raw-entry work budget**, not a wall-clock performance measurement or a claim that kernel prefetch, probes, allocations, or cache I/O are independently budgeted. Entries replayed up to the size of a validated index are read again on every restart and are bounded only by the runtime budget. The watchdog timeout only bounds worker lifetime. The hook does not replace enumeration, classification, or recursion, and does not exist in production builds. In particular, `xl.meta` object-boundary classification is unchanged.

-Exit 0 requires exact complete object/version/byte coverage within the same fixed budget on every executed round and positive evidence for all three stages: raw enumeration/indexing, object classification/processing, and durable cache retention after a fresh worker process reloads the previous report. Exit 1 means the strict convergence oracle remains unmet, including the current flat-directory enumeration starvation case. Exit 2 means invalid input, worker failure, or invalid evidence; it is not a successful reproduction. There is no final unbudgeted sweep. Small fixtures can pass; that does not establish the general R-E gate from [the scanner review comment](https://github.com/rustfs/backlog/issues/2240#issuecomment-5549222480). Raw entries observed are not a retained enumeration watermark. This is scanner-worker process restart plus codec evidence, **not** whole-daemon restart, EC quorum persistence, crash/fsync durability, remote RPC, or a throughput benchmark. The caller owns the bounded evidence directory and may remove it after inspection.
+Exit 0 requires exact complete object/version/byte coverage within the same fixed budget on every executed round and positive evidence for all three stages: raw enumeration/indexing, object classification/processing, and durable cache retention after a fresh worker process reloads the previous report. Exit 1 means the strict convergence oracle remains unmet. Exit 2 means invalid input, worker failure, or invalid evidence; it is not a successful reproduction. There is no final unbudgeted sweep. Small fixtures can pass; that does not establish the general R-E gate from [the scanner review comment](https://github.com/rustfs/backlog/issues/2240#issuecomment-5549222480). Raw entries observed are not a retained enumeration watermark. This is scanner-worker process restart plus codec evidence, **not** whole-daemon restart, EC quorum persistence, crash/fsync durability, remote RPC, or a throughput benchmark. The caller owns the bounded evidence directory and may remove it after inspection.
+
+### Budgeted First Build
+
+`FolderScanner::scan_folder` streams `read_dir`, charges each entry past the restored index size to the budget, and records it in the raw page index. Object metadata stays on the object budget. `max_entries` and `max_entry_name_bytes` stop a scan directly; `max_objects` and `max_directories` also bound one directory listing to 16 entries per budget unit, with a 128-entry floor, because a forward sweep needs the whole listing before it classifies in sorted order. A directory keeps its index until its children end, and the checkpoint saves every index on the active walk path, so a restart does not recharge any wide ancestor. A stop checkpoint grows only by the charged names. The total index stays proportional to the directory width.
+
+### Bucket Service Order
+
+Each set cache carries an optional `scan_bucket_service` map: a first-in-first-out wait position per bucket with its granted quanta, last certification and failure debt. A new or recreated bucket joins behind waiters but ahead of buckets that already had a turn in the current generation. The order is saved after budget stops and finished incomplete cycles too, under the set cache lock and revisions, and never when the owner was cancelled. It orders work and authorizes nothing, so another movement epoch or an invalid value starts a new order. Service recorded after the last save is not durable: a crash or cancellation inside a cycle repeats that cycle's order. Set dispatch order across restarts is not persisted.
+
+`cold_bucket_service_` tests fix N=17 buckets and q=4 service quanta with one hot and one failing bucket, and require service within ceil(17/4)=5 rounds through the real worker queue, the saved codec, and fresh OS processes. `fair_prefix_quantum_` tests inject small bucket shares. Production keeps `bucket_quantum` unset, so a bucket may use the total budget and then moves to the tail.

 ### Missing Storage Capability

-The current `scanner_folder::FolderScanner::scan_folder` collects child folders before recursing. `LocalDisk::scan_dir` also reads the whole parent before sorting and applying `forward_to`. Neither can supply a restartable first-build cursor over per-disk raw entries, orphan directories, and metadata boundaries. Repeated listing from the beginning is real work, not free pagination.
+`read_dir` has no restartable cursor, so resuming a listing rereads it from the start. Repeated listing from the beginning is real work, not free pagination.

-A future storage-owner capability must expose an explicit unsupported/building/ready state and a durable snapshot/index identity bound to disk mount, bucket incarnation, and directory identity. It must budget the first build and every page, including entry count, name bytes, metadata probes, I/O and time; survive a process restart during first build; seal page data before advancing the manifest; and distinguish enumerated, classified, and fully processed frontiers. An uncommitted page may be replayed only within a bounded cost. `xl.meta` classification must finish before descendants become traversable namespace. Missing capability or invalid identities must not become fabricated progress or completeness. No such capability is implemented by this diagnostic, and ordinary local storage remains without this R-E guarantee.
+A future storage-owner capability must expose an explicit unsupported/building/ready state and a durable snapshot/index identity bound to disk mount, bucket incarnation, and directory identity. It must budget the first build and every page, including entry count, name bytes, metadata probes, I/O and time; survive a process restart during first build; seal page data before advancing the manifest; and distinguish enumerated, classified, and fully processed frontiers. An uncommitted page may be replayed only within a bounded cost. `xl.meta` classification must finish before descendants become traversable namespace. Missing capability or invalid identities must not become fabricated progress or completeness. No such capability is implemented by this diagnostic. The page index above budgets new entries only, and ordinary local storage remains without this R-E guarantee.

 ## Completed Subtree Checkpoint Fixture

@@ -495,9 +495,9 @@ dependencies = [

 [[package]]
 name = "aws-smithy-schema"
-version = "1.1.0"
+version = "1.1.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bec8dae1015a6d959a5faf86fbdf77486cfe19e4ccb6ee009d8a46efc45028a4"
+checksum = "9543fc722ed4865ab29fb66bd7ed0bef7b029d265ba8c587144511e30006d431"
 dependencies = [
 "aws-smithy-runtime-api",
 "aws-smithy-types",
@@ -1418,9 +1418,9 @@ dependencies = [

 [[package]]
 name = "encoding_rs"
-version = "0.8.42"
+version = "0.8.44"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8e985e0451871ad22fb8d2b6b076e2028a502a0d3950998c2c5c0a4f9b5d9679"
+checksum = "89253175e704ab869b04f9db224d38630e0211a53841a79181deae0889e169f5"
 dependencies = [
 "cfg-if",
 "core_detect",
@@ -1837,18 +1837,18 @@ dependencies = [

 [[package]]
 name = "hotpath"
-version = "0.30.1"
+version = "0.30.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "502dc37a7c218b9b1d3a0ccfb904da81d10d6dda0e899c722c503092d55576ea"
+checksum = "b39e941010d86063ff233bf8325269bf68097fb24ba67000fbddc0a410e8056e"
 dependencies = [
 "hotpath-macros",
 ]

 [[package]]
 name = "hotpath-macros"
-version = "0.30.1"
+version = "0.30.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a76e0af911930fc97abc766b393b48cdca77fea9f5f6b388cf2123a6d9c30deb"
+checksum = "a24f5179ff680132003306354efd0ac8cde12e87b1a788719c836e91af35cb58"

 [[package]]
 name = "http"
@@ -2305,9 +2305,9 @@ dependencies = [

 [[package]]
 name = "js-sys"
-version = "0.3.106"
+version = "0.3.107"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7883d941dae510fb2d978fc3fe018c71c9e2892fd38854de3e8b92c2e5ad9cc5"
+checksum = "8dc09d2154098bbf4ef54eab6b117a3c24cbbffe94046b16ee6d6d4510584d3a"
 dependencies = [
 "cfg-if",
 "futures-util",
@@ -3162,9 +3162,9 @@ dependencies = [

 [[package]]
 name = "pulldown-cmark"
-version = "0.13.5"
+version = "0.13.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "278e9268c93b9e498a2da46c34d90ba93a3255eb99009646398f34bc73ab36eb"
+checksum = "3db2be46835f013dd3f4fa7f5f7402c537787b54ebb6fe2b94bbdd7e2669bb7b"
 dependencies = [
 "bitflags 2.13.2",
 "memchr",
@@ -4822,9 +4822,9 @@ dependencies = [

 [[package]]
 name = "sysinfo"
-version = "0.40.0"
+version = "0.40.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "110e37d98880fd804cd47509b90a8444f7aaaab655ae625e83cd442a8bc2ebf2"
+checksum = "0e8a3edbe0394ce115f3917a00349dd242be09eb5a091ed509eaf67b55cfb8a8"
 dependencies = [
 "libc",
 "memchr",
@@ -5017,9 +5017,9 @@ dependencies = [

 [[package]]
 name = "tonic"
-version = "0.14.8"
+version = "0.14.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cd1fa9b1a51188f3266a823208078315811269d06d272c3a61be0b9a194194ff"
+checksum = "e2cdfc673aabd30fe8fee92e65837b644c37c5d47f0f97ae6d5e0f1237d15e1b"
 dependencies = [
 "async-trait",
 "axum",
@@ -5050,9 +5050,9 @@ dependencies = [

 [[package]]
 name = "tonic-build"
-version = "0.14.8"
+version = "0.14.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2c07bd4e9f99e2a3ed8bebad596ae02a94e53745b68acc6900e22c3475c8bc44"
+checksum = "ac6d916d206ed7bdda1778ddff9bda43303789c258877e7bc22fb44ee5c984b4"
 dependencies = [
 "prettyplease",
 "proc-macro2",
@@ -5062,9 +5062,9 @@ dependencies = [

 [[package]]
 name = "tonic-prost"
-version = "0.14.8"
+version = "0.14.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f63c616ffaa648f7c5dd5657e97d9a285fcb44ff3b70da761d436f5a13ff7be6"
+checksum = "eba464054e2226f182a34489b8b079bf4c6e3e7ab5fd7fc30e024f24aa92a484"
 dependencies = [
 "bytes",
 "prost",
@@ -5073,9 +5073,9 @@ dependencies = [

 [[package]]
 name = "tonic-prost-build"
-version = "0.14.8"
+version = "0.14.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4a05d8957fac6b3542999796cb4449d45da790751962f974a457e5e00c43d78c"
+checksum = "2ea216ddc448e08e7839ab09e20e60b06b6a1c32745ccb212c0ebd161c199f1b"
 dependencies = [
 "prettyplease",
 "proc-macro2",
@@ -5293,9 +5293,18 @@ checksum = "daf8dba3b7eb870caf1ddeed7bc9d2a049f3cfdfae7cb521b087cc33ae4c49da"

 [[package]]
 name = "utf8_iter"
-version = "1.0.4"
+version = "1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b6c140620e7ffbb22c2dee59cafe6084a59b5ffc27a8859a5f0d494b5d52b6be"
+checksum = "af3bd9d3e571c26fcce9d033b87ea5ab061b8d2ffe9b7a5675d810d68f03edf0"
+dependencies = [
+ "utf_types",
+]
+
+[[package]]
+name = "utf_types"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3a3b425286980a367278453f3b6d28cdcb134b574e5a35824a6ff5eebad50bb6"

 [[package]]
 name = "uuid"
@@ -5355,12 +5364,11 @@ checksum = "ccf3ec651a847eb01de73ccad15eb7d99f80485de043efb2f370cd654f4ea44b"

 [[package]]
 name = "wasm-bindgen"
-version = "0.2.129"
+version = "0.2.130"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9bb54f33acc68fd454578d9820b0bde1a1a3d17aa17bb7b6595806d02886d409"
+checksum = "a0181c14ddd6c7b8b0b0132a5f1ea2f32be0d893cd3ea97b6e3b28886b8a3d1c"
 dependencies = [
 "cfg-if",
- "once_cell",
 "rustversion",
 "wasm-bindgen-macro",
 "wasm-bindgen-shared",
@@ -5368,9 +5376,9 @@ dependencies = [

 [[package]]
 name = "wasm-bindgen-futures"
-version = "0.4.79"
+version = "0.4.80"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3cbab34de2d982e9b48e18d216d04c4a6f641066ff19ffb699980f591ee3610e"
+checksum = "5e14e0327cb5368ad60ccb22d04a9827a693c95a926d8d125e9fa39e0baec501"
 dependencies = [
 "js-sys",
 "tokio",
@@ -5379,9 +5387,9 @@ dependencies = [

 [[package]]
 name = "wasm-bindgen-macro"
-version = "0.2.129"
+version = "0.2.130"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2e29d0c35b16e224a7eeb5cd2d25e3e1968fbd65604117b44d3b789d00ee8535"
+checksum = "6e931a02a39abdbf66966fc35902b5ed58344750a70885bed4ebb3d8eaf28ed9"
 dependencies = [
 "quote",
 "wasm-bindgen-macro-support",
@@ -5389,9 +5397,9 @@ dependencies = [

 [[package]]
 name = "wasm-bindgen-macro-support"
-version = "0.2.129"
+version = "0.2.130"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6f501a8bc3719dba86ef8ae4728879c08001bea749eb1333ac5b91e040e2a6b7"
+checksum = "2ca4b54280e455bd831e33a6b8e734baf432fe63fbc35c42ac14ce67a043a53a"
 dependencies = [
 "bumpalo",
 "proc-macro2",
@@ -5402,9 +5410,9 @@ dependencies = [

 [[package]]
 name = "wasm-bindgen-shared"
-version = "0.2.129"
+version = "0.2.130"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "23f0c9c52aa7cd7d77769a4cfe2a9adb1b331f489a41d912ce14513d5ab995c6"
+checksum = "3b1f9c3798725016c6ee5f2f57869ec0831e8bbc0ab0310a86e787e97f41389e"
 dependencies = [
 "unicode-ident",
 ]
@@ -5424,9 +5432,9 @@ dependencies = [

 [[package]]
 name = "web-sys"
-version = "0.3.106"
+version = "0.3.107"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "88261b9deccee56594c11a3460c462c41f58d148598fe70ad77070126a68aba4"
+checksum = "d7d179596ff5ec0f6de4db64d54011bde6289cc49603d3a6e4ce3f329207ab88"
 dependencies = [
 "js-sys",
 "wasm-bindgen",
@@ -433,6 +433,47 @@ async fn config_handler(uri: Uri, headers: HeaderMap) -> impl IntoResponse {
        .unwrap()
 }

+/// Buffers brotli-encoded responses to add a `Content-Length` header.
+///
+/// `tower_http`'s `CompressionLayer` streams brotli via `Transfer-Encoding: chunked`
+/// without a `Content-Length`. Firefox's incremental brotli decoder aborts on this
+/// combination (`NS_BINDING_ERROR`). Chrome and Safari buffer the full chunked body
+/// before decompressing and are unaffected.
+///
+/// This middleware collects the complete body for any brotli response that lacks a
+/// `Content-Length`, then re-emits it with the correct length so Firefox can decode it.
+pub(crate) async fn buffer_brotli_responses(request: Request, next: middleware::Next) -> Response {
+    let response = next.run(request).await;
+
+    let is_brotli = response
+        .headers()
+        .get(http::header::CONTENT_ENCODING)
+        .and_then(|v| v.to_str().ok())
+        .is_some_and(|v| v == "br");
+
+    if !is_brotli || response.headers().contains_key(http::header::CONTENT_LENGTH) {
+        return response;
+    }
+
+    let (mut parts, body) = response.into_parts();
+    match axum::body::to_bytes(body, 32 * 1024 * 1024).await {
+        Ok(bytes) => {
+            if let Ok(value) = HeaderValue::from_str(&bytes.len().to_string()) {
+                parts.headers.insert(http::header::CONTENT_LENGTH, value);
+            }
+            Response::from_parts(parts, Body::from(bytes))
+        }
+        Err(err) => {
+            warn!(
+                error = %err,
+                "Failed to buffer brotli console response; sending empty body without Content-Encoding"
+            );
+            parts.headers.remove(http::header::CONTENT_ENCODING);
+            Response::from_parts(parts, Body::empty())
+        }
+    }
+}
+
 /// Console access logging middleware
 /// Logs each console access with method, URI, status code, and duration.
 ///
@@ -605,6 +646,8 @@ fn setup_console_middleware_stack(
        .layer(SetRequestIdLayer::x_request_id(MakeRequestUuid))
        // Compress responses
        .layer(CompressionLayer::new())
+        // Buffer brotli responses to add Content-Length
+        .layer(middleware::from_fn(buffer_brotli_responses))
        .layer(middleware::from_fn(console_logging_middleware))
        .layer(cors_layer)
        // Add timeout layer - convert auth_timeout from seconds to Duration
@@ -43,6 +43,60 @@ mod tests {
            .map(|value| value.to_str().expect("allow-origin header must be valid UTF-8").to_string())
    }

+    /// Runs a request through a router that returns a brotli-encoded response without
+    /// `Content-Length` and returns the response's `content-length` header value, if any.
+    async fn brotli_response_content_length(has_content_length: bool) -> Option<String> {
+        use crate::admin::console::buffer_brotli_responses;
+        use axum::middleware;
+        use axum::{Router, body::Body, routing::get};
+        use tower::ServiceExt;
+
+        let app = Router::new()
+            .route(
+                "/",
+                get(move || async move {
+                    let mut builder = http::Response::builder().header(http::header::CONTENT_ENCODING, "br");
+                    if has_content_length {
+                        builder = builder.header(http::header::CONTENT_LENGTH, "4");
+                    }
+                    builder.body(Body::from("data")).expect("response must build")
+                }),
+            )
+            .layer(middleware::from_fn(buffer_brotli_responses));
+
+        let response = app
+            .oneshot(
+                http::Request::builder()
+                    .uri("/")
+                    .body(Body::empty())
+                    .expect("request must build"),
+            )
+            .await
+            .expect("request must not fail");
+
+        response
+            .headers()
+            .get(http::header::CONTENT_LENGTH)
+            .map(|value| value.to_str().expect("content-length header must be valid UTF-8").to_string())
+    }
+
+    #[tokio::test]
+    #[serial]
+    async fn test_buffer_brotli_responses() {
+        // Brotli response without Content-Length must have Content-Length added.
+        assert!(
+            brotli_response_content_length(false).await.is_some(),
+            "brotli response without Content-Length must have Content-Length added"
+        );
+
+        // Brotli response that already carries Content-Length must pass through unchanged.
+        assert_eq!(
+            brotli_response_content_length(true).await.as_deref(),
+            Some("4"),
+            "brotli response that already has Content-Length must not be re-buffered"
+        );
+    }
+
    #[tokio::test]
    #[serial]
    async fn test_console_cors_configuration() {
@@ -705,7 +705,7 @@ def check_ilm_build_budget(root: Path) -> list[str]:
            "--workspace-remap": "$GITHUB_WORKSPACE",
            "--target-dir-remap": "$GITHUB_WORKSPACE/target",
        }
-        if ("test-and-lint" not in job.get("needs", []) or "--archive-file" in tokens
+        if ("workspace-lint-and-build" not in job.get("needs", []) or "--archive-file" in tokens
                or any(tokens.count(flag) != 1 or tokens[tokens.index(flag) + 1:tokens.index(flag) + 2] != [value]
                       for flag, value in reuse_options.items())):
            return ["ILM integration must consume the workspace producer archive"]
@@ -729,7 +729,7 @@ def check_ilm_build_budget(root: Path) -> list[str]:
            return ["ILM integration must propagate failures"]
        if 'status=${PIPESTATUS[0]}' not in command or 'exit "${status}"' not in command or "|| true" in command.split('status=${PIPESTATUS[0]}')[0]:
            return ["ILM integration must retain the actual test exit status"]
-        producer_steps = jobs.get("test-and-lint", {}).get("steps", [])
+        producer_steps = jobs.get("workspace-lint-and-build", {}).get("steps", [])
        builds = [item for item in producer_steps if "ci_test_artifact.py build --configuration workspace" in item.get("run", "")]
        if len(builds) != 1:
            return ["ILM integration requires one workspace archive producer"]
@@ -33,7 +33,7 @@ set -uo pipefail
 # GNU date on the runners; the fallback keeps local smoke tests on macOS quiet.
 now() { date --utc --iso-8601=seconds 2>/dev/null || date -u +%Y-%m-%dT%H:%M:%S+00:00; }

-LOG_DIR="artifacts/test-and-lint"
+LOG_DIR="artifacts/workspace"
 LOG_FILE="${LOG_DIR}/sampler.log"
 PID_FILE="${LOG_DIR}/.sampler.pid"
 INTERVAL="${SAMPLER_INTERVAL_SECS:-60}"
@@ -16,20 +16,29 @@ import unittest
 ROOT = Path(__file__).resolve().parent.parent
 ALWAYS_JOBS = ("classify-changes", "typos", "quick-checks")
 CODE_JOBS = (
-    "test-and-lint", "workspace-tests", "core-contract", "connect-feature-boundaries", "test-and-lint-rio-v2",
+    "workspace-lint-and-build", "workspace-tests", "core-contract", "connect-feature-boundaries", "test-and-lint-rio-v2",
    "test-and-lint-protocols", "build-rustfs-debug-binary", "uring-integration",
    "e2e-tests", "s3-implemented-tests", "s3-lifecycle-behavior-tests",
 )
-# Full alternate-feature tests run on merge groups and on scheduled/manual
-# runs. Pull requests and main pushes skip them: the nightly run reports a
-# feature regression within a day, and repeating four builds per PR revision
-# or per merge bought no earlier signal.
-EXTENDED_FEATURE_JOBS = ("test-and-lint-rio-v2", "test-and-lint-protocols")
+# Specialized boundary, hardware and alternate-feature lanes do not gate a
+# merge. They run only in the scheduled (nightly) and manual full-validation
+# runs, which report a regression within a day; repeating them on every PR
+# revision and merge group bought no earlier signal worth the runner occupancy
+# (Connect alone measured 53.5 median minutes per run and occasionally set the
+# wall). Workspace lint and tests, the short core contract, the debug build,
+# E2E smoke and the S3 lanes stay on the pull-request path because they cover
+# the product's core correctness and S3 compatibility surface.
+NIGHTLY_JOBS = ("connect-feature-boundaries", "uring-integration", "test-and-lint-rio-v2", "test-and-lint-protocols")
+# Bump when a plan produced by an older `select` can no longer be checked
+# against this revision's expected job contract. The workflow refuses a plan
+# that does not carry the current marker and falls back to the full matrix, so
+# a base planner predating the contract cannot authorize a narrower selection.
+PLAN_CONTRACT = "2"
 # These jobs still exercise the server and its black-box harness when only E2E
 # Rust sources change. Production code, manifests and shared test configuration
 # always select the full matrix. No production package depends on e2e_test.
 E2E_JOBS = (
-    "test-and-lint", "workspace-tests", "core-contract", "build-rustfs-debug-binary", "e2e-tests",
+    "workspace-lint-and-build", "workspace-tests", "core-contract", "build-rustfs-debug-binary", "e2e-tests",
    "s3-implemented-tests", "s3-lifecycle-behavior-tests",
 )
 E2E_SELECTION_FILES = {
@@ -167,11 +176,10 @@ def expected_results(mode: str, event: str, ref: str, connect: bool = True, acti
        raise ValueError("shard rehearsal requires an explicit manual event")
    expected = {job: "success" for job in ALWAYS_JOBS}
    expected.update({job: "success" if mode == "full" or (mode == "e2e" and job in E2E_JOBS) else "skipped" for job in CODE_JOBS})
-    expected["connect-feature-boundaries"] = "success" if mode == "full" and connect else "skipped"
-    if event in ("pull_request", "push"):
-        expected.update({job: "skipped" for job in EXTENDED_FEATURE_JOBS})
-    rio = mode == "full" and event in ("schedule", "workflow_dispatch")
-    expected.update({job: "success" if rio else "skipped" for job in OPTIONAL_JOBS[:2]})
+    nightly = mode == "full" and event in ("schedule", "workflow_dispatch")
+    expected.update({job: "success" if nightly else "skipped" for job in NIGHTLY_JOBS})
+    expected["connect-feature-boundaries"] = "success" if nightly and connect else "skipped"
+    expected.update({job: "success" if nightly else "skipped" for job in OPTIONAL_JOBS[:2]})
    full = mode == "full" and (event in ("merge_group", "workflow_dispatch") or (event == "push" and ref == "refs/heads/main"))
    expected["e2e-full"] = "success" if full else "skipped"
    expected.update({job: "success" if rehearse_shards else "skipped" for job in SHARD_JOBS})
@@ -192,8 +200,8 @@ def read_policy(root: Path, revision: str) -> dict:

 def configurations(jobs: dict[str, str]) -> list[dict]:
    values = [
-        ("workspace-lint", "test-and-lint", "dev", []),
-        ("workspace-tests", "test-and-lint", "test", []),
+        ("workspace-lint", "workspace-lint-and-build", "dev", []),
+        ("workspace-tests", "workspace-lint-and-build", "test", []),
        ("e2e-harness", "build-rustfs-debug-binary", "test", []),
        ("uring-tests", "uring-integration", "test", []),
        ("server-e2e-hooks", "build-rustfs-debug-binary", "dev", ["e2e-test-hooks"]),
@@ -540,7 +548,7 @@ def check_workflow(root: Path) -> list[str]:
                              or verifiers[0].get("shell") != "bash" or "if" in verifiers[0]):
        errors.append("required-checks must unconditionally verify actual needs and preserve its exit status")
    lint_commands = ("cargo clippy --all-targets -- -D warnings", "python3 scripts/ci_test_artifact.py cargo lint --configuration workspace")
-    clippy = [step for step in jobs.get("test-and-lint", {}).get("steps", [])
+    clippy = [step for step in jobs.get("workspace-lint-and-build", {}).get("steps", [])
              if any(command in step.get("run", "") for command in lint_commands)]
    if not clippy or any("if" in step for step in clippy):
        errors.append("workspace Clippy must run on every code event, pull requests included")
@@ -620,7 +628,8 @@ def main() -> int:
                for name, value in (("mode", plan["mode"]), ("plan", json.dumps(plan, separators=(",", ":"))),
                                    ("connect", str(plan["connect"]).lower()), ("packages", json.dumps(plan["packages"], separators=(",", ":"))),
                                    ("full_validation", str(plan["full_validation"]).lower()),
-                                    ("rehearse_shards", str(plan["rehearse_shards"]).lower())):
+                                    ("rehearse_shards", str(plan["rehearse_shards"]).lower()),
+                                    ("plan_contract", PLAN_CONTRACT)):
                    output.write(f"{name}={value}\n")
            print(json.dumps(plan, indent=2))
            if os.environ.get("GITHUB_STEP_SUMMARY"):
@@ -0,0 +1,376 @@
+#!/usr/bin/env python3
+# Copyright 2024 RustFS Team
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+"""Contract tests for scripts/release/release_gate.py (rustfs/backlog#2662).
+
+Every fixture under testdata/release-gate/ is a contract rehearsal only: these
+tests prove the gate's fail-closed orchestration and must never be read as
+product release evidence or as R02 live verification results.
+"""
+
+import json
+import re
+import subprocess
+import sys
+import tempfile
+import unittest
+from pathlib import Path
+
+ROOT = Path(__file__).resolve().parents[2]
+GATE = ROOT / "scripts" / "release" / "release_gate.py"
+FIXTURES = ROOT / "testdata" / "release-gate"
+PLAN = FIXTURES / "plan.json"
+CANDIDATE = FIXTURES / "candidate.json"
+ARTIFACT = FIXTURES / "artifacts" / "rustfs-linux-x86_64-gnu-v9.9.9-fixture.zip"
+ARTIFACT_NAME = "rustfs-linux-x86_64-gnu-v9.9.9-fixture.zip"
+REAL_PLAN = ROOT / ".config" / "release-validation-plan.json"
+
+
+def run_gate(*arguments):
+    result = subprocess.run(
+        [sys.executable, str(GATE), *map(str, arguments)],
+        cwd=ROOT,
+        text=True,
+        capture_output=True,
+        check=False,
+    )
+    return result
+
+
+def run_validate(results, output, plan=PLAN, candidate=CANDIDATE):
+    return run_gate(
+        "validate",
+        "--plan", plan,
+        "--candidate", candidate,
+        "--results", results,
+        "--output", output,
+    )
+
+
+def run_promote(output, plan=PLAN, candidate=CANDIDATE, summary=None, artifact=ARTIFACT,
+                artifact_name=ARTIFACT_NAME, artifact_sha256=None):
+    arguments = [
+        "verify-promotion",
+        "--plan", plan,
+        "--candidate", candidate,
+        "--summary", summary or output,
+    ]
+    if artifact is not None:
+        arguments += ["--artifact", artifact]
+    if artifact_name is not None:
+        arguments += ["--artifact-name", artifact_name]
+    if artifact_sha256 is not None:
+        arguments += ["--artifact-sha256", artifact_sha256]
+    if output is not None:
+        arguments += ["--output", output]
+    return run_gate(*arguments)
+
+
+def load_summary(output):
+    return json.loads((Path(output) / "release-gate-summary.json").read_text())
+
+
+def finding_codes(summary):
+    return {finding["code"] for finding in summary["findings"]}
+
+
+class GateFixtureTests(unittest.TestCase):
+    """Assertion matrix rows from rustfs/backlog#2662 exercised on the fixtures."""
+
+    def setUp(self):
+        self._temporary = tempfile.TemporaryDirectory(prefix="release-gate-test.")
+        self.addCleanup(self._temporary.cleanup)
+        self.output = Path(self._temporary.name)
+
+    def validate_fixture(self, name, expect):
+        output = self.output / name
+        result = run_validate(FIXTURES / name, output)
+        self.assertEqual(result.returncode, expect, result.stderr)
+        return result, load_summary(output)
+
+    def test_all_required_pass_and_identity_consistent(self):
+        # Matrix: all required PASS and identity consistent -> validate and
+        # verify-promotion return 0.
+        result, summary = self.validate_fixture("pass", 0)
+        self.assertEqual(summary["state"], "pass")
+        self.assertTrue(summary["publish_allowed"])
+        self.assertEqual(len(summary["required_cases"]), 5)
+        self.assertEqual(len(summary["observed"]), 5)
+        self.assertEqual(summary["findings"], [])
+        expansion = json.loads((self.output / "pass" / "plan-expansion.json").read_text())
+        self.assertEqual(len(expansion["required_cases"]), 5)
+        promote = run_promote(self.output / "pass")
+        self.assertEqual(promote.returncode, 0, promote.stderr)
+
+    def test_cross_platform_same_case_and_split_shas_accepted(self):
+        # Matrix: the same case name on two platforms, and a workflow SHA that
+        # differs from the (legally bound) product SHA, must not be rejected.
+        result, summary = self.validate_fixture("cross-platform", 0)
+        self.assertEqual(summary["state"], "pass")
+        product_commit = json.loads(CANDIDATE.read_text())["product_commit"]
+        workflows = []
+        for name in sorted((FIXTURES / "cross-platform").glob("*.json")):
+            if name.name == "batch.json":
+                continue
+            envelope = json.loads(name.read_text())
+            workflows.append(envelope["workflow"]["workflow_sha"])
+            self.assertNotEqual(envelope["workflow"]["workflow_sha"], product_commit)
+        self.assertEqual(len(workflows), 5)
+        case_names = [entry["case_id"] for entry in summary["observed"]]
+        self.assertEqual(case_names.count("startup"), 2)
+        self.assertEqual(case_names.count("artifact-identity"), 2)
+
+    def test_missing_case_names_the_case(self):
+        result, summary = self.validate_fixture("missing-case", 1)
+        self.assertIn("missing_case", finding_codes(summary))
+        missing = [f for f in summary["findings"] if f["code"] == "missing_case"]
+        self.assertTrue(any(f.get("case_id") == "startup" for f in missing), missing)
+        self.assertFalse(summary["publish_allowed"])
+
+    def test_duplicate_key_names_the_case(self):
+        result, summary = self.validate_fixture("duplicate-key", 1)
+        self.assertIn("duplicate_key", finding_codes(summary))
+        duplicates = [f for f in summary["findings"] if f["code"] == "duplicate_key"]
+        self.assertTrue(any(f.get("case_id") == "startup" for f in duplicates), duplicates)
+        self.assertFalse(summary["publish_allowed"])
+
+    def test_extra_unplanned_case_names_the_case(self):
+        result, summary = self.validate_fixture("extra-case", 1)
+        self.assertIn("extra_case", finding_codes(summary))
+        extra = [f for f in summary["findings"] if f["code"] == "extra_case"]
+        self.assertTrue(any(f.get("case_id") == "surprise-case" for f in extra), extra)
+        self.assertFalse(summary["publish_allowed"])
+
+    def test_non_pass_required_items_block(self):
+        # Matrix: any skipped / infra_error / quarantined required item blocks
+        # and no official publish write is allowed.
+        for name in ("non-pass-skipped", "non-pass-infra-error", "non-pass-quarantined"):
+            with self.subTest(name=name):
+                result, summary = self.validate_fixture(name, 1)
+                self.assertIn("non_pass", finding_codes(summary))
+                self.assertFalse(summary["publish_allowed"])
+
+    def test_child_workflow_cancellation_blocks(self):
+        result, summary = self.validate_fixture("child-cancelled", 1)
+        self.assertIn("cancelled", finding_codes(summary))
+        self.assertFalse(summary["publish_allowed"])
+
+    def test_batch_timeout_blocks(self):
+        result, summary = self.validate_fixture("timeout", 1)
+        self.assertIn("timeout", finding_codes(summary))
+        self.assertFalse(summary["publish_allowed"])
+
+    def test_same_tag_different_bytes_is_rejected(self):
+        result, summary = self.validate_fixture("same-tag-different-bytes", 1)
+        self.assertIn("digest_mismatch", finding_codes(summary))
+        self.assertFalse(summary["publish_allowed"])
+
+    def test_stale_attempt_cannot_be_reused(self):
+        result, summary = self.validate_fixture("stale-attempt", 1)
+        self.assertIn("stale_attempt", finding_codes(summary))
+        self.assertFalse(summary["publish_allowed"])
+
+    def test_wrong_platform_is_rejected(self):
+        result, summary = self.validate_fixture("wrong-platform", 1)
+        self.assertIn("platform_mismatch", finding_codes(summary))
+        self.assertFalse(summary["publish_allowed"])
+
+    def test_wrong_harness_sha_cannot_be_reused(self):
+        result, summary = self.validate_fixture("wrong-harness", 1)
+        self.assertIn("harness_mismatch", finding_codes(summary))
+        self.assertFalse(summary["publish_allowed"])
+
+    def test_zero_tests_block(self):
+        result, summary = self.validate_fixture("zero-tests", 1)
+        self.assertIn("zero_tests", finding_codes(summary))
+        self.assertFalse(summary["publish_allowed"])
+
+    def test_untrusted_source_blocks(self):
+        # A PR-uploaded or foreign JSON set must never gain release authority.
+        result, summary = self.validate_fixture("untrusted-source", 1)
+        self.assertIn("untrusted_source", finding_codes(summary))
+        self.assertFalse(summary["publish_allowed"])
+
+    def test_swapped_package_after_verification_fails_promotion(self):
+        # Matrix: swapping a published package after verification must fail
+        # verify-promotion.
+        output = self.output / "certified"
+        self.assertEqual(run_validate(FIXTURES / "pass", output).returncode, 0)
+        promote = run_promote(
+            output,
+            artifact=FIXTURES / "promotion-swap" / ARTIFACT_NAME,
+            summary=output,
+        )
+        self.assertEqual(promote.returncode, 1, promote.stdout)
+        self.assertIn("artifact_mismatch", promote.stderr)
+        report = json.loads((output / "promotion-check.json").read_text())
+        self.assertEqual(report["state"], "blocked")
+        self.assertEqual(finding_codes(report), {"artifact_mismatch"})
+
+    def test_edited_plan_after_verification_fails_promotion(self):
+        # Matrix: editing the plan after verification must fail
+        # verify-promotion; the old certification cannot be reused.
+        output = self.output / "certified"
+        self.assertEqual(run_validate(FIXTURES / "pass", output).returncode, 0)
+        promote = run_promote(
+            output,
+            plan=FIXTURES / "promotion-edit" / "plan.json",
+            summary=output,
+        )
+        self.assertEqual(promote.returncode, 1, promote.stdout)
+        self.assertIn("plan_edited", promote.stderr)
+
+    def test_promotion_without_certification_fails(self):
+        output = self.output / "blocked"
+        self.assertEqual(run_validate(FIXTURES / "missing-case", output).returncode, 1)
+        promote = run_promote(output, summary=output)
+        self.assertEqual(promote.returncode, 1, promote.stdout)
+        self.assertIn("certification_missing", promote.stderr)
+
+    def test_summary_junit_and_expansion_are_written(self):
+        output = self.output / "pass"
+        self.assertEqual(run_validate(FIXTURES / "pass", output).returncode, 0)
+        summary = load_summary(output)
+        self.assertEqual(summary["plan_sha256"], json.loads(CANDIDATE.read_text())["plan_sha256"])
+        junit = (output / "release-gate.junit.xml").read_text()
+        self.assertIn("release-gate", junit)
+        self.assertIn("identity/linux-x86_64-gnu/startup", junit)
+        markdown = (output / "release-gate-summary.md").read_text()
+        self.assertIn("state: pass", markdown)
+
+    def test_error_messages_carry_no_credentials(self):
+        for name in ("missing-case", "stale-attempt", "untrusted-source", "zero-tests"):
+            output = self.output / name
+            run_validate(FIXTURES / name, output)
+            text = output.joinpath("release-gate-summary.json").read_text()
+            text += (output / "release-gate-summary.md").read_text()
+            lowered = text.lower()
+            for marker in ("secret", "password", "access_key", "akia", "bearer "):
+                self.assertNotIn(marker, lowered, f"{name} leaked a credential-shaped string")
+
+
+class PlanContractTests(unittest.TestCase):
+    def test_real_plan_is_explicit_about_sources_and_rollback(self):
+        sys.path.insert(0, str(GATE.parent))
+        import release_gate
+
+        plan = json.loads(REAL_PLAN.read_text())
+        info = release_gate.validate_plan(plan)
+        sources = info["upgrade_sources"]
+        self.assertGreaterEqual(len(sources["sources"]), 1)
+        self.assertFalse(sources["rollback_supported"])
+        self.assertTrue(sources["basis"].strip())
+        self.assertTrue(sources["rollback_basis"].strip())
+        for source in sources["sources"]:
+            self.assertEqual(len(source["artifact_sha256"]), 64)
+
+    def test_plan_requires_trusted_workflows_and_frozen_harness(self):
+        sys.path.insert(0, str(GATE.parent))
+        import release_gate
+
+        plan = json.loads(REAL_PLAN.read_text())
+        plan["trusted_workflows"] = []
+        with self.assertRaises(release_gate.GateError):
+            release_gate.validate_plan(plan)
+        plan = json.loads(REAL_PLAN.read_text())
+        plan["lanes"][0]["harness_sha"] = "not-a-sha"
+        with self.assertRaises(release_gate.GateError):
+            release_gate.validate_plan(plan)
+        plan = json.loads(REAL_PLAN.read_text())
+        plan["upgrade_sources"].pop("rollback_supported")
+        with self.assertRaises(release_gate.GateError):
+            release_gate.validate_plan(plan)
+
+    def test_plan_sha256_is_semantic_and_detects_required_set_edits(self):
+        sys.path.insert(0, str(GATE.parent))
+        import release_gate
+
+        plan = json.loads(PLAN.read_text())
+        baseline = release_gate.canonical_sha256(plan)
+        self.assertEqual(release_gate.canonical_sha256(json.loads(json.dumps(plan))), baseline)
+        edited = json.loads(PLAN.read_text())
+        edited["lanes"][0]["cases"] = ["artifact-identity"]
+        self.assertNotEqual(release_gate.canonical_sha256(edited), baseline)
+
+
+class PublicationWiringTests(unittest.TestCase):
+    """Static checks that the real publication exits consume the gate."""
+
+    def read(self, relative):
+        return (ROOT / relative).read_text()
+
+    def job_block(self, workflow, job):
+        match = re.search(
+            rf"^  {re.escape(job)}:\n(.*?)(?=^  [A-Za-z#])",
+            workflow,
+            re.S | re.M,
+        )
+        self.assertIsNotNone(match, f"job {job} not found")
+        return match.group(1)
+
+    def test_build_publish_requires_certification(self):
+        workflow = self.read(".github/workflows/build.yml")
+        self.assertIn("\n  release-certification:", workflow)
+        publish_block = self.job_block(workflow, "publish-release")
+        self.assertIn("release-certification", publish_block)
+        self.assertIn("release_gate.py validate", workflow)
+        self.assertIn("release_gate.py verify-promotion", workflow)
+
+    def test_build_time_official_r2_writes_are_staged(self):
+        workflow = self.read(".github/workflows/build.yml")
+        self.assertIn("artifacts/rustfs/staging/", workflow)
+        release_writes = [
+            line for line in workflow.splitlines()
+            if "artifacts/rustfs/release/" in line
+        ]
+        # Only the certification-gated promotion job may write the official path.
+        self.assertTrue(release_writes, "the promotion job must write the official R2 path")
+        promotion_block = self.job_block(workflow, "promote-release-artifacts")
+        self.assertIn("verify-promotion", promotion_block)
+        self.assertIn("artifacts/rustfs/release/", promotion_block)
+        build_block = self.job_block(workflow, "build-rustfs")
+        self.assertNotIn('R2_PATH="s3://${R2_BUCKET}/artifacts/rustfs/release/"', build_block)
+
+    def test_downstream_workflows_verify_certification(self):
+        docker = self.read(".github/workflows/docker.yml")
+        self.assertIn("\n  release-certification:", docker)
+        build_docker_block = self.job_block(docker, "build-docker")
+        self.assertIn("release-certification", build_docker_block)
+        self.assertIn("verify-promotion", docker)
+        package = self.read(".github/workflows/package.yml")
+        self.assertIn("\n  release-certification:", package)
+        package_block = self.job_block(package, "package")
+        self.assertIn("release-certification", package_block)
+        helm = self.read(".github/workflows/helm-package.yml")
+        self.assertIn("\n  release-certification:", helm)
+        helm_block = self.job_block(helm, "build-helm-package")
+        self.assertIn("release-certification", helm_block)
+
+    def test_manual_downstream_dispatch_without_certification_fails(self):
+        # Every downstream certification job must fail closed when the trusted
+        # certification artifact is absent (e.g. a manual dispatch without one).
+        for relative in (
+            ".github/workflows/docker.yml",
+            ".github/workflows/package.yml",
+            ".github/workflows/helm-package.yml",
+        ):
+            workflow = self.read(relative)
+            certification_block = self.job_block(workflow, "release-certification")
+            self.assertIn("fail", certification_block.lower(), relative)
+            self.assertIn("release-certification", certification_block, relative)
+
+
+if __name__ == "__main__":
+    unittest.main()
@@ -27,7 +27,7 @@ cleanup() {
 }
 trap cleanup EXIT INT TERM

-for command in curl docker python3 awscurl; do
+for command in curl docker python3 aws; do
  command -v "${command}" >/dev/null || {
    echo "missing required command: ${command}" >&2
    exit 1
@@ -192,12 +192,19 @@ print("\t".join(values[field] for field in ("AccessKeyId", "SecretAccessKey", "S
 PY
 )

-awscurl --fail-with-body --service s3 --region us-east-1 \
-  --access_key "${STS_ACCESS_KEY}" \
-  --secret_key "${STS_SECRET_KEY}" \
-  --security_token "${STS_SESSION_TOKEN}" \
-  "${RUSTFS_ORIGIN}/" >"${WORK_DIR}/list-buckets.xml"
-grep -q '<ListAllMyBucketsResult' "${WORK_DIR}/list-buckets.xml"
+# Sign with the STS session to prove the web-identity credentials are usable.
+# The AWS CLI replaces awscurl here: the functional fleet's system Python is
+# PEP 668 managed, so the live gate must not require pip-installed tools. The
+# security suite already requires the AWS CLI. Strip proxy env explicitly
+# (the runners define it) so this localhost request never leaves the host.
+env -u http_proxy -u https_proxy -u HTTP_PROXY -u HTTPS_PROXY \
+  AWS_ACCESS_KEY_ID="${STS_ACCESS_KEY}" \
+  AWS_SECRET_ACCESS_KEY="${STS_SECRET_KEY}" \
+  AWS_SESSION_TOKEN="${STS_SESSION_TOKEN}" \
+  AWS_EC2_METADATA_DISABLED=true \
+  aws --endpoint-url "${RUSTFS_ORIGIN}" --region us-east-1 \
+  s3api list-buckets --output json >"${WORK_DIR}/list-buckets.json"
+grep -q '"Buckets"' "${WORK_DIR}/list-buckets.json"

 TAMPERED_TOKEN="$(python3 - "${GOOD_TOKEN}" <<'PY'
 import sys
@@ -116,7 +116,7 @@ class PlannerTests(unittest.TestCase):
        plan = self.repo.plan(self.repo.commit(), base=baseline)
        self.assertEqual(plan['packages'], ['consumer', 'core', 'leaf', 'rustfs'])
        self.assertEqual(plan['jobs']['connect-feature-boundaries'], 'skipped')
-        for job in ('test-and-lint', 'workspace-tests', 'core-contract', 'e2e-tests',
+        for job in ('workspace-lint-and-build', 'workspace-tests', 'core-contract', 'e2e-tests',
                    's3-implemented-tests', 's3-lifecycle-behavior-tests'):
            self.assertEqual(plan['jobs'][job], 'success')

@@ -233,7 +233,8 @@ class PlannerTests(unittest.TestCase):
        result = subprocess.run([sys.executable, '-I', str(script), 'select'], cwd=self.repo.root, env=env, capture_output=True, text=True)
        self.assertEqual(result.returncode, 0, result.stderr)
        values = dict(line.split('=', 1) for line in output.read_text().splitlines())
-        self.assertEqual(set(values), {'mode', 'plan', 'connect', 'packages', 'full_validation', 'rehearse_shards'})
+        self.assertEqual(set(values), {'mode', 'plan', 'connect', 'packages', 'full_validation', 'rehearse_shards', 'plan_contract'})
+        self.assertEqual(values['plan_contract'], '2')
        plan = json.loads(values['plan'])
        self.assertEqual(plan['policy']['revision'], self.repo.base)
        self.assertEqual(plan['policy']['rollout'], 'shadow')
@@ -295,29 +296,48 @@ class GateTests(unittest.TestCase):
        needs['classify-changes']['outputs'] = {'mode': 'full', 'plan': '{'}
        self.assertTrue(gate.verify_results(needs, 'pull_request', 'refs/heads/main'))

+    def test_plan_from_a_previous_contract_cannot_authorize_the_new_job_set(self):
+        # A base planner predating the NIGHTLY_JOBS contract still emits
+        # connect-feature-boundaries as required success on a pull request. The
+        # current verifier must reject that plan instead of accepting the old
+        # responsibility, so the workflow's contract-marker fallback is the only
+        # path that can widen or narrow the required set.
+        stale = self.plan()
+        stale['jobs'] = dict(stale['jobs'], **{'connect-feature-boundaries': 'success',
+                                              'uring-integration': 'success',
+                                              'test-and-lint-rio-v2': 'success',
+                                              'test-and-lint-protocols': 'success'})
+        stale['not_applicable'] = {job: 'fixture' for job, state in stale['jobs'].items() if state == 'skipped'}
+        expected = gate.expected_results('full', 'pull_request', 'refs/heads/main')
+        self.assertEqual(expected['connect-feature-boundaries'], 'skipped')
+        needs = {job: {'result': result} for job, result in expected.items()}
+        needs['classify-changes']['outputs'] = {'mode': 'full', 'plan': json.dumps(stale, separators=(',', ':')),
+                                                'connect': 'true', 'full_validation': 'true', 'rehearse_shards': 'false'}
+        self.assertTrue(gate.verify_results(needs, 'pull_request', 'refs/heads/main'))
+
    def workflow(self):
        jobs = {}
        for job in gate.ALWAYS_JOBS + gate.CODE_JOBS + gate.OPTIONAL_JOBS:
            # A complete plan lookup is represented by equivalent explicit expressions here.
            if job in gate.ALWAYS_JOBS:
                expression = "true"
-            elif job in gate.EXTENDED_FEATURE_JOBS:
-                expression = "needs.classify-changes.outputs.mode == 'full' && contains(fromJSON('[\"merge_group\",\"schedule\",\"workflow_dispatch\"]'), github.event_name)"
+            elif job == 'connect-feature-boundaries':
+                expression = "needs.classify-changes.outputs.mode == 'full' && needs.classify-changes.outputs.connect == 'true' && contains(fromJSON('[\"schedule\",\"workflow_dispatch\"]'), github.event_name)"
+            elif job in gate.NIGHTLY_JOBS:
+                expression = "needs.classify-changes.outputs.mode == 'full' && contains(fromJSON('[\"schedule\",\"workflow_dispatch\"]'), github.event_name)"
            elif job in gate.OPTIONAL_JOBS[:2]:
                expression = "contains(fromJSON('[\"schedule\",\"workflow_dispatch\"]'), github.event_name)"
            elif job == 'e2e-full':
                expression = "github.event_name == 'merge_group' || github.event_name == 'workflow_dispatch' || (github.event_name == 'push' && github.ref == 'refs/heads/main')"
            elif job in gate.SHARD_JOBS:
                expression = "needs.classify-changes.outputs.rehearse_shards == 'true'"
-            elif job == 'connect-feature-boundaries':
-                expression = "needs.classify-changes.outputs.mode == 'full' && needs.classify-changes.outputs.connect == 'true'"
            elif job in gate.E2E_JOBS:
                expression = "needs.classify-changes.outputs.mode != 'docs'"
            else:
                expression = "needs.classify-changes.outputs.mode == 'full'"
            expression = f"({expression}) && (github.event_name != 'pull_request' || github.event.action != 'closed')"
            jobs[job] = {'name': job, 'if': expression, 'steps': []}
-        jobs['test-and-lint']['steps'] = [{'run': 'cargo clippy --all-targets -- -D warnings'}]
+        jobs['workspace-lint-and-build']['steps'] = [{'run': 'cargo clippy --all-targets -- -D warnings'}]
        jobs['test-and-lint-protocols']['strategy'] = {'matrix': {'features': [
            {'name': 'swift', 'flags': '--features swift'}, {'name': 'sftp', 'flags': '--features sftp'}, {'name': 'http3', 'flags': '--features http3,swift'}]}}
        jobs['required-checks'] = {'name': 'Test and Lint', 'if': "always() && (github.event_name != 'pull_request' || github.event.action != 'closed')",
@@ -387,7 +407,7 @@ class GateTests(unittest.TestCase):
        workflow['jobs']['required-checks']['needs'].reverse()
        for job in ('workspace-tests', 'core-contract', 'e2e-tests', 's3-implemented-tests', 's3-lifecycle-behavior-tests'):
            del workflow['jobs'][job]['if']
-            workflow['jobs'][job]['needs'] = ['test-and-lint' if job == 'workspace-tests' else 'build-rustfs-debug-binary']
+            workflow['jobs'][job]['needs'] = ['workspace-lint-and-build' if job == 'workspace-tests' else 'build-rustfs-debug-binary']
        self.assertEqual(self.check(workflow), [])
        for mutate in (
            lambda w: w['jobs']['required-checks']['needs'].pop(),
@@ -395,7 +415,7 @@ class GateTests(unittest.TestCase):
            lambda w: w['jobs']['required-checks'].update({'if': "'always()' == 'always()'"}),
            lambda w: w['jobs']['required-checks']['steps'][0].update({'run': 'python3 scripts/ci_gate.py verify || true'}),
            lambda w: w['jobs']['typos'].update({'continue-on-error': 'true'}),
-            lambda w: w['jobs']['test-and-lint']['steps'][0].update({'if': 'false'}),
+            lambda w: w['jobs']['workspace-lint-and-build']['steps'][0].update({'if': 'false'}),
            lambda w: w['jobs']['test-and-lint-protocols']['strategy']['matrix']['features'].pop(),
            lambda w: w['jobs'].update({'unaccounted': {'name': 'New'}}),
            lambda w: w['on']['pull_request'].update({'paths': ['README.md']}),
@@ -0,0 +1,29 @@
+{
+  "schema_version": 1,
+  "product_commit": "3333333333333333333333333333333333333333",
+  "version": "9.9.9-fixture",
+  "release_profile": "stable",
+  "features": [
+    "pyroscope"
+  ],
+  "plan_sha256": "578bb57e65df8ba7a63e40aafc254fa644163270b7ec288fe3368bcd7c10ff86",
+  "validation_batch": {
+    "run_id": "fixture-batch-1",
+    "run_attempt": 2
+  },
+  "deliverables": [
+    {
+      "kind": "zip",
+      "name": "rustfs-linux-x86_64-gnu-v9.9.9-fixture.zip",
+      "location": "https://example.invalid/artifacts/runs/fixture-batch-1/2/rustfs-linux-x86_64-gnu-v9.9.9-fixture.zip",
+      "sha256": "ea3ac1fb0ec4aa8fbec650f64ccdbc2543843c8d5734c3915d1b57d7cbb92ec8",
+      "size": 36,
+      "binary_sha256": "7b77e78cc7b8f63a60f8a7101bebed6502f82e03016f4d4e11450f927e0a52fa"
+    }
+  ],
+  "image": {
+    "ref": "example.invalid/rustfs:9.9.9-fixture",
+    "digest": "sha256:5555555555555555555555555555555555555555555555555555555555555555",
+    "binary_sha256": "7b77e78cc7b8f63a60f8a7101bebed6502f82e03016f4d4e11450f927e0a52fa"
+  }
+}
@@ -0,0 +1,6 @@
+{
+  "schema_version": 1,
+  "run_id": "fixture-batch-1",
+  "run_attempt": 2,
+  "status": "completed"
+}
@@ -0,0 +1,42 @@
+{
+  "schema_version": 1,
+  "evidence_profile": "release-artifact",
+  "run_id": "fixture-batch-1",
+  "run_attempt": 2,
+  "plan_sha256": "578bb57e65df8ba7a63e40aafc254fa644163270b7ec288fe3368bcd7c10ff86",
+  "tier": "release-certification",
+  "lane": "identity",
+  "case_id": "artifact-identity",
+  "product_commit": "3333333333333333333333333333333333333333",
+  "harness_commit": "1111111111111111111111111111111111111111",
+  "target_fingerprint": "rustfs-9.9.9-fixture-linux-aarch64-gnu",
+  "platform": {
+    "os": "linux",
+    "arch": "aarch64",
+    "abi": "gnu"
+  },
+  "started_at": "2026-09-26T10:02:00Z",
+  "finished_at": "2026-09-26T10:02:30Z",
+  "state": "pass",
+  "reason_code": "ok",
+  "reason_class": "NOT_APPLICABLE",
+  "evidence": [
+    {
+      "path": "cases/identity/artifact-identity-linux-aarch64-gnu.json",
+      "sha256": "fa138d5891e5098b97137b0edbb4779c4350285fdc76cec7e6214809b34b3075",
+      "size": 64
+    }
+  ],
+  "workflow": {
+    "repository": "rustfs/s3chaos",
+    "workflow_id": "release-gate.yml",
+    "run_id": "child-identity-linux-aarch64-gnu",
+    "run_attempt": 1,
+    "workflow_sha": "1111111111111111111111111111111111111111"
+  },
+  "artifact": {
+    "archive_sha256": "ea3ac1fb0ec4aa8fbec650f64ccdbc2543843c8d5734c3915d1b57d7cbb92ec8",
+    "binary_sha256": "7b77e78cc7b8f63a60f8a7101bebed6502f82e03016f4d4e11450f927e0a52fa",
+    "container_image_digest": "sha256:5555555555555555555555555555555555555555555555555555555555555555"
+  }
+}
@@ -0,0 +1,42 @@
+{
+  "schema_version": 1,
+  "evidence_profile": "release-artifact",
+  "run_id": "fixture-batch-1",
+  "run_attempt": 2,
+  "plan_sha256": "578bb57e65df8ba7a63e40aafc254fa644163270b7ec288fe3368bcd7c10ff86",
+  "tier": "release-certification",
+  "lane": "identity",
+  "case_id": "startup",
+  "product_commit": "3333333333333333333333333333333333333333",
+  "harness_commit": "1111111111111111111111111111111111111111",
+  "target_fingerprint": "rustfs-9.9.9-fixture-linux-aarch64-gnu",
+  "platform": {
+    "os": "linux",
+    "arch": "aarch64",
+    "abi": "gnu"
+  },
+  "started_at": "2026-09-26T10:03:00Z",
+  "finished_at": "2026-09-26T10:03:30Z",
+  "state": "pass",
+  "reason_code": "ok",
+  "reason_class": "NOT_APPLICABLE",
+  "evidence": [
+    {
+      "path": "cases/identity/startup-linux-aarch64-gnu.json",
+      "sha256": "314b19c4fee5f406cbf7ee0d6a436059115f1ff06f6864830045f9d452ab91c9",
+      "size": 64
+    }
+  ],
+  "workflow": {
+    "repository": "rustfs/s3chaos",
+    "workflow_id": "release-gate.yml",
+    "run_id": "child-identity-linux-aarch64-gnu",
+    "run_attempt": 1,
+    "workflow_sha": "1111111111111111111111111111111111111111"
+  },
+  "artifact": {
+    "archive_sha256": "ea3ac1fb0ec4aa8fbec650f64ccdbc2543843c8d5734c3915d1b57d7cbb92ec8",
+    "binary_sha256": "7b77e78cc7b8f63a60f8a7101bebed6502f82e03016f4d4e11450f927e0a52fa",
+    "container_image_digest": "sha256:5555555555555555555555555555555555555555555555555555555555555555"
+  }
+}
@@ -0,0 +1,42 @@
+{
+  "schema_version": 1,
+  "evidence_profile": "release-artifact",
+  "run_id": "fixture-batch-1",
+  "run_attempt": 2,
+  "plan_sha256": "578bb57e65df8ba7a63e40aafc254fa644163270b7ec288fe3368bcd7c10ff86",
+  "tier": "release-certification",
+  "lane": "identity",
+  "case_id": "artifact-identity",
+  "product_commit": "3333333333333333333333333333333333333333",
+  "harness_commit": "1111111111111111111111111111111111111111",
+  "target_fingerprint": "rustfs-9.9.9-fixture-linux-x86_64-gnu",
+  "platform": {
+    "os": "linux",
+    "arch": "x86_64",
+    "abi": "gnu"
+  },
+  "started_at": "2026-09-26T10:00:00Z",
+  "finished_at": "2026-09-26T10:00:30Z",
+  "state": "pass",
+  "reason_code": "ok",
+  "reason_class": "NOT_APPLICABLE",
+  "evidence": [
+    {
+      "path": "cases/identity/artifact-identity-linux-x86_64-gnu.json",
+      "sha256": "37e58ec3fc6fe3ac7ff2fcbeebdb62f6a6aaaa34ec771a0f3306c821da0336f7",
+      "size": 64
+    }
+  ],
+  "workflow": {
+    "repository": "rustfs/s3chaos",
+    "workflow_id": "release-gate.yml",
+    "run_id": "child-identity-linux-x86_64-gnu",
+    "run_attempt": 1,
+    "workflow_sha": "1111111111111111111111111111111111111111"
+  },
+  "artifact": {
+    "archive_sha256": "ea3ac1fb0ec4aa8fbec650f64ccdbc2543843c8d5734c3915d1b57d7cbb92ec8",
+    "binary_sha256": "7b77e78cc7b8f63a60f8a7101bebed6502f82e03016f4d4e11450f927e0a52fa",
+    "container_image_digest": "sha256:5555555555555555555555555555555555555555555555555555555555555555"
+  }
+}
@@ -0,0 +1,43 @@
+{
+  "schema_version": 1,
+  "evidence_profile": "release-artifact",
+  "run_id": "fixture-batch-1",
+  "run_attempt": 2,
+  "plan_sha256": "578bb57e65df8ba7a63e40aafc254fa644163270b7ec288fe3368bcd7c10ff86",
+  "tier": "release-certification",
+  "lane": "identity",
+  "case_id": "startup",
+  "product_commit": "3333333333333333333333333333333333333333",
+  "harness_commit": "1111111111111111111111111111111111111111",
+  "target_fingerprint": "rustfs-9.9.9-fixture-linux-x86_64-gnu",
+  "platform": {
+    "os": "linux",
+    "arch": "x86_64",
+    "abi": "gnu"
+  },
+  "started_at": "2026-09-26T10:01:00Z",
+  "finished_at": "2026-09-26T10:01:30Z",
+  "state": "infra_error",
+  "reason_code": "child-cancelled",
+  "reason_class": "ENV",
+  "evidence": [
+    {
+      "path": "cases/identity/startup-linux-x86_64-gnu.json",
+      "sha256": "8b8774175c55c400b337610a89fe725ad2637af8fcc4973a82ab218f9182b80d",
+      "size": 64
+    }
+  ],
+  "workflow": {
+    "repository": "rustfs/s3chaos",
+    "workflow_id": "release-gate.yml",
+    "run_id": "child-identity-linux-x86_64-gnu",
+    "run_attempt": 1,
+    "workflow_sha": "1111111111111111111111111111111111111111",
+    "status": "cancelled"
+  },
+  "artifact": {
+    "archive_sha256": "ea3ac1fb0ec4aa8fbec650f64ccdbc2543843c8d5734c3915d1b57d7cbb92ec8",
+    "binary_sha256": "7b77e78cc7b8f63a60f8a7101bebed6502f82e03016f4d4e11450f927e0a52fa",
+    "container_image_digest": "sha256:5555555555555555555555555555555555555555555555555555555555555555"
+  }
+}
@@ -0,0 +1,42 @@
+{
+  "schema_version": 1,
+  "evidence_profile": "release-artifact",
+  "run_id": "fixture-batch-1",
+  "run_attempt": 2,
+  "plan_sha256": "578bb57e65df8ba7a63e40aafc254fa644163270b7ec288fe3368bcd7c10ff86",
+  "tier": "release-certification",
+  "lane": "upgrade",
+  "case_id": "upgrade-smoke",
+  "product_commit": "3333333333333333333333333333333333333333",
+  "harness_commit": "2222222222222222222222222222222222222222",
+  "target_fingerprint": "rustfs-9.9.9-fixture-linux-x86_64-gnu",
+  "platform": {
+    "os": "linux",
+    "arch": "x86_64",
+    "abi": "gnu"
+  },
+  "started_at": "2026-09-26T10:04:00Z",
+  "finished_at": "2026-09-26T10:04:30Z",
+  "state": "pass",
+  "reason_code": "ok",
+  "reason_class": "NOT_APPLICABLE",
+  "evidence": [
+    {
+      "path": "cases/upgrade/upgrade-smoke-linux-x86_64-gnu.json",
+      "sha256": "c1ce56808b52859d2590b34b5990aed7bf560b134e44bd0c09f1873c9f764b38",
+      "size": 64
+    }
+  ],
+  "workflow": {
+    "repository": "rustfs/s3chaos",
+    "workflow_id": "release-gate.yml",
+    "run_id": "child-upgrade-linux-x86_64-gnu",
+    "run_attempt": 1,
+    "workflow_sha": "2222222222222222222222222222222222222222"
+  },
+  "artifact": {
+    "archive_sha256": "ea3ac1fb0ec4aa8fbec650f64ccdbc2543843c8d5734c3915d1b57d7cbb92ec8",
+    "binary_sha256": "7b77e78cc7b8f63a60f8a7101bebed6502f82e03016f4d4e11450f927e0a52fa",
+    "container_image_digest": "sha256:5555555555555555555555555555555555555555555555555555555555555555"
+  }
+}
@@ -0,0 +1,6 @@
+{
+  "schema_version": 1,
+  "run_id": "fixture-batch-1",
+  "run_attempt": 2,
+  "status": "completed"
+}
@@ -0,0 +1,42 @@
+{
+  "schema_version": 1,
+  "evidence_profile": "release-artifact",
+  "run_id": "fixture-batch-1",
+  "run_attempt": 2,
+  "plan_sha256": "578bb57e65df8ba7a63e40aafc254fa644163270b7ec288fe3368bcd7c10ff86",
+  "tier": "release-certification",
+  "lane": "identity",
+  "case_id": "artifact-identity",
+  "product_commit": "3333333333333333333333333333333333333333",
+  "harness_commit": "1111111111111111111111111111111111111111",
+  "target_fingerprint": "rustfs-9.9.9-fixture-linux-aarch64-gnu",
+  "platform": {
+    "os": "linux",
+    "arch": "aarch64",
+    "abi": "gnu"
+  },
+  "started_at": "2026-09-26T10:02:00Z",
+  "finished_at": "2026-09-26T10:02:30Z",
+  "state": "pass",
+  "reason_code": "ok",
+  "reason_class": "NOT_APPLICABLE",
+  "evidence": [
+    {
+      "path": "cases/identity/artifact-identity-linux-aarch64-gnu.json",
+      "sha256": "fa138d5891e5098b97137b0edbb4779c4350285fdc76cec7e6214809b34b3075",
+      "size": 64
+    }
+  ],
+  "workflow": {
+    "repository": "rustfs/s3chaos",
+    "workflow_id": "release-gate.yml",
+    "run_id": "child-cross-identity-linux-aarch64-gnu-artifact-identity",
+    "run_attempt": 1,
+    "workflow_sha": "4444444444444444444444444444444444444444"
+  },
+  "artifact": {
+    "archive_sha256": "ea3ac1fb0ec4aa8fbec650f64ccdbc2543843c8d5734c3915d1b57d7cbb92ec8",
+    "binary_sha256": "7b77e78cc7b8f63a60f8a7101bebed6502f82e03016f4d4e11450f927e0a52fa",
+    "container_image_digest": "sha256:5555555555555555555555555555555555555555555555555555555555555555"
+  }
+}
@@ -0,0 +1,42 @@
+{
+  "schema_version": 1,
+  "evidence_profile": "release-artifact",
+  "run_id": "fixture-batch-1",
+  "run_attempt": 2,
+  "plan_sha256": "578bb57e65df8ba7a63e40aafc254fa644163270b7ec288fe3368bcd7c10ff86",
+  "tier": "release-certification",
+  "lane": "identity",
+  "case_id": "startup",
+  "product_commit": "3333333333333333333333333333333333333333",
+  "harness_commit": "1111111111111111111111111111111111111111",
+  "target_fingerprint": "rustfs-9.9.9-fixture-linux-aarch64-gnu",
+  "platform": {
+    "os": "linux",
+    "arch": "aarch64",
+    "abi": "gnu"
+  },
+  "started_at": "2026-09-26T10:03:00Z",
+  "finished_at": "2026-09-26T10:03:30Z",
+  "state": "pass",
+  "reason_code": "ok",
+  "reason_class": "NOT_APPLICABLE",
+  "evidence": [
+    {
+      "path": "cases/identity/startup-linux-aarch64-gnu.json",
+      "sha256": "314b19c4fee5f406cbf7ee0d6a436059115f1ff06f6864830045f9d452ab91c9",
+      "size": 64
+    }
+  ],
+  "workflow": {
+    "repository": "rustfs/s3chaos",
+    "workflow_id": "release-gate.yml",
+    "run_id": "child-cross-identity-linux-aarch64-gnu-startup",
+    "run_attempt": 1,
+    "workflow_sha": "4444444444444444444444444444444444444444"
+  },
+  "artifact": {
+    "archive_sha256": "ea3ac1fb0ec4aa8fbec650f64ccdbc2543843c8d5734c3915d1b57d7cbb92ec8",
+    "binary_sha256": "7b77e78cc7b8f63a60f8a7101bebed6502f82e03016f4d4e11450f927e0a52fa",
+    "container_image_digest": "sha256:5555555555555555555555555555555555555555555555555555555555555555"
+  }
+}
@@ -0,0 +1,42 @@
+{
+  "schema_version": 1,
+  "evidence_profile": "release-artifact",
+  "run_id": "fixture-batch-1",
+  "run_attempt": 2,
+  "plan_sha256": "578bb57e65df8ba7a63e40aafc254fa644163270b7ec288fe3368bcd7c10ff86",
+  "tier": "release-certification",
+  "lane": "identity",
+  "case_id": "artifact-identity",
+  "product_commit": "3333333333333333333333333333333333333333",
+  "harness_commit": "1111111111111111111111111111111111111111",
+  "target_fingerprint": "rustfs-9.9.9-fixture-linux-x86_64-gnu",
+  "platform": {
+    "os": "linux",
+    "arch": "x86_64",
+    "abi": "gnu"
+  },
+  "started_at": "2026-09-26T10:00:00Z",
+  "finished_at": "2026-09-26T10:00:30Z",
+  "state": "pass",
+  "reason_code": "ok",
+  "reason_class": "NOT_APPLICABLE",
+  "evidence": [
+    {
+      "path": "cases/identity/artifact-identity-linux-x86_64-gnu.json",
+      "sha256": "37e58ec3fc6fe3ac7ff2fcbeebdb62f6a6aaaa34ec771a0f3306c821da0336f7",
+      "size": 64
+    }
+  ],
+  "workflow": {
+    "repository": "rustfs/s3chaos",
+    "workflow_id": "release-gate.yml",
+    "run_id": "child-cross-identity-linux-x86_64-gnu-artifact-identity",
+    "run_attempt": 1,
+    "workflow_sha": "4444444444444444444444444444444444444444"
+  },
+  "artifact": {
+    "archive_sha256": "ea3ac1fb0ec4aa8fbec650f64ccdbc2543843c8d5734c3915d1b57d7cbb92ec8",
+    "binary_sha256": "7b77e78cc7b8f63a60f8a7101bebed6502f82e03016f4d4e11450f927e0a52fa",
+    "container_image_digest": "sha256:5555555555555555555555555555555555555555555555555555555555555555"
+  }
+}
@@ -0,0 +1,42 @@
+{
+  "schema_version": 1,
+  "evidence_profile": "release-artifact",
+  "run_id": "fixture-batch-1",
+  "run_attempt": 2,
+  "plan_sha256": "578bb57e65df8ba7a63e40aafc254fa644163270b7ec288fe3368bcd7c10ff86",
+  "tier": "release-certification",
+  "lane": "identity",
+  "case_id": "startup",
+  "product_commit": "3333333333333333333333333333333333333333",
+  "harness_commit": "1111111111111111111111111111111111111111",
+  "target_fingerprint": "rustfs-9.9.9-fixture-linux-x86_64-gnu",
+  "platform": {
+    "os": "linux",
+    "arch": "x86_64",
+    "abi": "gnu"
+  },
+  "started_at": "2026-09-26T10:01:00Z",
+  "finished_at": "2026-09-26T10:01:30Z",
+  "state": "pass",
+  "reason_code": "ok",
+  "reason_class": "NOT_APPLICABLE",
+  "evidence": [
+    {
+      "path": "cases/identity/startup-linux-x86_64-gnu.json",
+      "sha256": "8b8774175c55c400b337610a89fe725ad2637af8fcc4973a82ab218f9182b80d",
+      "size": 64
+    }
+  ],
+  "workflow": {
+    "repository": "rustfs/s3chaos",
+    "workflow_id": "release-gate.yml",
+    "run_id": "child-cross-identity-linux-x86_64-gnu-startup",
+    "run_attempt": 1,
+    "workflow_sha": "4444444444444444444444444444444444444444"
+  },
+  "artifact": {
+    "archive_sha256": "ea3ac1fb0ec4aa8fbec650f64ccdbc2543843c8d5734c3915d1b57d7cbb92ec8",
+    "binary_sha256": "7b77e78cc7b8f63a60f8a7101bebed6502f82e03016f4d4e11450f927e0a52fa",
+    "container_image_digest": "sha256:5555555555555555555555555555555555555555555555555555555555555555"
+  }
+}
@@ -0,0 +1,42 @@
+{
+  "schema_version": 1,
+  "evidence_profile": "release-artifact",
+  "run_id": "fixture-batch-1",
+  "run_attempt": 2,
+  "plan_sha256": "578bb57e65df8ba7a63e40aafc254fa644163270b7ec288fe3368bcd7c10ff86",
+  "tier": "release-certification",
+  "lane": "upgrade",
+  "case_id": "upgrade-smoke",
+  "product_commit": "3333333333333333333333333333333333333333",
+  "harness_commit": "2222222222222222222222222222222222222222",
+  "target_fingerprint": "rustfs-9.9.9-fixture-linux-x86_64-gnu",
+  "platform": {
+    "os": "linux",
+    "arch": "x86_64",
+    "abi": "gnu"
+  },
+  "started_at": "2026-09-26T10:04:00Z",
+  "finished_at": "2026-09-26T10:04:30Z",
+  "state": "pass",
+  "reason_code": "ok",
+  "reason_class": "NOT_APPLICABLE",
+  "evidence": [
+    {
+      "path": "cases/upgrade/upgrade-smoke-linux-x86_64-gnu.json",
+      "sha256": "c1ce56808b52859d2590b34b5990aed7bf560b134e44bd0c09f1873c9f764b38",
+      "size": 64
+    }
+  ],
+  "workflow": {
+    "repository": "rustfs/s3chaos",
+    "workflow_id": "release-gate.yml",
+    "run_id": "child-cross-upgrade-linux-x86_64-gnu-upgrade-smoke",
+    "run_attempt": 1,
+    "workflow_sha": "4444444444444444444444444444444444444444"
+  },
+  "artifact": {
+    "archive_sha256": "ea3ac1fb0ec4aa8fbec650f64ccdbc2543843c8d5734c3915d1b57d7cbb92ec8",
+    "binary_sha256": "7b77e78cc7b8f63a60f8a7101bebed6502f82e03016f4d4e11450f927e0a52fa",
+    "container_image_digest": "sha256:5555555555555555555555555555555555555555555555555555555555555555"
+  }
+}
@@ -0,0 +1,6 @@
+{
+  "schema_version": 1,
+  "run_id": "fixture-batch-1",
+  "run_attempt": 2,
+  "status": "completed"
+}
@@ -0,0 +1,42 @@
+{
+  "schema_version": 1,
+  "evidence_profile": "release-artifact",
+  "run_id": "fixture-batch-1",
+  "run_attempt": 2,
+  "plan_sha256": "578bb57e65df8ba7a63e40aafc254fa644163270b7ec288fe3368bcd7c10ff86",
+  "tier": "release-certification",
+  "lane": "identity",
+  "case_id": "artifact-identity",
+  "product_commit": "3333333333333333333333333333333333333333",
+  "harness_commit": "1111111111111111111111111111111111111111",
+  "target_fingerprint": "rustfs-9.9.9-fixture-linux-aarch64-gnu",
+  "platform": {
+    "os": "linux",
+    "arch": "aarch64",
+    "abi": "gnu"
+  },
+  "started_at": "2026-09-26T10:02:00Z",
+  "finished_at": "2026-09-26T10:02:30Z",
+  "state": "pass",
+  "reason_code": "ok",
+  "reason_class": "NOT_APPLICABLE",
+  "evidence": [
+    {
+      "path": "cases/identity/artifact-identity-linux-aarch64-gnu.json",
+      "sha256": "fa138d5891e5098b97137b0edbb4779c4350285fdc76cec7e6214809b34b3075",
+      "size": 64
+    }
+  ],
+  "workflow": {
+    "repository": "rustfs/s3chaos",
+    "workflow_id": "release-gate.yml",
+    "run_id": "child-identity-linux-aarch64-gnu",
+    "run_attempt": 1,
+    "workflow_sha": "1111111111111111111111111111111111111111"
+  },
+  "artifact": {
+    "archive_sha256": "ea3ac1fb0ec4aa8fbec650f64ccdbc2543843c8d5734c3915d1b57d7cbb92ec8",
+    "binary_sha256": "7b77e78cc7b8f63a60f8a7101bebed6502f82e03016f4d4e11450f927e0a52fa",
+    "container_image_digest": "sha256:5555555555555555555555555555555555555555555555555555555555555555"
+  }
+}
@@ -0,0 +1,42 @@
+{
+  "schema_version": 1,
+  "evidence_profile": "release-artifact",
+  "run_id": "fixture-batch-1",
+  "run_attempt": 2,
+  "plan_sha256": "578bb57e65df8ba7a63e40aafc254fa644163270b7ec288fe3368bcd7c10ff86",
+  "tier": "release-certification",
+  "lane": "identity",
+  "case_id": "startup",
+  "product_commit": "3333333333333333333333333333333333333333",
+  "harness_commit": "1111111111111111111111111111111111111111",
+  "target_fingerprint": "rustfs-9.9.9-fixture-linux-aarch64-gnu",
+  "platform": {
+    "os": "linux",
+    "arch": "aarch64",
+    "abi": "gnu"
+  },
+  "started_at": "2026-09-26T10:03:00Z",
+  "finished_at": "2026-09-26T10:03:30Z",
+  "state": "pass",
+  "reason_code": "ok",
+  "reason_class": "NOT_APPLICABLE",
+  "evidence": [
+    {
+      "path": "cases/identity/startup-linux-aarch64-gnu.json",
+      "sha256": "314b19c4fee5f406cbf7ee0d6a436059115f1ff06f6864830045f9d452ab91c9",
+      "size": 64
+    }
+  ],
+  "workflow": {
+    "repository": "rustfs/s3chaos",
+    "workflow_id": "release-gate.yml",
+    "run_id": "child-identity-linux-aarch64-gnu",
+    "run_attempt": 1,
+    "workflow_sha": "1111111111111111111111111111111111111111"
+  },
+  "artifact": {
+    "archive_sha256": "ea3ac1fb0ec4aa8fbec650f64ccdbc2543843c8d5734c3915d1b57d7cbb92ec8",
+    "binary_sha256": "7b77e78cc7b8f63a60f8a7101bebed6502f82e03016f4d4e11450f927e0a52fa",
+    "container_image_digest": "sha256:5555555555555555555555555555555555555555555555555555555555555555"
+  }
+}
@@ -0,0 +1,42 @@
+{
+  "schema_version": 1,
+  "evidence_profile": "release-artifact",
+  "run_id": "fixture-batch-1",
+  "run_attempt": 2,
+  "plan_sha256": "578bb57e65df8ba7a63e40aafc254fa644163270b7ec288fe3368bcd7c10ff86",
+  "tier": "release-certification",
+  "lane": "identity",
+  "case_id": "artifact-identity",
+  "product_commit": "3333333333333333333333333333333333333333",
+  "harness_commit": "1111111111111111111111111111111111111111",
+  "target_fingerprint": "rustfs-9.9.9-fixture-linux-x86_64-gnu",
+  "platform": {
+    "os": "linux",
+    "arch": "x86_64",
+    "abi": "gnu"
+  },
+  "started_at": "2026-09-26T10:00:00Z",
+  "finished_at": "2026-09-26T10:00:30Z",
+  "state": "pass",
+  "reason_code": "ok",
+  "reason_class": "NOT_APPLICABLE",
+  "evidence": [
+    {
+      "path": "cases/identity/artifact-identity-linux-x86_64-gnu.json",
+      "sha256": "37e58ec3fc6fe3ac7ff2fcbeebdb62f6a6aaaa34ec771a0f3306c821da0336f7",
+      "size": 64
+    }
+  ],
+  "workflow": {
+    "repository": "rustfs/s3chaos",
+    "workflow_id": "release-gate.yml",
+    "run_id": "child-identity-linux-x86_64-gnu",
+    "run_attempt": 1,
+    "workflow_sha": "1111111111111111111111111111111111111111"
+  },
+  "artifact": {
+    "archive_sha256": "ea3ac1fb0ec4aa8fbec650f64ccdbc2543843c8d5734c3915d1b57d7cbb92ec8",
+    "binary_sha256": "7b77e78cc7b8f63a60f8a7101bebed6502f82e03016f4d4e11450f927e0a52fa",
+    "container_image_digest": "sha256:5555555555555555555555555555555555555555555555555555555555555555"
+  }
+}
@@ -0,0 +1,42 @@
+{
+  "schema_version": 1,
+  "evidence_profile": "release-artifact",
+  "run_id": "fixture-batch-1",
+  "run_attempt": 2,
+  "plan_sha256": "578bb57e65df8ba7a63e40aafc254fa644163270b7ec288fe3368bcd7c10ff86",
+  "tier": "release-certification",
+  "lane": "identity",
+  "case_id": "startup",
+  "product_commit": "3333333333333333333333333333333333333333",
+  "harness_commit": "1111111111111111111111111111111111111111",
+  "target_fingerprint": "rustfs-9.9.9-fixture-linux-x86_64-gnu",
+  "platform": {
+    "os": "linux",
+    "arch": "x86_64",
+    "abi": "gnu"
+  },
+  "started_at": "2026-09-26T10:01:00Z",
+  "finished_at": "2026-09-26T10:01:30Z",
+  "state": "pass",
+  "reason_code": "ok",
+  "reason_class": "NOT_APPLICABLE",
+  "evidence": [
+    {
+      "path": "cases/identity/startup-linux-x86_64-gnu.json",
+      "sha256": "8b8774175c55c400b337610a89fe725ad2637af8fcc4973a82ab218f9182b80d",
+      "size": 64
+    }
+  ],
+  "workflow": {
+    "repository": "rustfs/s3chaos",
+    "workflow_id": "release-gate.yml",
+    "run_id": "child-identity-linux-x86_64-gnu",
+    "run_attempt": 1,
+    "workflow_sha": "1111111111111111111111111111111111111111"
+  },
+  "artifact": {
+    "archive_sha256": "ea3ac1fb0ec4aa8fbec650f64ccdbc2543843c8d5734c3915d1b57d7cbb92ec8",
+    "binary_sha256": "7b77e78cc7b8f63a60f8a7101bebed6502f82e03016f4d4e11450f927e0a52fa",
+    "container_image_digest": "sha256:5555555555555555555555555555555555555555555555555555555555555555"
+  }
+}
@@ -0,0 +1,42 @@
+{
+  "schema_version": 1,
+  "evidence_profile": "release-artifact",
+  "run_id": "fixture-batch-1",
+  "run_attempt": 2,
+  "plan_sha256": "578bb57e65df8ba7a63e40aafc254fa644163270b7ec288fe3368bcd7c10ff86",
+  "tier": "release-certification",
+  "lane": "identity",
+  "case_id": "startup",
+  "product_commit": "3333333333333333333333333333333333333333",
+  "harness_commit": "1111111111111111111111111111111111111111",
+  "target_fingerprint": "rustfs-9.9.9-fixture-linux-x86_64-gnu",
+  "platform": {
+    "os": "linux",
+    "arch": "x86_64",
+    "abi": "gnu"
+  },
+  "started_at": "2026-09-26T10:01:00Z",
+  "finished_at": "2026-09-26T10:01:30Z",
+  "state": "pass",
+  "reason_code": "ok",
+  "reason_class": "NOT_APPLICABLE",
+  "evidence": [
+    {
+      "path": "cases/identity/startup-linux-x86_64-gnu.json",
+      "sha256": "8b8774175c55c400b337610a89fe725ad2637af8fcc4973a82ab218f9182b80d",
+      "size": 64
+    }
+  ],
+  "workflow": {
+    "repository": "rustfs/s3chaos",
+    "workflow_id": "release-gate.yml",
+    "run_id": "child-identity-linux-x86_64-gnu",
+    "run_attempt": 1,
+    "workflow_sha": "1111111111111111111111111111111111111111"
+  },
+  "artifact": {
+    "archive_sha256": "ea3ac1fb0ec4aa8fbec650f64ccdbc2543843c8d5734c3915d1b57d7cbb92ec8",
+    "binary_sha256": "7b77e78cc7b8f63a60f8a7101bebed6502f82e03016f4d4e11450f927e0a52fa",
+    "container_image_digest": "sha256:5555555555555555555555555555555555555555555555555555555555555555"
+  }
+}
@@ -0,0 +1,42 @@
+{
+  "schema_version": 1,
+  "evidence_profile": "release-artifact",
+  "run_id": "fixture-batch-1",
+  "run_attempt": 2,
+  "plan_sha256": "578bb57e65df8ba7a63e40aafc254fa644163270b7ec288fe3368bcd7c10ff86",
+  "tier": "release-certification",
+  "lane": "upgrade",
+  "case_id": "upgrade-smoke",
+  "product_commit": "3333333333333333333333333333333333333333",
+  "harness_commit": "2222222222222222222222222222222222222222",
+  "target_fingerprint": "rustfs-9.9.9-fixture-linux-x86_64-gnu",
+  "platform": {
+    "os": "linux",
+    "arch": "x86_64",
+    "abi": "gnu"
+  },
+  "started_at": "2026-09-26T10:04:00Z",
+  "finished_at": "2026-09-26T10:04:30Z",
+  "state": "pass",
+  "reason_code": "ok",
+  "reason_class": "NOT_APPLICABLE",
+  "evidence": [
+    {
+      "path": "cases/upgrade/upgrade-smoke-linux-x86_64-gnu.json",
+      "sha256": "c1ce56808b52859d2590b34b5990aed7bf560b134e44bd0c09f1873c9f764b38",
+      "size": 64
+    }
+  ],
+  "workflow": {
+    "repository": "rustfs/s3chaos",
+    "workflow_id": "release-gate.yml",
+    "run_id": "child-upgrade-linux-x86_64-gnu",
+    "run_attempt": 1,
+    "workflow_sha": "2222222222222222222222222222222222222222"
+  },
+  "artifact": {
+    "archive_sha256": "ea3ac1fb0ec4aa8fbec650f64ccdbc2543843c8d5734c3915d1b57d7cbb92ec8",
+    "binary_sha256": "7b77e78cc7b8f63a60f8a7101bebed6502f82e03016f4d4e11450f927e0a52fa",
+    "container_image_digest": "sha256:5555555555555555555555555555555555555555555555555555555555555555"
+  }
+}
@@ -0,0 +1,6 @@
+{
+  "schema_version": 1,
+  "run_id": "fixture-batch-1",
+  "run_attempt": 2,
+  "status": "completed"
+}
@@ -0,0 +1,42 @@
+{
+  "schema_version": 1,
+  "evidence_profile": "release-artifact",
+  "run_id": "fixture-batch-1",
+  "run_attempt": 2,
+  "plan_sha256": "578bb57e65df8ba7a63e40aafc254fa644163270b7ec288fe3368bcd7c10ff86",
+  "tier": "release-certification",
+  "lane": "identity",
+  "case_id": "artifact-identity",
+  "product_commit": "3333333333333333333333333333333333333333",
+  "harness_commit": "1111111111111111111111111111111111111111",
+  "target_fingerprint": "rustfs-9.9.9-fixture-linux-aarch64-gnu",
+  "platform": {
+    "os": "linux",
+    "arch": "aarch64",
+    "abi": "gnu"
+  },
+  "started_at": "2026-09-26T10:02:00Z",
+  "finished_at": "2026-09-26T10:02:30Z",
+  "state": "pass",
+  "reason_code": "ok",
+  "reason_class": "NOT_APPLICABLE",
+  "evidence": [
+    {
+      "path": "cases/identity/artifact-identity-linux-aarch64-gnu.json",
+      "sha256": "fa138d5891e5098b97137b0edbb4779c4350285fdc76cec7e6214809b34b3075",
+      "size": 64
+    }
+  ],
+  "workflow": {
+    "repository": "rustfs/s3chaos",
+    "workflow_id": "release-gate.yml",
+    "run_id": "child-identity-linux-aarch64-gnu",
+    "run_attempt": 1,
+    "workflow_sha": "1111111111111111111111111111111111111111"
+  },
+  "artifact": {
+    "archive_sha256": "ea3ac1fb0ec4aa8fbec650f64ccdbc2543843c8d5734c3915d1b57d7cbb92ec8",
+    "binary_sha256": "7b77e78cc7b8f63a60f8a7101bebed6502f82e03016f4d4e11450f927e0a52fa",
+    "container_image_digest": "sha256:5555555555555555555555555555555555555555555555555555555555555555"
+  }
+}
@@ -0,0 +1,42 @@
+{
+  "schema_version": 1,
+  "evidence_profile": "release-artifact",
+  "run_id": "fixture-batch-1",
+  "run_attempt": 2,
+  "plan_sha256": "578bb57e65df8ba7a63e40aafc254fa644163270b7ec288fe3368bcd7c10ff86",
+  "tier": "release-certification",
+  "lane": "identity",
+  "case_id": "startup",
+  "product_commit": "3333333333333333333333333333333333333333",
+  "harness_commit": "1111111111111111111111111111111111111111",
+  "target_fingerprint": "rustfs-9.9.9-fixture-linux-aarch64-gnu",
+  "platform": {
+    "os": "linux",
+    "arch": "aarch64",
+    "abi": "gnu"
+  },
+  "started_at": "2026-09-26T10:03:00Z",
+  "finished_at": "2026-09-26T10:03:30Z",
+  "state": "pass",
+  "reason_code": "ok",
+  "reason_class": "NOT_APPLICABLE",
+  "evidence": [
+    {
+      "path": "cases/identity/startup-linux-aarch64-gnu.json",
+      "sha256": "314b19c4fee5f406cbf7ee0d6a436059115f1ff06f6864830045f9d452ab91c9",
+      "size": 64
+    }
+  ],
+  "workflow": {
+    "repository": "rustfs/s3chaos",
+    "workflow_id": "release-gate.yml",
+    "run_id": "child-identity-linux-aarch64-gnu",
+    "run_attempt": 1,
+    "workflow_sha": "1111111111111111111111111111111111111111"
+  },
+  "artifact": {
+    "archive_sha256": "ea3ac1fb0ec4aa8fbec650f64ccdbc2543843c8d5734c3915d1b57d7cbb92ec8",
+    "binary_sha256": "7b77e78cc7b8f63a60f8a7101bebed6502f82e03016f4d4e11450f927e0a52fa",
+    "container_image_digest": "sha256:5555555555555555555555555555555555555555555555555555555555555555"
+  }
+}
@@ -0,0 +1,42 @@
+{
+  "schema_version": 1,
+  "evidence_profile": "release-artifact",
+  "run_id": "fixture-batch-1",
+  "run_attempt": 2,
+  "plan_sha256": "578bb57e65df8ba7a63e40aafc254fa644163270b7ec288fe3368bcd7c10ff86",
+  "tier": "release-certification",
+  "lane": "identity",
+  "case_id": "artifact-identity",
+  "product_commit": "3333333333333333333333333333333333333333",
+  "harness_commit": "1111111111111111111111111111111111111111",
+  "target_fingerprint": "rustfs-9.9.9-fixture-linux-x86_64-gnu",
+  "platform": {
+    "os": "linux",
+    "arch": "x86_64",
+    "abi": "gnu"
+  },
+  "started_at": "2026-09-26T10:00:00Z",
+  "finished_at": "2026-09-26T10:00:30Z",
+  "state": "pass",
+  "reason_code": "ok",
+  "reason_class": "NOT_APPLICABLE",
+  "evidence": [
+    {
+      "path": "cases/identity/artifact-identity-linux-x86_64-gnu.json",
+      "sha256": "37e58ec3fc6fe3ac7ff2fcbeebdb62f6a6aaaa34ec771a0f3306c821da0336f7",
+      "size": 64
+    }
+  ],
+  "workflow": {
+    "repository": "rustfs/s3chaos",
+    "workflow_id": "release-gate.yml",
+    "run_id": "child-identity-linux-x86_64-gnu",
+    "run_attempt": 1,
+    "workflow_sha": "1111111111111111111111111111111111111111"
+  },
+  "artifact": {
+    "archive_sha256": "ea3ac1fb0ec4aa8fbec650f64ccdbc2543843c8d5734c3915d1b57d7cbb92ec8",
+    "binary_sha256": "7b77e78cc7b8f63a60f8a7101bebed6502f82e03016f4d4e11450f927e0a52fa",
+    "container_image_digest": "sha256:5555555555555555555555555555555555555555555555555555555555555555"
+  }
+}
@@ -0,0 +1,42 @@
+{
+  "schema_version": 1,
+  "evidence_profile": "release-artifact",
+  "run_id": "fixture-batch-1",
+  "run_attempt": 2,
+  "plan_sha256": "578bb57e65df8ba7a63e40aafc254fa644163270b7ec288fe3368bcd7c10ff86",
+  "tier": "release-certification",
+  "lane": "identity",
+  "case_id": "startup",
+  "product_commit": "3333333333333333333333333333333333333333",
+  "harness_commit": "1111111111111111111111111111111111111111",
+  "target_fingerprint": "rustfs-9.9.9-fixture-linux-x86_64-gnu",
+  "platform": {
+    "os": "linux",
+    "arch": "x86_64",
+    "abi": "gnu"
+  },
+  "started_at": "2026-09-26T10:01:00Z",
+  "finished_at": "2026-09-26T10:01:30Z",
+  "state": "pass",
+  "reason_code": "ok",
+  "reason_class": "NOT_APPLICABLE",
+  "evidence": [
+    {
+      "path": "cases/identity/startup-linux-x86_64-gnu.json",
+      "sha256": "8b8774175c55c400b337610a89fe725ad2637af8fcc4973a82ab218f9182b80d",
+      "size": 64
+    }
+  ],
+  "workflow": {
+    "repository": "rustfs/s3chaos",
+    "workflow_id": "release-gate.yml",
+    "run_id": "child-identity-linux-x86_64-gnu",
+    "run_attempt": 1,
+    "workflow_sha": "1111111111111111111111111111111111111111"
+  },
+  "artifact": {
+    "archive_sha256": "ea3ac1fb0ec4aa8fbec650f64ccdbc2543843c8d5734c3915d1b57d7cbb92ec8",
+    "binary_sha256": "7b77e78cc7b8f63a60f8a7101bebed6502f82e03016f4d4e11450f927e0a52fa",
+    "container_image_digest": "sha256:5555555555555555555555555555555555555555555555555555555555555555"
+  }
+}
@@ -0,0 +1,42 @@
+{
+  "schema_version": 1,
+  "evidence_profile": "release-artifact",
+  "run_id": "fixture-batch-1",
+  "run_attempt": 2,
+  "plan_sha256": "578bb57e65df8ba7a63e40aafc254fa644163270b7ec288fe3368bcd7c10ff86",
+  "tier": "release-certification",
+  "lane": "identity",
+  "case_id": "surprise-case",
+  "product_commit": "3333333333333333333333333333333333333333",
+  "harness_commit": "1111111111111111111111111111111111111111",
+  "target_fingerprint": "rustfs-9.9.9-fixture-linux-x86_64-gnu",
+  "platform": {
+    "os": "linux",
+    "arch": "x86_64",
+    "abi": "gnu"
+  },
+  "started_at": "2026-09-26T10:05:00Z",
+  "finished_at": "2026-09-26T10:05:30Z",
+  "state": "pass",
+  "reason_code": "ok",
+  "reason_class": "NOT_APPLICABLE",
+  "evidence": [
+    {
+      "path": "cases/identity/surprise-case-linux-x86_64-gnu.json",
+      "sha256": "f82eedac16c983bd426ca24a6cbf3acfa032dc722e9c4a5ed7ef21c7eff0bcb1",
+      "size": 64
+    }
+  ],
+  "workflow": {
+    "repository": "rustfs/s3chaos",
+    "workflow_id": "release-gate.yml",
+    "run_id": "child-identity-linux-x86_64-gnu",
+    "run_attempt": 1,
+    "workflow_sha": "1111111111111111111111111111111111111111"
+  },
+  "artifact": {
+    "archive_sha256": "ea3ac1fb0ec4aa8fbec650f64ccdbc2543843c8d5734c3915d1b57d7cbb92ec8",
+    "binary_sha256": "7b77e78cc7b8f63a60f8a7101bebed6502f82e03016f4d4e11450f927e0a52fa",
+    "container_image_digest": "sha256:5555555555555555555555555555555555555555555555555555555555555555"
+  }
+}
@@ -0,0 +1,42 @@
+{
+  "schema_version": 1,
+  "evidence_profile": "release-artifact",
+  "run_id": "fixture-batch-1",
+  "run_attempt": 2,
+  "plan_sha256": "578bb57e65df8ba7a63e40aafc254fa644163270b7ec288fe3368bcd7c10ff86",
+  "tier": "release-certification",
+  "lane": "upgrade",
+  "case_id": "upgrade-smoke",
+  "product_commit": "3333333333333333333333333333333333333333",
+  "harness_commit": "2222222222222222222222222222222222222222",
+  "target_fingerprint": "rustfs-9.9.9-fixture-linux-x86_64-gnu",
+  "platform": {
+    "os": "linux",
+    "arch": "x86_64",
+    "abi": "gnu"
+  },
+  "started_at": "2026-09-26T10:04:00Z",
+  "finished_at": "2026-09-26T10:04:30Z",
+  "state": "pass",
+  "reason_code": "ok",
+  "reason_class": "NOT_APPLICABLE",
+  "evidence": [
+    {
+      "path": "cases/upgrade/upgrade-smoke-linux-x86_64-gnu.json",
+      "sha256": "c1ce56808b52859d2590b34b5990aed7bf560b134e44bd0c09f1873c9f764b38",
+      "size": 64
+    }
+  ],
+  "workflow": {
+    "repository": "rustfs/s3chaos",
+    "workflow_id": "release-gate.yml",
+    "run_id": "child-upgrade-linux-x86_64-gnu",
+    "run_attempt": 1,
+    "workflow_sha": "2222222222222222222222222222222222222222"
+  },
+  "artifact": {
+    "archive_sha256": "ea3ac1fb0ec4aa8fbec650f64ccdbc2543843c8d5734c3915d1b57d7cbb92ec8",
+    "binary_sha256": "7b77e78cc7b8f63a60f8a7101bebed6502f82e03016f4d4e11450f927e0a52fa",
+    "container_image_digest": "sha256:5555555555555555555555555555555555555555555555555555555555555555"
+  }
+}
@@ -0,0 +1,6 @@
+{
+  "schema_version": 1,
+  "run_id": "fixture-batch-1",
+  "run_attempt": 2,
+  "status": "completed"
+}
@@ -0,0 +1,42 @@
+{
+  "schema_version": 1,
+  "evidence_profile": "release-artifact",
+  "run_id": "fixture-batch-1",
+  "run_attempt": 2,
+  "plan_sha256": "578bb57e65df8ba7a63e40aafc254fa644163270b7ec288fe3368bcd7c10ff86",
+  "tier": "release-certification",
+  "lane": "identity",
+  "case_id": "artifact-identity",
+  "product_commit": "3333333333333333333333333333333333333333",
+  "harness_commit": "1111111111111111111111111111111111111111",
+  "target_fingerprint": "rustfs-9.9.9-fixture-linux-aarch64-gnu",
+  "platform": {
+    "os": "linux",
+    "arch": "aarch64",
+    "abi": "gnu"
+  },
+  "started_at": "2026-09-26T10:02:00Z",
+  "finished_at": "2026-09-26T10:02:30Z",
+  "state": "pass",
+  "reason_code": "ok",
+  "reason_class": "NOT_APPLICABLE",
+  "evidence": [
+    {
+      "path": "cases/identity/artifact-identity-linux-aarch64-gnu.json",
+      "sha256": "fa138d5891e5098b97137b0edbb4779c4350285fdc76cec7e6214809b34b3075",
+      "size": 64
+    }
+  ],
+  "workflow": {
+    "repository": "rustfs/s3chaos",
+    "workflow_id": "release-gate.yml",
+    "run_id": "child-identity-linux-aarch64-gnu",
+    "run_attempt": 1,
+    "workflow_sha": "1111111111111111111111111111111111111111"
+  },
+  "artifact": {
+    "archive_sha256": "ea3ac1fb0ec4aa8fbec650f64ccdbc2543843c8d5734c3915d1b57d7cbb92ec8",
+    "binary_sha256": "7b77e78cc7b8f63a60f8a7101bebed6502f82e03016f4d4e11450f927e0a52fa",
+    "container_image_digest": "sha256:5555555555555555555555555555555555555555555555555555555555555555"
+  }
+}
@@ -0,0 +1,42 @@
+{
+  "schema_version": 1,
+  "evidence_profile": "release-artifact",
+  "run_id": "fixture-batch-1",
+  "run_attempt": 2,
+  "plan_sha256": "578bb57e65df8ba7a63e40aafc254fa644163270b7ec288fe3368bcd7c10ff86",
+  "tier": "release-certification",
+  "lane": "identity",
+  "case_id": "artifact-identity",
+  "product_commit": "3333333333333333333333333333333333333333",
+  "harness_commit": "1111111111111111111111111111111111111111",
+  "target_fingerprint": "rustfs-9.9.9-fixture-linux-x86_64-gnu",
+  "platform": {
+    "os": "linux",
+    "arch": "x86_64",
+    "abi": "gnu"
+  },
+  "started_at": "2026-09-26T10:00:00Z",
+  "finished_at": "2026-09-26T10:00:30Z",
+  "state": "pass",
+  "reason_code": "ok",
+  "reason_class": "NOT_APPLICABLE",
+  "evidence": [
+    {
+      "path": "cases/identity/artifact-identity-linux-x86_64-gnu.json",
+      "sha256": "37e58ec3fc6fe3ac7ff2fcbeebdb62f6a6aaaa34ec771a0f3306c821da0336f7",
+      "size": 64
+    }
+  ],
+  "workflow": {
+    "repository": "rustfs/s3chaos",
+    "workflow_id": "release-gate.yml",
+    "run_id": "child-identity-linux-x86_64-gnu",
+    "run_attempt": 1,
+    "workflow_sha": "1111111111111111111111111111111111111111"
+  },
+  "artifact": {
+    "archive_sha256": "ea3ac1fb0ec4aa8fbec650f64ccdbc2543843c8d5734c3915d1b57d7cbb92ec8",
+    "binary_sha256": "7b77e78cc7b8f63a60f8a7101bebed6502f82e03016f4d4e11450f927e0a52fa",
+    "container_image_digest": "sha256:5555555555555555555555555555555555555555555555555555555555555555"
+  }
+}
@@ -0,0 +1,42 @@
+{
+  "schema_version": 1,
+  "evidence_profile": "release-artifact",
+  "run_id": "fixture-batch-1",
+  "run_attempt": 2,
+  "plan_sha256": "578bb57e65df8ba7a63e40aafc254fa644163270b7ec288fe3368bcd7c10ff86",
+  "tier": "release-certification",
+  "lane": "identity",
+  "case_id": "startup",
+  "product_commit": "3333333333333333333333333333333333333333",
+  "harness_commit": "1111111111111111111111111111111111111111",
+  "target_fingerprint": "rustfs-9.9.9-fixture-linux-x86_64-gnu",
+  "platform": {
+    "os": "linux",
+    "arch": "x86_64",
+    "abi": "gnu"
+  },
+  "started_at": "2026-09-26T10:01:00Z",
+  "finished_at": "2026-09-26T10:01:30Z",
+  "state": "pass",
+  "reason_code": "ok",
+  "reason_class": "NOT_APPLICABLE",
+  "evidence": [
+    {
+      "path": "cases/identity/startup-linux-x86_64-gnu.json",
+      "sha256": "8b8774175c55c400b337610a89fe725ad2637af8fcc4973a82ab218f9182b80d",
+      "size": 64
+    }
+  ],
+  "workflow": {
+    "repository": "rustfs/s3chaos",
+    "workflow_id": "release-gate.yml",
+    "run_id": "child-identity-linux-x86_64-gnu",
+    "run_attempt": 1,
+    "workflow_sha": "1111111111111111111111111111111111111111"
+  },
+  "artifact": {
+    "archive_sha256": "ea3ac1fb0ec4aa8fbec650f64ccdbc2543843c8d5734c3915d1b57d7cbb92ec8",
+    "binary_sha256": "7b77e78cc7b8f63a60f8a7101bebed6502f82e03016f4d4e11450f927e0a52fa",
+    "container_image_digest": "sha256:5555555555555555555555555555555555555555555555555555555555555555"
+  }
+}
@@ -0,0 +1,42 @@
+{
+  "schema_version": 1,
+  "evidence_profile": "release-artifact",
+  "run_id": "fixture-batch-1",
+  "run_attempt": 2,
+  "plan_sha256": "578bb57e65df8ba7a63e40aafc254fa644163270b7ec288fe3368bcd7c10ff86",
+  "tier": "release-certification",
+  "lane": "upgrade",
+  "case_id": "upgrade-smoke",
+  "product_commit": "3333333333333333333333333333333333333333",
+  "harness_commit": "2222222222222222222222222222222222222222",
+  "target_fingerprint": "rustfs-9.9.9-fixture-linux-x86_64-gnu",
+  "platform": {
+    "os": "linux",
+    "arch": "x86_64",
+    "abi": "gnu"
+  },
+  "started_at": "2026-09-26T10:04:00Z",
+  "finished_at": "2026-09-26T10:04:30Z",
+  "state": "pass",
+  "reason_code": "ok",
+  "reason_class": "NOT_APPLICABLE",
+  "evidence": [
+    {
+      "path": "cases/upgrade/upgrade-smoke-linux-x86_64-gnu.json",
+      "sha256": "c1ce56808b52859d2590b34b5990aed7bf560b134e44bd0c09f1873c9f764b38",
+      "size": 64
+    }
+  ],
+  "workflow": {
+    "repository": "rustfs/s3chaos",
+    "workflow_id": "release-gate.yml",
+    "run_id": "child-upgrade-linux-x86_64-gnu",
+    "run_attempt": 1,
+    "workflow_sha": "2222222222222222222222222222222222222222"
+  },
+  "artifact": {
+    "archive_sha256": "ea3ac1fb0ec4aa8fbec650f64ccdbc2543843c8d5734c3915d1b57d7cbb92ec8",
+    "binary_sha256": "7b77e78cc7b8f63a60f8a7101bebed6502f82e03016f4d4e11450f927e0a52fa",
+    "container_image_digest": "sha256:5555555555555555555555555555555555555555555555555555555555555555"
+  }
+}
@@ -0,0 +1,6 @@
+{
+  "schema_version": 1,
+  "run_id": "fixture-batch-1",
+  "run_attempt": 2,
+  "status": "completed"
+}
@@ -0,0 +1,42 @@
+{
+  "schema_version": 1,
+  "evidence_profile": "release-artifact",
+  "run_id": "fixture-batch-1",
+  "run_attempt": 2,
+  "plan_sha256": "578bb57e65df8ba7a63e40aafc254fa644163270b7ec288fe3368bcd7c10ff86",
+  "tier": "release-certification",
+  "lane": "identity",
+  "case_id": "artifact-identity",
+  "product_commit": "3333333333333333333333333333333333333333",
+  "harness_commit": "1111111111111111111111111111111111111111",
+  "target_fingerprint": "rustfs-9.9.9-fixture-linux-aarch64-gnu",
+  "platform": {
+    "os": "linux",
+    "arch": "aarch64",
+    "abi": "gnu"
+  },
+  "started_at": "2026-09-26T10:02:00Z",
+  "finished_at": "2026-09-26T10:02:30Z",
+  "state": "pass",
+  "reason_code": "ok",
+  "reason_class": "NOT_APPLICABLE",
+  "evidence": [
+    {
+      "path": "cases/identity/artifact-identity-linux-aarch64-gnu.json",
+      "sha256": "fa138d5891e5098b97137b0edbb4779c4350285fdc76cec7e6214809b34b3075",
+      "size": 64
+    }
+  ],
+  "workflow": {
+    "repository": "rustfs/s3chaos",
+    "workflow_id": "release-gate.yml",
+    "run_id": "child-identity-linux-aarch64-gnu",
+    "run_attempt": 1,
+    "workflow_sha": "1111111111111111111111111111111111111111"
+  },
+  "artifact": {
+    "archive_sha256": "ea3ac1fb0ec4aa8fbec650f64ccdbc2543843c8d5734c3915d1b57d7cbb92ec8",
+    "binary_sha256": "7b77e78cc7b8f63a60f8a7101bebed6502f82e03016f4d4e11450f927e0a52fa",
+    "container_image_digest": "sha256:5555555555555555555555555555555555555555555555555555555555555555"
+  }
+}
@@ -0,0 +1,42 @@
+{
+  "schema_version": 1,
+  "evidence_profile": "release-artifact",
+  "run_id": "fixture-batch-1",
+  "run_attempt": 2,
+  "plan_sha256": "578bb57e65df8ba7a63e40aafc254fa644163270b7ec288fe3368bcd7c10ff86",
+  "tier": "release-certification",
+  "lane": "identity",
+  "case_id": "startup",
+  "product_commit": "3333333333333333333333333333333333333333",
+  "harness_commit": "1111111111111111111111111111111111111111",
+  "target_fingerprint": "rustfs-9.9.9-fixture-linux-aarch64-gnu",
+  "platform": {
+    "os": "linux",
+    "arch": "aarch64",
+    "abi": "gnu"
+  },
+  "started_at": "2026-09-26T10:03:00Z",
+  "finished_at": "2026-09-26T10:03:30Z",
+  "state": "pass",
+  "reason_code": "ok",
+  "reason_class": "NOT_APPLICABLE",
+  "evidence": [
+    {
+      "path": "cases/identity/startup-linux-aarch64-gnu.json",
+      "sha256": "314b19c4fee5f406cbf7ee0d6a436059115f1ff06f6864830045f9d452ab91c9",
+      "size": 64
+    }
+  ],
+  "workflow": {
+    "repository": "rustfs/s3chaos",
+    "workflow_id": "release-gate.yml",
+    "run_id": "child-identity-linux-aarch64-gnu",
+    "run_attempt": 1,
+    "workflow_sha": "1111111111111111111111111111111111111111"
+  },
+  "artifact": {
+    "archive_sha256": "ea3ac1fb0ec4aa8fbec650f64ccdbc2543843c8d5734c3915d1b57d7cbb92ec8",
+    "binary_sha256": "7b77e78cc7b8f63a60f8a7101bebed6502f82e03016f4d4e11450f927e0a52fa",
+    "container_image_digest": "sha256:5555555555555555555555555555555555555555555555555555555555555555"
+  }
+}
@@ -0,0 +1,42 @@
+{
+  "schema_version": 1,
+  "evidence_profile": "release-artifact",
+  "run_id": "fixture-batch-1",
+  "run_attempt": 2,
+  "plan_sha256": "578bb57e65df8ba7a63e40aafc254fa644163270b7ec288fe3368bcd7c10ff86",
+  "tier": "release-certification",
+  "lane": "identity",
+  "case_id": "artifact-identity",
+  "product_commit": "3333333333333333333333333333333333333333",
+  "harness_commit": "1111111111111111111111111111111111111111",
+  "target_fingerprint": "rustfs-9.9.9-fixture-linux-x86_64-gnu",
+  "platform": {
+    "os": "linux",
+    "arch": "x86_64",
+    "abi": "gnu"
+  },
+  "started_at": "2026-09-26T10:00:00Z",
+  "finished_at": "2026-09-26T10:00:30Z",
+  "state": "pass",
+  "reason_code": "ok",
+  "reason_class": "NOT_APPLICABLE",
+  "evidence": [
+    {
+      "path": "cases/identity/artifact-identity-linux-x86_64-gnu.json",
+      "sha256": "37e58ec3fc6fe3ac7ff2fcbeebdb62f6a6aaaa34ec771a0f3306c821da0336f7",
+      "size": 64
+    }
+  ],
+  "workflow": {
+    "repository": "rustfs/s3chaos",
+    "workflow_id": "release-gate.yml",
+    "run_id": "child-identity-linux-x86_64-gnu",
+    "run_attempt": 1,
+    "workflow_sha": "1111111111111111111111111111111111111111"
+  },
+  "artifact": {
+    "archive_sha256": "ea3ac1fb0ec4aa8fbec650f64ccdbc2543843c8d5734c3915d1b57d7cbb92ec8",
+    "binary_sha256": "7b77e78cc7b8f63a60f8a7101bebed6502f82e03016f4d4e11450f927e0a52fa",
+    "container_image_digest": "sha256:5555555555555555555555555555555555555555555555555555555555555555"
+  }
+}
@@ -0,0 +1,42 @@
+{
+  "schema_version": 1,
+  "evidence_profile": "release-artifact",
+  "run_id": "fixture-batch-1",
+  "run_attempt": 2,
+  "plan_sha256": "578bb57e65df8ba7a63e40aafc254fa644163270b7ec288fe3368bcd7c10ff86",
+  "tier": "release-certification",
+  "lane": "identity",
+  "case_id": "startup",
+  "product_commit": "3333333333333333333333333333333333333333",
+  "harness_commit": "1111111111111111111111111111111111111111",
+  "target_fingerprint": "rustfs-9.9.9-fixture-linux-x86_64-gnu",
+  "platform": {
+    "os": "linux",
+    "arch": "x86_64",
+    "abi": "gnu"
+  },
+  "started_at": "2026-09-26T10:01:00Z",
+  "finished_at": "2026-09-26T10:01:30Z",
+  "state": "infra_error",
+  "reason_code": "fixture-infra_error",
+  "reason_class": "NOT_APPLICABLE",
+  "evidence": [
+    {
+      "path": "cases/identity/startup-linux-x86_64-gnu.json",
+      "sha256": "8b8774175c55c400b337610a89fe725ad2637af8fcc4973a82ab218f9182b80d",
+      "size": 64
+    }
+  ],
+  "workflow": {
+    "repository": "rustfs/s3chaos",
+    "workflow_id": "release-gate.yml",
+    "run_id": "child-identity-linux-x86_64-gnu",
+    "run_attempt": 1,
+    "workflow_sha": "1111111111111111111111111111111111111111"
+  },
+  "artifact": {
+    "archive_sha256": "ea3ac1fb0ec4aa8fbec650f64ccdbc2543843c8d5734c3915d1b57d7cbb92ec8",
+    "binary_sha256": "7b77e78cc7b8f63a60f8a7101bebed6502f82e03016f4d4e11450f927e0a52fa",
+    "container_image_digest": "sha256:5555555555555555555555555555555555555555555555555555555555555555"
+  }
+}
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
Hauser	0b402cd661	test(e2e): isolate mc mirror fixture in full suite Co-Authored-By: heihutu <heihutu@gmail.com> Co-Authored-By: zhi22915 <qiuzgang@gmail.com>	2026-11-01 02:40:44 +08:00
Hauser	884388163d	perf(s3): streamline conditional multipart preflight Co-Authored-By: heihutu <heihutu@gmail.com> Co-Authored-By: zhi22915 <qiuzgang@gmail.com>	2026-10-31 22:38:26 +08:00
Chris An	422e724051	fix(ecstore): clear stale BucketMetadataSys on ECStore drop (#9097 ) When sequential test fixtures share the bootstrap InstanceContext, the BucketMetadataSys stores a Weak<ECStore> to avoid a reference cycle. The ExpiryState holds an Arc<ECStore> that keeps the store alive past the test's own Arc drop; the next fixture's resize_workers releases it and the weak goes dangling before init_bucket_metadata_sys installs a fresh BucketMetadataSys. Any object_store() call in that window panicked. Add Drop for ECStore that clears the context's BucketMetadataSys slot when its weak handle is stale, so the next fixture always finds a clean slot. Fixes the heal absence_receipt_regressions and dangling_grace test failures under sequential execution.	2026-10-31 22:25:08 +08:00
overtrue	e0bf54197d	fix(ecstore): clear stale BucketMetadataSys on ECStore drop When sequential test fixtures share the bootstrap InstanceContext, the BucketMetadataSys stores a Weak<ECStore> to avoid a reference cycle. The ExpiryState holds an Arc<ECStore> that keeps the store alive past the test's own Arc drop; the next fixture's resize_workers releases it and the weak goes dangling before init_bucket_metadata_sys installs a fresh BucketMetadataSys. Any object_store() call in that window panicked. Add Drop for ECStore that clears the context's BucketMetadataSys slot when its weak handle is stale, so the next fixture always finds a clean slot. Fixes the heal absence_receipt_regressions and dangling_grace test failures under sequential execution.	2026-10-31 21:58:51 +08:00
Hauser Zhi	b4af43c884	fix(s3): guard conditional multipart pool errors (#9092 ) * test(s3): cover conditional writes over delete markers Co-Authored-By: heihutu <heihutu@gmail.com> Co-Authored-By: zhi22915 <qiuzgang@gmail.com> * perf(s3): avoid repeated ETag regex compilation Co-Authored-By: heihutu <heihutu@gmail.com> Co-Authored-By: zhi22915 <qiuzgang@gmail.com> * perf(s3): borrow conditional write headers Co-Authored-By: heihutu <heihutu@gmail.com> Co-Authored-By: zhi22915 <qiuzgang@gmail.com> * fix(s3): reject conditional completion on unknown pool Co-Authored-By: heihutu <heihutu@gmail.com> Co-Authored-By: zhi22915 <qiuzgang@gmail.com> * test(ci): update e2e smoke selection digest Co-Authored-By: heihutu <heihutu@gmail.com> Co-Authored-By: zhi22915 <qiuzgang@gmail.com> * test(ci): update full E2E selection for marker regression Co-Authored-By: heihutu <heihutu@gmail.com> Co-Authored-By: zhi22915 <qiuzgang@gmail.com> --------- Co-authored-by: heihutu <heihutu@gmail.com> Co-authored-by: zhi22915 <qiuzgang@gmail.com> Co-authored-by: Chris An <anzhengchao@gmail.com>	2026-10-31 20:48:34 +08:00
Chris An	1cb4c0ebe2	ci: stamp the plan contract and rename the workspace lint-and-build key (#9095 ) * ci: gate the plan on a contract marker A base planner predating the NIGHTLY_JOBS split still emits the old required set, and the strict verifier would reject it. Select now stamps plan_contract=2 and the workflow refuses any plan without the current marker, falling back to the full matrix, so a stale base planner can neither authorize the new narrower selection nor force a job the new workflow no longer schedules. * ci: rename the workspace lint-and-build job key and evidence path The job key test-and-lint named a job that runs no tests: it does Clippy, the test-binary archive, doctests and the log-rule anchors, while the tests live in workspace-tests. Anyone reading needs: [test-and-lint] would conclude tests had already gated that dependency. The key becomes workspace-lint-and-build to match its display name, and the shared evidence directory becomes artifacts/workspace so the path stops asserting the same thing. The aggregate's display name stays Test and Lint because that is the live ruleset check context. ci-gates.md also stops attributing the ECStore test run to the wrong job.	2026-10-31 17:41:02 +08:00
Chris An	e5563e6004	feat(release): gate publication on candidate certification (R01) (#9090 ) Add a fail-closed release certification path so incomplete or substituted evidence blocks every official publication exit. scripts/release/release_gate.py validates the versioned release-validation plan, the candidate identity and the G01 evidence-envelope set, then re-checks promoted bytes against the passed list. build/docker/package/helm publication jobs require that certification and stage artifacts before promoting identical bytes.	2026-10-31 16:53:18 +08:00
Chris An	0a72b29a34	chore(e2e): isolated harness event drill (close after evidence) (#9089 ) chore(e2e): isolated harness drill	2026-10-31 16:52:19 +08:00
Chris An	51275cb7d8	ci: move specialized lanes off the pull-request path (#9093 ) Connect Feature Boundaries, real io_uring and the rio-v2, Swift, SFTP and HTTP/3 feature lanes no longer gate a merge. They run only in the scheduled and manual full-validation runs, which report a regression within a day; on the pull-request path they bought no earlier signal worth the runner occupancy (Connect alone measured 53.5 median minutes and occasionally set the wall). Workspace lint and tests, the short core contract, the debug build, E2E smoke and the S3 lanes stay required on PRs and merge groups.	2026-10-31 16:52:03 +08:00
Chris An	3bf270b49f	ci: record CI01 measurements, drill evidence and fix the OIDC live gate (#9091 ) * ci: retain CI01 timing sample and fix the OIDC live gate tool Record the measured PR feedback and runner occupancy for the CI plan's CI01 criterion, including the honest gap between the experimental targets and the sampled medians, and replace the awscurl dependency in the live Keycloak gate with the AWS CLI so the security suite runs on PEP 668 managed fleets. * docs(testing): attach live run evidence to the event-drill index	2026-10-31 05:10:38 +00:00
Chris An	d8d064bd18	docs(testing): index event-class drills and retained CI evidence (#9088 )	2026-10-31 11:21:46 +08:00
Hauser Zhi	e5653ca055	chore(deps): refresh workspace dependencies (#9080 ) Run cargo update --verbose and cargo upgrade --verbose twice from the current main baseline. Upgrade the Tonic family to 0.14.9, Redis to 1.8.1, sysinfo to 0.40.1, and hotpath to 0.30.2 with compatible transitive updates. Synchronize the standalone fuzz lockfile and retain its PKCS#1 rc.4 resolution for compatibility with pinned RSA rc.18. Co-authored-by: heihutu <heihutu@gmail.com> Co-authored-by: zhi22915 <qiuzgang@gmail.com> Co-authored-by: Chris An <anzhengchao@gmail.com>	2026-10-31 10:36:21 +08:00
Chris An	6413a11889	test(heal): align cleanup tests with removal-disabled heals (#9087 )	2026-10-31 10:35:56 +08:00
Chris An	9e4ea9fdd1	fix(console): strip Content-Encoding on brotli buffer failure (#9085 ) When to_bytes fails in buffer_brotli_responses the error path replaced the body with empty while keeping Content-Encoding: br, producing a malformed response (empty body claiming brotli encoding). Strip the header and log a warning so the degradation is visible and the client does not attempt to decode a missing body.	2026-10-31 09:02:10 +08:00
Joep	1a841fb7c7	fix(console): buffer brotli responses to set Content-Length for Firefox (#9076 ) (#9079 ) tower_http's CompressionLayer streams brotli via Transfer-Encoding: chunked without a Content-Length header. Firefox's incremental brotli decoder aborts on this combination (NS_BINDING_ERROR), making the web console unusable in Firefox. Chrome and Safari buffer the full body before decoding so they are unaffected. Add a thin middleware (buffer_brotli_responses) that runs after CompressionLayer, collects the complete body for any brotli response that lacks Content-Length, and re-emits it with the correct length header.	2026-10-31 08:07:28 +08:00
Chris An	b8ee0301e9	feat(scanner): fair bucket service across restarts and budgeted first enumeration (#9083 ) * feat(scanner): bound first-build enumeration with the cycle budget Charge raw directory entries and their name bytes, and let one bucket scan hold a child budget that stops its own token while charging the cycle. A count budget also bounds one directory listing, so a wide first build can no longer finish a full read_dir before the first object is charged. The new stop reason maps onto the persisted Directories variant so older readers keep decoding checkpoints. A directory with queued children keeps its index until they end, and every index on the active walk path is saved as an optional map field: losing either one would recharge its replay and stop a fixed budget from advancing. * feat(scanner): keep bucket service order across restarts Save each set's first-in-first-out bucket order as an optional map field of its usage cache, including after an incomplete cycle, which otherwise writes nothing. Durable age now outranks the dirty-first and leader-local cohort orders, which only break its ties, so a restart cannot hand the budget back to the same first buckets. Failed turns add visible debt without moving a bucket forward; a budget stop or a resource veto adds none. A bucket that spends its quantum and saves forward motion returns to the queue tail within the cycle. The order authorizes nothing: another movement epoch or a corrupt value starts a new one, and a recreated bucket joins as a new arrival. * test(scanner): cover quantum handoff and saved service order Run the real worker queue with injected bucket shares and verify a spent bucket yields to waiters, a share without durable motion ends its turn, and the saved order keeps certified coverage while rejecting older owners. * docs(scanner): describe budgeted first build and service order * test(scanner): pin index retention and requeue motion Bound the nested restart fixture tightly enough that dropping a directory index fails it, and cover a repeated share whose frontier never moves. * fix(scanner): keep service generations and owner stops intact Queue a new bucket behind waiters but ahead of buckets that already had a turn, matching the leader-local cohort, and keep the set cache untouched when the owner was cancelled so an interrupted cycle cannot advance its revision. The order holds one record per inventory bucket, like the set cache's entries, so a truncating bound that could starve the long-waiting buckets is removed. Publish the incomplete scope before saving so a contended lock cannot delay it. * ci(e2e): refresh the full selection digests * fix(scanner): correct a comment spelling * fix(scanner): separate service debt from vetoes and stale owners Keep a resource veto and a remote count-budget stop out of failure debt, settle the claim before a requeue exposes the bucket to another worker, and stamp the service order with its leader so an older owner cannot replace it after an incomplete save. The checkpoint fixture's budget now covers both service orders. * fix(ecstore): create parents before resource-scoped writes #9064 moved parent creation into the lazy writer, so a write that holds a resource unit reached the native open without its parent directory and failed with FileNotFound on nested paths. * fix(e2e): retry SlowDown codes during upgrade write readiness The rolling-upgrade readiness probe only retried 503 ServiceUnavailable, so a transient 503 SlowDown from a still-recovering node failed the four_node_rolling_upgrade test immediately. Accept SlowDown and SlowDownRead alongside ServiceUnavailable, matching the existing chaos test transient-error set.	2026-10-31 07:57:18 +08:00