# Storage, Control Plane, And Background Controllers

This document defines migration boundaries for the storage hot path and adjacent
control-plane responsibilities.

## Storage API Contracts

Storage API contracts must not absorb implementation details from ECStore or the
reader pipeline.

Out of scope for the contract layer:

- KMS/SSE implementation.
- Range and compression behavior.
- Erasure coding and bitrot logic.
- Remote disk transport and recovery.

No-drift behavior:

- Object-to-set hash remains unchanged.
- Write quorum remains unchanged.
- Reader decryption, etag/checksum, version, and delete-marker behavior remain
  unchanged.
- Public compatibility paths remain available through temporary re-exports or
  wrappers during pure moves.

## Cluster Control Plane

ClusterControlPlane starts as a read-only facade inside `crates/ecstore/src/cluster`.
Do not create a standalone cluster crate until internal dependencies are stable.

Initial scope:

- Topology snapshot.
- Membership snapshot.
- Lock registry snapshot.
- Peer health snapshot.
- Pool state snapshot.

Risk controls:

- Distributed lock quorum remains per set.
- RemoteDisk suspect/offline/recovery, timeout, and connection eviction semantics
  must not be simplified.
- Health impact behavior must be feature-gated if it changes production behavior.

## Background Controllers

Scanner, heal, lifecycle, replication, config reload, metrics, and auto-tuning
controllers should move behind explicit controller boundaries after lifecycle
contracts are stable.

The first controller work should be read-only status and shutdown ordering, not
behavior changes.