4.17

fix(s3api): ListObjects with trailing-slash prefix returns wrong results

When ListObjectsV2 is called with a prefix ending in "/" (e.g., "foo/"),
normalizePrefixMarker strips the trailing slash and splits into
dir="parent" and prefix="foo". The filer then lists entries matching
prefix "foo", which returns both directory "foo" and "foo1000".

The prefixEndsOnDelimiter guard correctly identifies directory "foo" as
the target and recurses into it, but then resets the guard to false.
The loop continues and incorrectly recurses into "foo1000" as well,
causing the listing to return objects from unrelated directories.

Fix: after recursing into the exact directory targeted by the
trailing-slash prefix, return immediately from the listing loop.
There is no reason to process sibling entries since the original
prefix specifically targeted one directory.

.github/workflows/container_dev.yml

@@ -32,7 +32,7 @@ jobs:
             org.opencontainers.image.vendor=Chris Lu
       -
         name: Set up QEMU
-        uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v1
+        uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v1
       -
         name: Create BuildKit config
         run: |
@@ -42,28 +42,28 @@ jobs:
           EOF
       -
         name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v1
+        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v1
         with:
           buildkitd-flags: "--debug"
           buildkitd-config: /tmp/buildkitd.toml
       -
         name: Login to Docker Hub
         if: github.event_name != 'pull_request'
-        uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v1
+        uses: docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2 # v1
         with:
           username: ${{ secrets.DOCKER_USERNAME }}
           password: ${{ secrets.DOCKER_PASSWORD }}
       -
         name: Login to GHCR
         if: github.event_name != 'pull_request'
-        uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v1
+        uses: docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2 # v1
         with:
           registry: ghcr.io
           username: ${{ secrets.GHCR_USERNAME }}
           password: ${{ secrets.GHCR_TOKEN }}
       -
         name: Build
-        uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v2
+        uses: docker/build-push-action@d08e5c354a6adb9ed34480a06d141179aa583294 # v2
         with:
           context: ./docker
           push: ${{ github.event_name != 'pull_request' }}

.github/workflows/container_foundationdb_version.yml

@@ -126,14 +126,14 @@ jobs:
           echo "seaweedfs_ref=$seaweed" >> "$GITHUB_OUTPUT"
 
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@v3
+        uses: docker/setup-qemu-action@v4
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@v4
 
       - name: Login to Docker Hub
         if: github.event_name != 'pull_request'
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4
         with:
           username: ${{ secrets.DOCKER_USERNAME }}
           password: ${{ secrets.DOCKER_PASSWORD }}
@@ -150,7 +150,7 @@ jobs:
           fi
 
       - name: Build and push image
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@v7
         with:
           context: ./docker
           push: ${{ github.event_name != 'pull_request' }}

.github/workflows/container_latest.yml

@@ -98,7 +98,7 @@ jobs:
             org.opencontainers.image.vendor=Chris Lu
       - name: Set up QEMU
         if: matrix.platform != 'amd64'
-        uses: docker/setup-qemu-action@v3
+        uses: docker/setup-qemu-action@v4
       - name: Create BuildKit config
         run: |
           cat > /tmp/buildkitd.toml <<EOF
@@ -106,25 +106,25 @@ jobs:
             mirrors = ["https://mirror.gcr.io"]
           EOF
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@v4
         with:
           buildkitd-flags: "--debug"
           buildkitd-config: /tmp/buildkitd.toml
       - name: Login to Docker Hub
         if: github.event_name != 'pull_request'
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4
         with:
           username: ${{ secrets.DOCKER_USERNAME }}
           password: ${{ secrets.DOCKER_PASSWORD }}
       - name: Login to GHCR
         if: github.event_name != 'pull_request'
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4
         with:
           registry: ghcr.io
           username: ${{ secrets.GHCR_USERNAME }}
           password: ${{ secrets.GHCR_TOKEN }}
       - name: Build ${{ matrix.platform }} ${{ matrix.variant }}
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@v7
         env:
           DOCKER_BUILDKIT: 1
         with:
@@ -180,12 +180,12 @@ jobs:
             ghcr.io/chrislusf/seaweedfs
           tags: type=raw,value=${{ github.event_name == 'workflow_dispatch' && github.event.inputs.image_tag || 'latest' }},suffix=${{ steps.config.outputs.tag_suffix }}
       - name: Login to Docker Hub
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4
         with:
           username: ${{ secrets.DOCKER_USERNAME }}
           password: ${{ secrets.DOCKER_PASSWORD }}
       - name: Login to GHCR
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4
         with:
           registry: ghcr.io
           username: ${{ secrets.GHCR_USERNAME }}

.github/workflows/container_release_foundationdb.yml

@@ -35,14 +35,14 @@ jobs:
             org.opencontainers.image.vendor=Chris Lu
       -
         name: Set up QEMU
-        uses: docker/setup-qemu-action@v3
+        uses: docker/setup-qemu-action@v4
       -
         name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@v4
       -
         name: Login to Docker Hub
         if: github.event_name != 'pull_request'
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4
         with:
           username: ${{ secrets.DOCKER_USERNAME }}
           password: ${{ secrets.DOCKER_PASSWORD }}
@@ -57,7 +57,7 @@ jobs:
           fi
       -
         name: Build
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@v7
         with:
           context: ./docker
           push: ${{ github.event_name != 'pull_request' }}

.github/workflows/container_release_unified.yml

@@ -60,16 +60,16 @@ jobs:
             build_args: TAGS=5BytesOffset
             tag_suffix: _large_disk
             
-          # Full tags - amd64 only
+          # Full tags - multi-arch
           - variant: full
-            platforms: linux/amd64
+            platforms: linux/amd64,linux/arm64
             dockerfile: ./docker/Dockerfile.go_build
             build_args: TAGS=elastic,gocdk,rclone,sqlite,tarantool,tikv,ydb
             tag_suffix: _full
-            
-          # Large disk + full tags - amd64 only
+
+          # Large disk + full tags - multi-arch
           - variant: large_disk_full
-            platforms: linux/amd64
+            platforms: linux/amd64,linux/arm64
             dockerfile: ./docker/Dockerfile.go_build
             build_args: TAGS=5BytesOffset,elastic,gocdk,rclone,sqlite,tarantool,tikv,ydb
             tag_suffix: _large_disk_full
@@ -117,7 +117,7 @@ jobs:
             
       - name: Set up QEMU
         if: (github.event_name != 'workflow_dispatch' || github.event.inputs.variant == 'all' || github.event.inputs.variant == matrix.variant) && contains(matrix.platforms, 'arm')
-        uses: docker/setup-qemu-action@v3
+        uses: docker/setup-qemu-action@v4
         
       - name: Create BuildKit config
         if: github.event_name != 'workflow_dispatch' || github.event.inputs.variant == 'all' || github.event.inputs.variant == matrix.variant
@@ -129,20 +129,20 @@ jobs:
           
       - name: Set up Docker Buildx
         if: github.event_name != 'workflow_dispatch' || github.event.inputs.variant == 'all' || github.event.inputs.variant == matrix.variant
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@v4
         with:
           buildkitd-config: /tmp/buildkitd.toml
           
       - name: Login to Docker Hub
         if: (github.event_name != 'workflow_dispatch' || github.event.inputs.variant == 'all' || github.event.inputs.variant == matrix.variant) && github.event_name != 'pull_request'
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4
         with:
           username: ${{ secrets.DOCKER_USERNAME }}
           password: ${{ secrets.DOCKER_PASSWORD }}
           
       - name: Login to GHCR
         if: (github.event_name != 'workflow_dispatch' || github.event.inputs.variant == 'all' || github.event.inputs.variant == matrix.variant) && github.event_name != 'pull_request'
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4
         with:
           registry: ghcr.io
           username: ${{ secrets.GHCR_USERNAME }}
@@ -150,7 +150,7 @@ jobs:
           
       - name: Build and push ${{ matrix.variant }}
         if: github.event_name != 'workflow_dispatch' || github.event.inputs.variant == 'all' || github.event.inputs.variant == matrix.variant
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@v7
         env:
           DOCKER_BUILDKIT: 1
         with:
@@ -198,14 +198,14 @@ jobs:
     steps:
       - name: Login to Docker Hub
         if: github.event_name != 'workflow_dispatch' || github.event.inputs.variant == 'all' || github.event.inputs.variant == matrix.variant
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4
         with:
           username: ${{ secrets.DOCKER_USERNAME }}
           password: ${{ secrets.DOCKER_PASSWORD }}
           
       - name: Login to GHCR
         if: github.event_name != 'workflow_dispatch' || github.event.inputs.variant == 'all' || github.event.inputs.variant == matrix.variant
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4
         with:
           registry: ghcr.io
           username: ${{ secrets.GHCR_USERNAME }}

.github/workflows/container_rocksdb_version.yml

@@ -82,19 +82,19 @@ jobs:
           echo "seaweedfs_ref=$seaweed" >> "$GITHUB_OUTPUT"
 
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v1
+        uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v1
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v1
+        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v1
 
       - name: Login to Docker Hub
-        uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v1
+        uses: docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2 # v1
         with:
           username: ${{ secrets.DOCKER_USERNAME }}
           password: ${{ secrets.DOCKER_PASSWORD }}
 
       - name: Build and push image
-        uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v2
+        uses: docker/build-push-action@d08e5c354a6adb9ed34480a06d141179aa583294 # v2
         with:
           context: ./docker
           push: true

.github/workflows/deploy_telemetry.yml

@@ -26,7 +26,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@v6
         with:
-          go-version: '1.24'
+          go-version-file: 'go.mod'
 
       - name: Build Telemetry Server
         if: github.event_name == 'workflow_dispatch' && inputs.deploy

.github/workflows/depsreview.yml

@@ -11,4 +11,4 @@ jobs:
       - name: 'Checkout Repository'
         uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8
       - name: 'Dependency Review'
-        uses: actions/dependency-review-action@05fe4576374b728f0c523d6a13d64c25081e0803
+        uses: actions/dependency-review-action@2031cfc080254a8a887f58cffee85186f0e49e48

.github/workflows/e2e.yml

@@ -23,17 +23,16 @@ jobs:
     runs-on: ubuntu-22.04
     timeout-minutes: 30
     steps:
-    - name: Set up Go 1.x
-      uses: actions/setup-go@a5f9b05d2d216f63e13859e0d847461041025775 # v2
-      with:
-        go-version: ^1.13
-      id: go
-
     - name: Check out code into the Go module directory
-      uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v2
+      uses: actions/checkout@v6
+
+    - name: Set up Go
+      uses: actions/setup-go@v6
+      with:
+        go-version-file: 'go.mod'
 
     - name: Set up Docker Buildx
-      uses: docker/setup-buildx-action@v3
+      uses: docker/setup-buildx-action@v4
       
     - name: Cache Docker layers
       uses: actions/cache@v5
@@ -135,7 +134,7 @@ jobs:
 
     - name: Archive logs
       if: always()
-      uses: actions/upload-artifact@v6
+      uses: actions/upload-artifact@v7
       with:
         name: output-logs
         path: docker/output.log

.github/workflows/ec-integration-tests.yml

@@ -18,7 +18,7 @@ jobs:
     - name: Set up Go 1.x
       uses: actions/setup-go@v6
       with:
-        go-version: ^1.24
+        go-version: ^1.25
       id: go
 
     - name: Check out code into the Go module directory
@@ -52,7 +52,7 @@ jobs:
 
     - name: Archive logs
       if: failure()
-      uses: actions/upload-artifact@v6
+      uses: actions/upload-artifact@v7
       with:
         name: ec-integration-test-logs
         path: |

.github/workflows/ec-integration.yml

@@ -28,7 +28,7 @@ jobs:
     - name: Set up Go
       uses: actions/setup-go@v6
       with:
-        go-version: '1.24'
+        go-version-file: 'go.mod'
         
     - name: Build weed binary
       run: |
@@ -42,7 +42,7 @@ jobs:
         
     - name: Upload test logs on failure
       if: failure()
-      uses: actions/upload-artifact@v6
+      uses: actions/upload-artifact@v7
       with:
         name: ec-test-logs
         path: test/erasure_coding/admin_dockertest/tmp/logs/

.github/workflows/fuse-integration.yml

@@ -22,7 +22,6 @@ permissions:
   contents: read
 
 env:
-  GO_VERSION: '1.24'
   TEST_TIMEOUT: '45m'
 
 jobs:
@@ -35,10 +34,10 @@ jobs:
     - name: Checkout code
       uses: actions/checkout@v6
       
-    - name: Set up Go ${{ env.GO_VERSION }}
+    - name: Set up Go
       uses: actions/setup-go@v6
       with:
-        go-version: ${{ env.GO_VERSION }}
+        go-version-file: 'go.mod'
         
     - name: Install FUSE and dependencies
       run: |
@@ -183,7 +182,7 @@ jobs:
         
     - name: Upload Test Artifacts
       if: always()
-      uses: actions/upload-artifact@v6
+      uses: actions/upload-artifact@v7
       with:
         name: fuse-integration-test-results
         path: |

.github/workflows/go.yml

@@ -19,13 +19,12 @@ jobs:
     name: Go Vet
     runs-on: ubuntu-latest
     steps:
-    - name: Set up Go 1.x
-      uses: actions/setup-go@a5f9b05d2d216f63e13859e0d847461041025775 # v2
-      with:
-        go-version: ^1.13
-      id: go
     - name: Check out code into the Go module directory
-      uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v2
+      uses: actions/checkout@v6
+    - name: Set up Go
+      uses: actions/setup-go@v6
+      with:
+        go-version-file: 'go.mod'
     - name: Get dependencies
       run: |
         cd weed; go get -v -t -d ./...
@@ -42,13 +41,12 @@ jobs:
     name: Build
     runs-on: ubuntu-latest
     steps:
-    - name: Set up Go 1.x
-      uses: actions/setup-go@a5f9b05d2d216f63e13859e0d847461041025775 # v2
-      with:
-        go-version: ^1.13
-      id: go
     - name: Check out code into the Go module directory
-      uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v2
+      uses: actions/checkout@v6
+    - name: Set up Go
+      uses: actions/setup-go@v6
+      with:
+        go-version-file: 'go.mod'
     - name: Build
       run: cd weed; go build -tags "elastic gocdk sqlite ydb tarantool tikv rclone" -v .
 
@@ -56,12 +54,11 @@ jobs:
     name: Test
     runs-on: ubuntu-latest
     steps:
-    - name: Set up Go 1.x
-      uses: actions/setup-go@a5f9b05d2d216f63e13859e0d847461041025775 # v2
-      with:
-        go-version: ^1.13
-      id: go
     - name: Check out code into the Go module directory
-      uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v2
+      uses: actions/checkout@v6
+    - name: Set up Go
+      uses: actions/setup-go@v6
+      with:
+        go-version-file: 'go.mod'
     - name: Test
       run: cd weed; go test -tags "elastic gocdk sqlite ydb tarantool tikv rclone" -v ./...

.github/workflows/java_unit_tests.yml

@@ -49,7 +49,7 @@ jobs:
       
       - name: Upload Test Reports
         if: always()
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v7
         with:
           name: test-reports-java-${{ matrix.java }}
           path: |

.github/workflows/kafka-quicktest.yml

@@ -26,14 +26,14 @@ jobs:
     - name: Set up Go 1.x
       uses: actions/setup-go@v6
       with:
-        go-version: ^1.24
+        go-version: ^1.25
         cache: true
         cache-dependency-path: |
           **/go.sum
       id: go
 
     - name: Set up Docker Buildx
-      uses: docker/setup-buildx-action@v3
+      uses: docker/setup-buildx-action@v4
 
     - name: Install dependencies
       run: |

.github/workflows/kafka-tests.yml

@@ -37,7 +37,7 @@ jobs:
     - name: Set up Go 1.x
       uses: actions/setup-go@v6
       with:
-        go-version: ^1.24
+        go-version: ^1.25
       id: go
 
     - name: Check out code
@@ -82,7 +82,7 @@ jobs:
     - name: Set up Go 1.x
       uses: actions/setup-go@v6
       with:
-        go-version: ^1.24
+        go-version: ^1.25
       id: go
 
     - name: Check out code
@@ -132,7 +132,7 @@ jobs:
     - name: Set up Go 1.x
       uses: actions/setup-go@v6
       with:
-        go-version: ^1.24
+        go-version: ^1.25
         cache: true
         cache-dependency-path: |
           **/go.sum
@@ -311,7 +311,7 @@ jobs:
     - name: Set up Go 1.x
       uses: actions/setup-go@v6
       with:
-        go-version: ^1.24
+        go-version: ^1.25
         cache: true
         cache-dependency-path: |
           **/go.sum
@@ -473,7 +473,7 @@ jobs:
     - name: Set up Go 1.x
       uses: actions/setup-go@v6
       with:
-        go-version: ^1.24
+        go-version: ^1.25
         cache: true
         cache-dependency-path: |
           **/go.sum
@@ -631,7 +631,7 @@ jobs:
     - name: Set up Go 1.x
       uses: actions/setup-go@v6
       with:
-        go-version: ^1.24
+        go-version: ^1.25
         cache: true
         cache-dependency-path: |
           **/go.sum
@@ -789,7 +789,7 @@ jobs:
     - name: Set up Go 1.x
       uses: actions/setup-go@v6
       with:
-        go-version: ^1.24
+        go-version: ^1.25
       id: go
 
     - name: Check out code

.github/workflows/metadata-subscribe-tests.yml

@@ -30,7 +30,6 @@ permissions:
   contents: read
 
 env:
-  GO_VERSION: '1.24'
   TEST_TIMEOUT: '10m'
 
 jobs:
@@ -43,10 +42,10 @@ jobs:
     - name: Checkout code
       uses: actions/checkout@v6
       
-    - name: Set up Go ${{ env.GO_VERSION }}
+    - name: Set up Go
       uses: actions/setup-go@v6
       with:
-        go-version: ${{ env.GO_VERSION }}
+        go-version-file: 'go.mod'
         
     - name: Build SeaweedFS
       run: |
@@ -70,7 +69,7 @@ jobs:
         
     - name: Archive logs on failure
       if: failure()
-      uses: actions/upload-artifact@v6
+      uses: actions/upload-artifact@v7
       with:
         name: metadata-subscribe-test-logs
         path: |

.github/workflows/postgres-tests.yml

@@ -25,14 +25,14 @@ jobs:
     - name: Set up Go 1.x
       uses: actions/setup-go@v6
       with:
-        go-version: ^1.24
+        go-version: ^1.25
       id: go
 
     - name: Check out code
       uses: actions/checkout@v6
 
     - name: Set up Docker Buildx
-      uses: docker/setup-buildx-action@v3
+      uses: docker/setup-buildx-action@v4
 
     - name: Cache Docker layers
       uses: actions/cache@v5
@@ -62,7 +62,7 @@ jobs:
 
     - name: Archive logs
       if: always()
-      uses: actions/upload-artifact@v6
+      uses: actions/upload-artifact@v7
       with:
         name: postgres-logs
         path: test/postgres/postgres-output.log

.github/workflows/s3-example-integration-tests.yml

@@ -57,7 +57,7 @@ jobs:
 
       - name: Upload test logs on failure
         if: failure()
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v7
         with:
           name: integration-test-logs
           path: test/s3/normal/*.log

.github/workflows/s3-filer-group-tests.yml

@@ -77,7 +77,7 @@ jobs:
 
       - name: Upload test logs on failure
         if: failure()
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v7
         with:
           name: s3-filer-group-test-logs
           path: test/s3/filer_group/weed-test*.log

.github/workflows/s3-go-tests.yml

@@ -76,7 +76,7 @@ jobs:
 
       - name: Upload test logs on failure
         if: failure()
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v7
         with:
           name: s3-versioning-test-logs-${{ matrix.test-type }}
           path: test/s3/versioning/weed-test*.log
@@ -124,7 +124,7 @@ jobs:
 
       - name: Upload server logs on failure
         if: failure()
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v7
         with:
           name: s3-versioning-compatibility-logs
           path: test/s3/versioning/weed-test*.log
@@ -172,7 +172,7 @@ jobs:
 
       - name: Upload server logs on failure
         if: failure()
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v7
         with:
           name: s3-cors-compatibility-logs
           path: test/s3/cors/weed-test*.log
@@ -239,7 +239,7 @@ jobs:
 
       - name: Upload test logs on failure
         if: failure()
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v7
         with:
           name: s3-retention-test-logs-${{ matrix.test-type }}
           path: test/s3/retention/weed-test*.log
@@ -306,7 +306,7 @@ jobs:
 
       - name: Upload test logs on failure
         if: failure()
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v7
         with:
           name: s3-cors-test-logs-${{ matrix.test-type }}
           path: test/s3/cors/weed-test*.log
@@ -355,7 +355,7 @@ jobs:
 
       - name: Upload server logs on failure
         if: failure()
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v7
         with:
           name: s3-retention-worm-logs
           path: test/s3/retention/weed-test*.log
@@ -422,7 +422,7 @@ jobs:
 
       - name: Upload stress test logs
         if: always()
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v7
         with:
           name: s3-versioning-stress-logs
           path: test/s3/versioning/weed-test*.log
@@ -478,7 +478,7 @@ jobs:
 
       - name: Upload test logs on failure
         if: failure()
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v7
         with:
           name: s3-tagging-test-logs
           path: test/s3/tagging/weed-test*.log
@@ -531,7 +531,7 @@ jobs:
 
       - name: Upload test logs on failure
         if: failure()
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v7
         with:
           name: s3-remote-cache-test-logs
           path: |

.github/workflows/s3-iam-tests.yml

@@ -5,6 +5,8 @@ on:
     paths:
       - 'weed/iam/**'
       - 'weed/s3api/**'
+      - 'weed/credential/**'
+      - 'weed/pb/**'
       - 'test/s3/iam/**'
       - '.github/workflows/s3-iam-tests.yml'
   push:
@@ -12,6 +14,8 @@ on:
     paths:
       - 'weed/iam/**'
       - 'weed/s3api/**'
+      - 'weed/credential/**'
+      - 'weed/pb/**'
       - 'test/s3/iam/**'
       - '.github/workflows/s3-iam-tests.yml'
   
@@ -65,7 +69,7 @@ jobs:
 
       - name: Upload test results on failure
         if: failure()
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v7
         with:
           name: iam-unit-test-results
           path: |
@@ -80,7 +84,7 @@ jobs:
     timeout-minutes: 25
     strategy:
       matrix:
-        test-type: ["basic", "advanced", "policy-enforcement"]
+        test-type: ["basic", "advanced", "policy-enforcement", "group"]
         
     steps:
       - name: Check out code
@@ -117,7 +121,7 @@ jobs:
             "basic")
               echo "Running basic IAM functionality tests..."
               make clean setup start-services wait-for-services
-              go test -v -timeout 15m -run "TestS3IAMAuthentication|TestS3IAMBasicWorkflow|TestS3IAMTokenValidation|TestIAM" ./...
+              go test -v -timeout 15m -run "TestS3IAMAuthentication|TestS3IAMBasicWorkflow|TestS3IAMTokenValidation|TestIAMUserManagement|TestIAMAccessKeyManagement|TestIAMPolicyManagement" ./...
               ;;
             "advanced")
               echo "Running advanced IAM feature tests..."
@@ -129,6 +133,11 @@ jobs:
               make clean setup start-services wait-for-services
               go test -v -timeout 15m -run "TestS3IAMPolicyEnforcement|TestS3IAMBucketPolicy|TestS3IAMContextual" ./...
               ;;
+            "group")
+              echo "Running IAM group management tests..."
+              make clean setup start-services wait-for-services
+              go test -v -timeout 15m -run "TestIAMGroup" ./...
+              ;;
             *)
               echo "Unknown test type: ${{ matrix.test-type }}"
               exit 1
@@ -162,7 +171,7 @@ jobs:
 
       - name: Upload test logs on failure
         if: failure()
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v7
         with:
           name: s3-iam-integration-logs-${{ matrix.test-type }}
           path: test/s3/iam/weed-*.log
@@ -222,7 +231,7 @@ jobs:
 
       - name: Upload distributed test logs
         if: always()
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v7
         with:
           name: s3-iam-distributed-logs
           path: test/s3/iam/weed-*.log
@@ -274,7 +283,7 @@ jobs:
 
       - name: Upload performance test results
         if: always()
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v7
         with:
           name: s3-iam-performance-results
           path: |

.github/workflows/s3-keycloak-tests.yml

@@ -152,7 +152,7 @@ jobs:
 
       - name: Upload test logs on failure
         if: failure()
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v7
         with:
           name: s3-keycloak-test-logs
           path: |

.github/workflows/s3-parquet-tests.yml

@@ -41,7 +41,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@v6
         with:
-          go-version: ^1.24
+          go-version: ^1.25
           cache: true
       
       - name: Set up Python ${{ matrix.python-version }}
@@ -121,7 +121,7 @@ jobs:
       
       - name: Upload test logs on failure
         if: failure()
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v7
         with:
           name: test-logs-python-${{ matrix.python-version }}
           path: |
@@ -148,7 +148,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@v6
         with:
-          go-version: ^1.24
+          go-version: ^1.25
           cache: true
       
       - name: Run Go unit tests

.github/workflows/s3-policy-tests.yml

@@ -70,7 +70,7 @@ jobs:
 
       - name: Upload test results on failure
         if: failure()
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v7
         with:
           name: policy-unit-test-results
           path: |
@@ -178,7 +178,7 @@ jobs:
 
       - name: Upload test logs on failure
         if: failure()
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v7
         with:
           name: s3-policy-variables-test-logs
           path: /tmp/weed_policy_test_server.log
@@ -299,7 +299,7 @@ jobs:
 
       - name: Upload test logs on failure
         if: failure()
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v7
         with:
           name: s3-policy-enforcement-logs-${{ matrix.test-case }}
           path: /tmp/weed_policy_enforcement_${{ matrix.test-case }}.log
@@ -386,7 +386,7 @@ jobs:
 
       - name: Upload test logs on failure
         if: failure()
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v7
         with:
           name: trusted-proxy-test-logs
           path: /tmp/weed_proxy_test.log

.github/workflows/s3-proxy-signature-tests.yml

@@ -29,7 +29,7 @@ jobs:
         id: go
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@v4
 
       - name: Build SeaweedFS binary for Linux
         run: |

.github/workflows/s3-spark-tests.yml

@@ -33,7 +33,7 @@ jobs:
         id: go
 
       - name: Set up Docker
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@v4
 
       - name: Install SeaweedFS
         run: |
@@ -73,7 +73,7 @@ jobs:
 
       - name: Upload test logs on failure
         if: failure()
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v7
         with:
           name: s3-spark-test-logs
           path: test/s3/spark/test-output.log

.github/workflows/s3-sse-tests.yml

@@ -95,7 +95,7 @@ jobs:
 
       - name: Upload test logs on failure
         if: failure()
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v7
         with:
           name: s3-sse-test-logs-${{ matrix.test-type }}
           path: test/s3/sse/weed-test*.log
@@ -143,7 +143,7 @@ jobs:
 
       - name: Upload server logs on failure
         if: failure()
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v7
         with:
           name: s3-sse-compatibility-logs
           path: test/s3/sse/weed-test*.log
@@ -192,7 +192,7 @@ jobs:
 
       - name: Upload server logs on failure
         if: failure()
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v7
         with:
           name: s3-sse-metadata-persistence-logs
           path: test/s3/sse/weed-test*.log
@@ -241,7 +241,7 @@ jobs:
 
       - name: Upload server logs on failure
         if: failure()
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v7
         with:
           name: s3-sse-copy-operations-logs
           path: test/s3/sse/weed-test*.log
@@ -290,7 +290,7 @@ jobs:
 
       - name: Upload server logs on failure
         if: failure()
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v7
         with:
           name: s3-sse-multipart-logs
           path: test/s3/sse/weed-test*.log
@@ -340,7 +340,7 @@ jobs:
 
       - name: Upload performance test logs
         if: always()
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v7
         with:
           name: s3-sse-performance-logs
           path: test/s3/sse/weed-test*.log
@@ -389,7 +389,7 @@ jobs:
 
       - name: Upload server logs on failure
         if: failure()
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v7
         with:
           name: s3-volume-encryption-logs
           path: /tmp/seaweedfs-sse-*.log

.github/workflows/s3-tables-tests.yml

@@ -66,7 +66,7 @@ jobs:
 
       - name: Upload test logs on failure
         if: failure()
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v7
         with:
           name: s3-tables-test-logs
           path: test/s3tables/table-buckets/test-output.log
@@ -122,7 +122,7 @@ jobs:
 
       - name: Upload test logs on failure
         if: failure()
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v7
         with:
           name: iceberg-catalog-test-logs
           path: test/s3tables/catalog/test-output.log
@@ -144,7 +144,7 @@ jobs:
         id: go
 
       - name: Set up Docker
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@v4
 
       - name: Pre-pull Trino image
         run: docker pull trinodb/trino:479
@@ -188,12 +188,73 @@ jobs:
 
       - name: Upload test logs on failure
         if: failure()
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v7
         with:
           name: trino-iceberg-catalog-test-logs
           path: test/s3tables/catalog_trino/test-output.log
           retention-days: 3
 
+  polaris-integration-tests:
+    name: Polaris Integration Tests
+    runs-on: ubuntu-22.04
+    timeout-minutes: 30
+
+    steps:
+      - name: Check out code
+        uses: actions/checkout@v6
+
+      - name: Set up Go
+        uses: actions/setup-go@v6
+        with:
+          go-version-file: 'go.mod'
+        id: go
+
+      - name: Run go mod tidy
+        run: go mod tidy
+
+      - name: Install SeaweedFS
+        run: |
+          go install -buildvcs=false ./weed
+
+      - name: Pre-pull Polaris image
+        run: docker pull apache/polaris:latest
+
+      - name: Run Polaris Integration Tests
+        timeout-minutes: 25
+        run: |
+          set -x
+          set -o pipefail
+          echo "=== System Information ==="
+          uname -a
+          free -h
+          df -h
+          echo "=== Starting Polaris Tests ==="
+
+          go test -v -timeout 20m ./test/s3tables/polaris 2>&1 | tee test/s3tables/polaris/test-output.log || {
+            echo "Polaris integration tests failed"
+            exit 1
+          }
+
+      - name: Show test output on failure
+        if: failure()
+        working-directory: test/s3tables/polaris
+        run: |
+          echo "=== Test Output ==="
+          if [ -f test-output.log ]; then
+            tail -200 test-output.log
+          fi
+
+          echo "=== Process information ==="
+          ps aux | grep -E "(weed|test|docker)" || true
+
+      - name: Upload test logs on failure
+        if: failure()
+        uses: actions/upload-artifact@v7
+        with:
+          name: polaris-test-logs
+          path: test/s3tables/polaris/test-output.log
+          retention-days: 3
+
   spark-iceberg-catalog-tests:
     name: Spark Iceberg Catalog Integration Tests
     runs-on: ubuntu-22.04
@@ -210,7 +271,7 @@ jobs:
         id: go
 
       - name: Set up Docker
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@v4
 
       - name: Pre-pull Spark image
         run: docker pull apache/spark:3.5.1
@@ -254,7 +315,7 @@ jobs:
 
       - name: Upload test logs on failure
         if: failure()
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v7
         with:
           name: spark-iceberg-catalog-test-logs
           path: test/s3tables/catalog_spark/test-output.log
@@ -276,7 +337,7 @@ jobs:
         id: go
 
       - name: Set up Docker
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@v4
 
       - name: Pre-pull RisingWave image
         run: |
@@ -322,7 +383,7 @@ jobs:
 
       - name: Upload test logs on failure
         if: failure()
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v7
         with:
           name: risingwave-catalog-test-logs
           path: test/s3tables/catalog_risingwave/test-output.log
@@ -344,7 +405,7 @@ jobs:
         id: go
 
       - name: Set up Docker
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@v4
 
       - name: Pre-pull Python image
         run: docker pull python:3
@@ -388,7 +449,7 @@ jobs:
 
       - name: Upload test logs on failure
         if: failure()
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v7
         with:
           name: sts-integration-test-logs
           path: test/s3tables/sts_integration/test-output.log
@@ -410,7 +471,7 @@ jobs:
         id: go
 
       - name: Set up Docker
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@v4
 
       - name: Pre-pull Python image
         run: docker pull python:3
@@ -457,7 +518,7 @@ jobs:
 
       - name: Upload test logs on failure
         if: failure()
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v7
         with:
           name: lakekeeper-integration-test-logs
           path: test/s3tables/lakekeeper/test-output.log

.github/workflows/sftp-tests.yml

@@ -24,7 +24,6 @@ permissions:
   contents: read
 
 env:
-  GO_VERSION: '1.24'
   TEST_TIMEOUT: '15m'
 
 jobs:
@@ -37,10 +36,10 @@ jobs:
     - name: Checkout code
       uses: actions/checkout@v6
       
-    - name: Set up Go ${{ env.GO_VERSION }}
+    - name: Set up Go
       uses: actions/setup-go@v6
       with:
-        go-version: ${{ env.GO_VERSION }}
+        go-version-file: 'go.mod'
         
     - name: Install dependencies
       run: |

.github/workflows/spark-integration-tests.yml

@@ -43,7 +43,7 @@ jobs:
     - name: Set up Go
       uses: actions/setup-go@v6
       with:
-        go-version: '1.24'
+        go-version-file: 'go.mod'
 
     - name: Build SeaweedFS binary
       run: |
@@ -125,7 +125,7 @@ jobs:
 
     - name: Upload test results
       if: always()
-      uses: actions/upload-artifact@v6
+      uses: actions/upload-artifact@v7
       with:
         name: spark-test-results
         path: test/java/spark/target/surefire-reports/

.github/workflows/test-s3-over-https-using-awscli.yml

@@ -24,7 +24,7 @@ jobs:
 
       - uses: actions/setup-go@v6
         with:
-          go-version: ^1.24
+          go-version: ^1.25
 
       - name: Build SeaweedFS
         run: |
@@ -103,7 +103,7 @@ jobs:
 
       - name: Upload server logs on failure
         if: failure()
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v7
         with:
           name: seaweedfs-logs
           # Note: actions don't use defaults.run.working-directory, so path is relative to workspace root

.github/workflows/tus-tests.yml

@@ -106,7 +106,7 @@ jobs:
 
       - name: Upload test logs on failure
         if: failure()
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v7
         with:
           name: tus-test-logs
           path: |

.github/workflows/volume-server-integration-tests.yml

@@ -28,7 +28,6 @@ permissions:
   contents: read
 
 env:
-  GO_VERSION: '1.24'
   TEST_TIMEOUT: '30m'
 
 jobs:
@@ -46,10 +45,10 @@ jobs:
       - name: Checkout code
         uses: actions/checkout@v6
 
-      - name: Set up Go ${{ env.GO_VERSION }}
+      - name: Set up Go
         uses: actions/setup-go@v6
         with:
-          go-version: ${{ env.GO_VERSION }}
+          go-version-file: 'go.mod'
 
       - name: Build SeaweedFS binary
         run: |
@@ -90,7 +89,7 @@ jobs:
 
       - name: Archive logs on failure
         if: failure()
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v7
         with:
           name: volume-server-integration-test-logs
           path: /tmp/volume-server-it-logs/

docker/Dockerfile.foundationdb_large

@@ -1,4 +1,4 @@
-FROM golang:1.24 AS builder
+FROM golang:1.25 AS builder
 
 RUN apt-get update && \
     apt-get install -y build-essential wget ca-certificates && \

docker/Dockerfile.go_build

@@ -1,4 +1,4 @@
-FROM golang:1.24-alpine as builder
+FROM golang:1.25-alpine AS builder
 RUN apk add git g++ fuse
 RUN mkdir -p /go/src/github.com/seaweedfs/
 ARG BRANCH=${BRANCH:-master}

docker/Dockerfile.rocksdb_dev_env

@@ -1,4 +1,4 @@
-FROM golang:1.24 AS builder
+FROM golang:1.25 AS builder
 
 RUN apt-get update
 RUN apt-get install -y build-essential libsnappy-dev zlib1g-dev libbz2-dev libgflags-dev liblz4-dev libzstd-dev

docker/Dockerfile.rocksdb_large

@@ -1,4 +1,4 @@
-FROM golang:1.24 AS builder
+FROM golang:1.25 AS builder
 
 RUN apt-get update
 RUN apt-get install -y build-essential libsnappy-dev zlib1g-dev libbz2-dev libgflags-dev liblz4-dev libzstd-dev

docker/compose/BLOCK_GETTING_STARTED.md

@@ -1,247 +0,0 @@
-# SeaweedFS Block Storage -- Getting Started
-
-Block storage exposes SeaweedFS volumes as `/dev/sdX` block devices via iSCSI.
-You can format them with ext4/xfs, mount them, and use them like any disk.
-
-## Prerequisites
-
-- Linux host with `open-iscsi` installed
-- Docker with compose plugin (`docker compose`)
-
-```bash
-# Install iSCSI initiator (Ubuntu/Debian)
-sudo apt-get install -y open-iscsi
-
-# Verify
-sudo systemctl start iscsid
-```
-
-## Quick Start (5 minutes)
-
-### 1. Build the image
-
-```bash
-# From the seaweedfs repo root
-GOOS=linux GOARCH=amd64 CGO_ENABLED=0 go build -o docker/compose/weed ./weed
-cd docker
-docker build -f Dockerfile.local -t seaweedfs-block:local .
-```
-
-### 2. Start the cluster
-
-```bash
-cd docker/compose
-
-# Set HOST_IP to your machine's IP (for remote iSCSI clients)
-# Use 127.0.0.1 for local-only testing
-HOST_IP=127.0.0.1 docker compose -f local-block-compose.yml up -d
-```
-
-Wait ~5 seconds for the volume server to register with the master.
-
-### 3. Create a block volume
-
-```bash
-curl -s -X POST http://localhost:9333/block/volume \
-  -H "Content-Type: application/json" \
-  -d '{"name":"myvolume","size_bytes":1073741824}'
-```
-
-This creates a 1GB block volume, auto-assigns it as primary, and starts the
-iSCSI target. The response includes the IQN and iSCSI address.
-
-### 4. Connect via iSCSI
-
-```bash
-# Discover targets
-sudo iscsiadm -m discovery -t sendtargets -p 127.0.0.1:3260
-
-# Login
-sudo iscsiadm -m node -T iqn.2024-01.com.seaweedfs:vol.myvolume \
-  -p 127.0.0.1:3260 --login
-
-# Find the new device
-lsblk | grep sd
-```
-
-### 5. Format and mount
-
-```bash
-# Format with ext4
-sudo mkfs.ext4 /dev/sdX
-
-# Mount
-sudo mkdir -p /mnt/myvolume
-sudo mount /dev/sdX /mnt/myvolume
-
-# Use it like any filesystem
-echo "hello" | sudo tee /mnt/myvolume/test.txt
-```
-
-### 6. Cleanup
-
-```bash
-sudo umount /mnt/myvolume
-sudo iscsiadm -m node -T iqn.2024-01.com.seaweedfs:vol.myvolume \
-  -p 127.0.0.1:3260 --logout
-docker compose -f local-block-compose.yml down -v
-```
-
-## API Reference
-
-All endpoints are on the master server (default: port 9333).
-
-### Create volume
-
-```
-POST /block/volume
-Content-Type: application/json
-
-{
-  "name": "myvolume",
-  "size_bytes": 1073741824,
-  "disk_type": "ssd",
-  "replica_placement": "001",
-  "durability_mode": "best_effort"
-}
-```
-
-| Field | Required | Default | Description |
-|-------|----------|---------|-------------|
-| `name` | yes | -- | Volume name (alphanumeric + hyphens) |
-| `size_bytes` | yes | -- | Volume size in bytes |
-| `disk_type` | no | `""` | Disk type hint: `ssd`, `hdd` |
-| `replica_placement` | no | `000` | SeaweedFS placement: `000` (no replica), `001` (1 replica same rack) |
-| `durability_mode` | no | `best_effort` | `best_effort`, `sync_all`, `sync_quorum` |
-| `replica_factor` | no | `2` | Number of copies: 1, 2, or 3 |
-
-### List volumes
-
-```
-GET /block/volumes
-```
-
-Returns JSON array of all block volumes with status, role, epoch, IQN, etc.
-
-### Lookup volume
-
-```
-GET /block/volume/{name}
-```
-
-### Delete volume
-
-```
-DELETE /block/volume/{name}
-```
-
-### Assign role
-
-```
-POST /block/assign
-Content-Type: application/json
-
-{
-  "name": "myvolume",
-  "epoch": 2,
-  "role": "primary",
-  "lease_ttl_ms": 30000
-}
-```
-
-Roles: `primary`, `replica`, `stale`, `rebuilding`.
-
-### Cluster status
-
-```
-GET /block/status
-```
-
-Returns volume count, server count, failover stats, queue depth.
-
-## Remote Client Setup
-
-To connect from a remote machine (not the Docker host):
-
-1. Set `HOST_IP` to the Docker host's network-reachable IP:
-   ```bash
-   HOST_IP=192.168.1.100 docker compose -f local-block-compose.yml up -d
-   ```
-
-2. On the client machine:
-   ```bash
-   sudo iscsiadm -m discovery -t sendtargets -p 192.168.1.100:3260
-   sudo iscsiadm -m node -T iqn.2024-01.com.seaweedfs:vol.myvolume \
-     -p 192.168.1.100:3260 --login
-   ```
-
-## Volume Lifecycle
-
-```
-create  -->  primary (serving I/O via iSCSI)
-                |
-           unmount/remount OK (lease auto-renewed by master)
-                |
-         assign replica  -->  WAL shipping active
-                |
-          kill primary   -->  promote replica  -->  new primary
-                |
-          old primary    -->  rebuild from new primary
-```
-
-Key points:
-- **Lease renewal is automatic.** The master continuously renews the primary's
-  write lease via the heartbeat stream. Unmount/remount works without manual
-  intervention.
-- **Epoch fencing.** Each role change bumps the epoch. Old primaries cannot
-  write after being demoted -- even if they still have the lease.
-- **Volumes survive container restart.** Data is stored in the Docker volume
-  at `/data/blocks/`. The volume server re-registers with the master on restart.
-
-## Troubleshooting
-
-**iSCSI login fails with "No records found"**
-- Run discovery first: `sudo iscsiadm -m discovery -t sendtargets -p HOST:3260`
-
-**Device not appearing after login**
-- Check `dmesg | tail` for SCSI errors
-- Verify the volume is assigned as primary: `curl http://HOST:9333/block/volumes`
-
-**I/O errors on write**
-- Check volume role is `primary` (not `none` or `stale`)
-- Check master is running (lease renewal requires master heartbeat)
-
-**Stuck iSCSI session after container restart**
-- Force logout: `sudo iscsiadm -m node -T IQN -p HOST:PORT --logout`
-- If stuck: `sudo ss -K dst HOST dport = 3260` to kill the TCP connection
-- Then re-discover and login
-
-## Docker Compose Reference
-
-```yaml
-# local-block-compose.yml
-services:
-  master:
-    image: seaweedfs-block:local
-    ports:
-      - "9333:9333"      # HTTP API
-      - "19333:19333"     # gRPC
-    command: ["master", "-ip=master", "-ip.bind=0.0.0.0", "-mdir=/data"]
-
-  volume:
-    image: seaweedfs-block:local
-    ports:
-      - "8280:8080"       # Volume HTTP
-      - "18280:18080"     # Volume gRPC
-      - "3260:3260"       # iSCSI target
-    command: >
-      volume -ip=volume -master=master:9333 -dir=/data
-      -block.dir=/data/blocks
-      -block.listen=0.0.0.0:3260
-      -block.portal=${HOST_IP:-127.0.0.1}:3260,1
-```
-
-Key flags:
-- `-block.dir`: Directory for `.blk` volume files
-- `-block.listen`: iSCSI target listen address (inside container)
-- `-block.portal`: iSCSI portal address reported to clients (must be reachable)

docker/compose/local-block-compose.yml

@@ -1,38 +0,0 @@
-## SeaweedFS Block Storage — Docker Compose
-##
-## Usage:
-##   HOST_IP=192.168.1.100 docker compose -f local-block-compose.yml up -d
-##
-## The HOST_IP is used for iSCSI discovery so external clients can connect.
-## If running on the same host, you can use: HOST_IP=127.0.0.1
-
-services:
-  master:
-    image: seaweedfs-block:local
-    entrypoint: ["/usr/bin/weed"]
-    ports:
-      - "9333:9333"
-      - "19333:19333"
-    command: ["master", "-ip=master", "-ip.bind=0.0.0.0", "-mdir=/data"]
-
-  volume:
-    image: seaweedfs-block:local
-    ports:
-      - "8280:8080"
-      - "18280:18080"
-      - "3260:3260"
-    entrypoint: ["/bin/sh", "-c"]
-    command:
-      - >
-        mkdir -p /data/blocks &&
-        exec /usr/bin/weed volume
-        -ip=volume
-        -master=master:9333
-        -ip.bind=0.0.0.0
-        -port=8080
-        -dir=/data
-        -block.dir=/data/blocks
-        -block.listen=0.0.0.0:3260
-        -block.portal=${HOST_IP:-127.0.0.1}:3260,1
-    depends_on:
-      - master

docker/compose/master-cloud.toml

@@ -7,6 +7,7 @@
 
 [master.maintenance]
 # periodically run these scripts are the same as running them from 'weed shell'
+# Scripts are skipped while an admin server is connected.
 scripts = """
   lock
   ec.encode -fullPercent=95 -quietFor=1h

docker/entrypoint.sh

@@ -1,2 +1,105 @@
 #!/bin/sh
-exec /usr/bin/weed "$@"
+
+# Enable FIPS 140-3 mode by default (Go 1.24+)
+# To disable: docker run -e GODEBUG=fips140=off ...
+export GODEBUG="${GODEBUG:+$GODEBUG,}fips140=on"
+
+# Fix permissions for mounted volumes
+# If /data is mounted from host, it might have different ownership
+# Fix this by ensuring seaweed user owns the directory
+if [ "$(id -u)" = "0" ]; then
+  # Running as root, check and fix permissions if needed
+  SEAWEED_UID=$(id -u seaweed)
+  SEAWEED_GID=$(id -g seaweed)
+  
+  # Verify seaweed user and group exist
+  if [ -z "$SEAWEED_UID" ] || [ -z "$SEAWEED_GID" ]; then
+    echo "Error: 'seaweed' user or group not found. Cannot fix permissions." >&2
+    exit 1
+  fi
+  
+  DATA_UID=$(stat -c '%u' /data 2>/dev/null)
+  DATA_GID=$(stat -c '%g' /data 2>/dev/null)
+
+  # Only run chown -R if ownership doesn't already match (avoids expensive
+  # recursive chown on subsequent starts, and is a no-op on OpenShift when
+  # fsGroup has already set correct ownership on the PVC).
+  if [ "$DATA_UID" != "$SEAWEED_UID" ] || [ "$DATA_GID" != "$SEAWEED_GID" ]; then
+    echo "Fixing /data ownership for seaweed user (uid=$SEAWEED_UID, gid=$SEAWEED_GID)"
+    if ! chown -R seaweed:seaweed /data; then
+      echo "Warning: Failed to change ownership of /data. This may cause permission errors." >&2
+      echo "If /data is read-only or has mount issues, the application may fail to start." >&2
+    fi
+  fi
+  
+  # Use su-exec to drop privileges and run as seaweed user
+  exec su-exec seaweed "$0" "$@"
+fi
+
+isArgPassed() {
+  arg="$1"
+  argWithEqualSign="$1="
+  shift
+  while [ $# -gt 0 ]; do
+    passedArg="$1"
+    shift
+    case $passedArg in
+    "$arg")
+      return 0
+      ;;
+    "$argWithEqualSign"*)
+      return 0
+      ;;
+    esac
+  done
+  return 1
+}
+
+case "$1" in
+
+  'master')
+  	ARGS="-mdir=/data -volumeSizeLimitMB=1024"
+  	shift
+  	exec /usr/bin/weed -logtostderr=true master $ARGS $@
+	;;
+
+  'volume')
+  	ARGS="-dir=/data -max=0"
+  	if isArgPassed "-max" "$@"; then
+  	  ARGS="-dir=/data"
+  	fi
+  	shift
+  	exec /usr/bin/weed -logtostderr=true volume $ARGS $@
+	;;
+
+  'server')
+  	ARGS="-dir=/data -volume.max=0 -master.volumeSizeLimitMB=1024"
+  	if isArgPassed "-volume.max" "$@"; then
+  	  ARGS="-dir=/data -master.volumeSizeLimitMB=1024"
+  	fi
+ 	shift
+  	exec /usr/bin/weed -logtostderr=true server $ARGS $@
+  	;;
+
+  'filer')
+  	ARGS=""
+  	shift
+  	exec /usr/bin/weed -logtostderr=true filer $ARGS $@
+	;;
+
+  's3')
+  	ARGS="-domainName=$S3_DOMAIN_NAME -key.file=$S3_KEY_FILE -cert.file=$S3_CERT_FILE"
+  	shift
+  	exec /usr/bin/weed -logtostderr=true s3 $ARGS $@
+	;;
+
+  'shell')
+  	ARGS="-cluster=$SHELL_CLUSTER -filer=$SHELL_FILER -filerGroup=$SHELL_FILER_GROUP -master=$SHELL_MASTER -options=$SHELL_OPTIONS"
+  	shift
+  	exec echo "$@" | /usr/bin/weed -logtostderr=true shell $ARGS
+  ;;
+
+  *)
+  	exec /usr/bin/weed $@
+	;;
+esac

go.mod

@@ -1,6 +1,6 @@
 module github.com/seaweedfs/seaweedfs
 
-go 1.24.9
+go 1.25.0
 
 require (
 	cloud.google.com/go v0.123.0 // indirect
@@ -26,7 +26,7 @@ require (
 	github.com/facebookgo/stats v0.0.0-20151006221625-1b76add642e4
 	github.com/facebookgo/subset v0.0.0-20200203212716-c811ad88dec4 // indirect
 	github.com/fsnotify/fsnotify v1.9.0 // indirect
-	github.com/go-redsync/redsync/v4 v4.15.0
+	github.com/go-redsync/redsync/v4 v4.16.0
 	github.com/go-sql-driver/mysql v1.9.3
 	github.com/go-zookeeper/zk v1.0.3 // indirect
 	github.com/golang/protobuf v1.5.4
@@ -63,7 +63,7 @@ require (
 	github.com/prometheus/client_golang v1.23.2
 	github.com/prometheus/client_model v0.6.2 // indirect
 	github.com/prometheus/common v0.67.2 // indirect
-	github.com/prometheus/procfs v0.19.2
+	github.com/prometheus/procfs v0.20.1
 	github.com/rcrowley/go-metrics v0.0.0-20201227073835-cf1acfcdf475 // indirect
 	github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec // indirect
 	github.com/seaweedfs/goexif v1.0.3
@@ -87,22 +87,22 @@ require (
 	github.com/xdg-go/stringprep v1.0.4 // indirect
 	github.com/youmark/pkcs8 v0.0.0-20240726163527-a2c0da244d78 // indirect
 	go.etcd.io/etcd/client/v3 v3.6.7
-	go.mongodb.org/mongo-driver v1.17.6
+	go.mongodb.org/mongo-driver v1.17.9
 	go.opencensus.io v0.24.0 // indirect
-	gocloud.dev v0.44.0
-	gocloud.dev/pubsub/natspubsub v0.44.0
+	gocloud.dev v0.45.0
+	gocloud.dev/pubsub/natspubsub v0.45.0
 	gocloud.dev/pubsub/rabbitpubsub v0.44.0
 	golang.org/x/crypto v0.48.0
 	golang.org/x/exp v0.0.0-20251023183803-a4bb9ffd2546
 	golang.org/x/image v0.36.0
 	golang.org/x/net v0.49.0
-	golang.org/x/oauth2 v0.34.0
-	golang.org/x/sys v0.41.0
+	golang.org/x/oauth2 v0.35.0
+	golang.org/x/sys v0.42.0
 	golang.org/x/text v0.34.0 // indirect
 	golang.org/x/tools v0.41.0 // indirect
 	golang.org/x/xerrors v0.0.0-20240903120638-7835f813f4da // indirect
 	google.golang.org/api v0.258.0
-	google.golang.org/genproto v0.0.0-20250922171735-9219d122eba9 // indirect
+	google.golang.org/genproto v0.0.0-20251124214823-79d6a2a48846 // indirect
 	google.golang.org/grpc v1.78.0
 	google.golang.org/protobuf v1.36.11
 	gopkg.in/inf.v0 v0.9.1 // indirect
@@ -124,14 +124,13 @@ require (
 	github.com/apple/foundationdb/bindings/go v0.0.0-20250911184653-27f7192f47c3
 	github.com/arangodb/go-driver v1.6.9
 	github.com/armon/go-metrics v0.4.1
-	github.com/aws/aws-sdk-go-v2 v1.41.1
+	github.com/aws/aws-sdk-go-v2 v1.41.3
 	github.com/aws/aws-sdk-go-v2/config v1.32.7
 	github.com/aws/aws-sdk-go-v2/credentials v1.19.7
 	github.com/aws/aws-sdk-go-v2/service/s3 v1.95.0
 	github.com/cognusion/imaging v1.0.2
-	github.com/container-storage-interface/spec v1.10.0
 	github.com/fluent/fluent-logger-golang v1.10.1
-	github.com/getsentry/sentry-go v0.42.0
+	github.com/getsentry/sentry-go v0.43.0
 	github.com/go-ldap/ldap/v3 v3.4.12
 	github.com/golang-jwt/jwt/v5 v5.3.1
 	github.com/google/flatbuffers/go v0.0.0-20230108230133-3b8644d32c50
@@ -139,7 +138,7 @@ require (
 	github.com/hashicorp/raft-boltdb/v2 v2.3.1
 	github.com/hashicorp/vault/api v1.22.0
 	github.com/jhump/protoreflect v1.18.0
-	github.com/linkedin/goavro/v2 v2.14.1
+	github.com/linkedin/goavro/v2 v2.15.0
 	github.com/mattn/go-sqlite3 v1.14.34
 	github.com/minio/crc64nvme v1.1.1
 	github.com/orcaman/concurrent-map/v2 v2.0.1
@@ -151,7 +150,7 @@ require (
 	github.com/redis/go-redis/v9 v9.18.0
 	github.com/schollz/progressbar/v3 v3.19.0
 	github.com/seaweedfs/go-fuse/v2 v2.9.1
-	github.com/shirou/gopsutil/v4 v4.26.1
+	github.com/shirou/gopsutil/v4 v4.26.2
 	github.com/tarantool/go-tarantool/v2 v2.4.1
 	github.com/testcontainers/testcontainers-go v0.39.0
 	github.com/tikv/client-go/v2 v2.0.7
@@ -172,7 +171,7 @@ require (
 	atomicgo.dev/keyboard v0.2.9 // indirect
 	atomicgo.dev/schedule v0.1.0 // indirect
 	cloud.google.com/go/longrunning v0.7.0 // indirect
-	cloud.google.com/go/pubsub/v2 v2.2.1 // indirect
+	cloud.google.com/go/pubsub/v2 v2.3.0 // indirect
 	dario.cat/mergo v1.0.2 // indirect
 	github.com/Azure/azure-sdk-for-go/sdk/keyvault/internal v0.7.1 // indirect
 	github.com/Azure/go-ansiterm v0.0.0-20250102033503-faa5f7b0171c // indirect
@@ -227,7 +226,6 @@ require (
 	github.com/hashicorp/go-secure-stdlib/strutil v0.1.2 // indirect
 	github.com/hashicorp/go-sockaddr v1.0.7 // indirect
 	github.com/hashicorp/hcl v1.0.1-vault-7 // indirect
-	github.com/iceber/iouring-go v0.0.0-20230403020409-002cfd2e2a90 // indirect
 	github.com/internxt/rclone-adapter v0.0.0-20260213125353-6f59c89fcb7c // indirect
 	github.com/jackc/pgpassfile v1.0.0 // indirect
 	github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761 // indirect
@@ -257,7 +255,6 @@ require (
 	github.com/openzipkin/zipkin-go v0.4.3 // indirect
 	github.com/parquet-go/bitpack v1.0.0 // indirect
 	github.com/parquet-go/jsonlite v1.0.0 // indirect
-	github.com/pawelgaczynski/giouring v0.0.0-20230826085535-69588b89acb9 // indirect
 	github.com/petermattis/goid v0.0.0-20260113132338-7c7de50cc741 // indirect
 	github.com/pierrre/geohash v1.0.0 // indirect
 	github.com/pquerna/otp v1.5.0 // indirect
@@ -282,10 +279,10 @@ require (
 	github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415 // indirect
 	github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e // indirect
 	github.com/zeebo/xxh3 v1.0.2 // indirect
-	go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.37.0 // indirect
-	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.37.0 // indirect
+	go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.38.0 // indirect
+	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.38.0 // indirect
 	go.opentelemetry.io/otel/exporters/zipkin v1.36.0 // indirect
-	go.opentelemetry.io/proto/otlp v1.7.0 // indirect
+	go.opentelemetry.io/proto/otlp v1.9.0 // indirect
 	go.uber.org/mock v0.5.2 // indirect
 	go.yaml.in/yaml/v2 v2.4.3 // indirect
 	go.yaml.in/yaml/v3 v3.0.4 // indirect
@@ -295,12 +292,12 @@ require (
 )
 
 require (
-	cel.dev/expr v0.24.0 // indirect
+	cel.dev/expr v0.25.1 // indirect
 	cloud.google.com/go/auth v0.17.0 // indirect
 	cloud.google.com/go/auth/oauth2adapt v0.2.8 // indirect
 	cloud.google.com/go/compute/metadata v0.9.0 // indirect
 	cloud.google.com/go/iam v1.5.3 // indirect
-	cloud.google.com/go/monitoring v1.24.2 // indirect
+	cloud.google.com/go/monitoring v1.24.3 // indirect
 	filippo.io/edwards25519 v1.1.1 // indirect
 	github.com/Azure/azure-sdk-for-go/sdk/azcore v1.21.0
 	github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.13.1
@@ -330,7 +327,7 @@ require (
 	github.com/arangodb/go-velocypack v0.0.0-20200318135517-5af53c29c67e // indirect
 	github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.4 // indirect
 	github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.17 // indirect
-	github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.20.4 // indirect
+	github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.20.12 // indirect
 	github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.17 // indirect
 	github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.17 // indirect
 	github.com/aws/aws-sdk-go-v2/internal/ini v1.8.4 // indirect
@@ -339,12 +336,12 @@ require (
 	github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.9.7 // indirect
 	github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.17 // indirect
 	github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.19.16 // indirect
-	github.com/aws/aws-sdk-go-v2/service/sns v1.34.7 // indirect
-	github.com/aws/aws-sdk-go-v2/service/sqs v1.38.8 // indirect
+	github.com/aws/aws-sdk-go-v2/service/sns v1.39.7 // indirect
+	github.com/aws/aws-sdk-go-v2/service/sqs v1.42.17 // indirect
 	github.com/aws/aws-sdk-go-v2/service/sso v1.30.9 // indirect
 	github.com/aws/aws-sdk-go-v2/service/ssooidc v1.35.13 // indirect
-	github.com/aws/aws-sdk-go-v2/service/sts v1.41.6 // indirect
-	github.com/aws/smithy-go v1.24.0
+	github.com/aws/aws-sdk-go-v2/service/sts v1.41.6
+	github.com/aws/smithy-go v1.24.2
 	github.com/boltdb/bolt v1.3.1 // indirect
 	github.com/bradenaw/juniper v0.15.3 // indirect
 	github.com/bradfitz/iter v0.0.0-20191230175014-e8f45d346db8 // indirect
@@ -355,7 +352,7 @@ require (
 	github.com/cloudinary/cloudinary-go/v2 v2.13.0 // indirect
 	github.com/cloudsoda/go-smb2 v0.0.0-20250228001242-d4c70e6251cc // indirect
 	github.com/cloudsoda/sddl v0.0.0-20250224235906-926454e91efc // indirect
-	github.com/cncf/xds/go v0.0.0-20251022180443-0feb69152e9f // indirect
+	github.com/cncf/xds/go v0.0.0-20251110193048-8bfbf64dc13e // indirect
 	github.com/colinmarc/hdfs/v2 v2.4.0 // indirect
 	github.com/creasty/defaults v1.8.0 // indirect
 	github.com/cronokirby/saferith v0.33.0 // indirect
@@ -363,11 +360,11 @@ require (
 	github.com/d4l3k/messagediff v1.2.1 // indirect
 	github.com/dgryski/go-farm v0.0.0-20200201041132-a6ae2369ad13 // indirect
 	github.com/dropbox/dropbox-sdk-go-unofficial/v6 v6.0.5 // indirect
-	github.com/ebitengine/purego v0.9.1 // indirect
+	github.com/ebitengine/purego v0.10.0 // indirect
 	github.com/elastic/gosigar v0.14.3 // indirect
 	github.com/emersion/go-message v0.18.2 // indirect
 	github.com/emersion/go-vcard v0.0.0-20241024213814-c9703dde27ff // indirect
-	github.com/envoyproxy/go-control-plane/envoy v1.35.0 // indirect
+	github.com/envoyproxy/go-control-plane/envoy v1.36.0 // indirect
 	github.com/envoyproxy/protoc-gen-validate v1.2.1 // indirect
 	github.com/fatih/color v1.18.0 // indirect
 	github.com/felixge/httpsnoop v1.0.4 // indirect
@@ -431,8 +428,8 @@ require (
 	github.com/mitchellh/mapstructure v1.5.1-0.20220423185008-bf980b35cac4
 	github.com/montanaflynn/stats v0.7.1 // indirect
 	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
-	github.com/nats-io/nats.go v1.43.0 // indirect
-	github.com/nats-io/nkeys v0.4.11 // indirect
+	github.com/nats-io/nats.go v1.48.0 // indirect
+	github.com/nats-io/nkeys v0.4.12 // indirect
 	github.com/nats-io/nuid v1.0.1 // indirect
 	github.com/ncruces/go-strftime v1.0.0 // indirect
 	github.com/ncw/swift/v2 v2.0.5 // indirect
@@ -496,11 +493,11 @@ require (
 	go.opentelemetry.io/contrib/detectors/gcp v1.38.0 // indirect
 	go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.63.0 // indirect
 	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.63.0 // indirect
-	go.opentelemetry.io/otel v1.38.0 // indirect
-	go.opentelemetry.io/otel/metric v1.38.0 // indirect
-	go.opentelemetry.io/otel/sdk v1.38.0 // indirect
-	go.opentelemetry.io/otel/sdk/metric v1.38.0 // indirect
-	go.opentelemetry.io/otel/trace v1.38.0 // indirect
+	go.opentelemetry.io/otel v1.40.0 // indirect
+	go.opentelemetry.io/otel/metric v1.40.0 // indirect
+	go.opentelemetry.io/otel/sdk v1.40.0 // indirect
+	go.opentelemetry.io/otel/sdk/metric v1.40.0 // indirect
+	go.opentelemetry.io/otel/trace v1.40.0 // indirect
 	go.uber.org/multierr v1.11.0 // indirect
 	go.uber.org/zap v1.27.1 // indirect
 	golang.org/x/term v0.40.0 // indirect
@@ -523,14 +520,3 @@ require (
 )
 
 // replace github.com/seaweedfs/raft => /Users/chrislu/go/src/github.com/seaweedfs/raft
-
-// V2 engine bridge modules (Phase 07)
-require (
-	github.com/seaweedfs/seaweedfs/sw-block/engine/replication v0.0.0
-	github.com/seaweedfs/seaweedfs/sw-block/bridge/blockvol v0.0.0
-)
-
-replace (
-	github.com/seaweedfs/seaweedfs/sw-block/engine/replication => ./sw-block/engine/replication
-	github.com/seaweedfs/seaweedfs/sw-block/bridge/blockvol => ./sw-block/bridge/blockvol
-)

go.sum

@@ -6,8 +6,8 @@ atomicgo.dev/keyboard v0.2.9 h1:tOsIid3nlPLZ3lwgG8KZMp/SFmr7P0ssEN5JUsm78K8=
 atomicgo.dev/keyboard v0.2.9/go.mod h1:BC4w9g00XkxH/f1HXhW2sXmJFOCWbKn9xrOunSFtExQ=
 atomicgo.dev/schedule v0.1.0 h1:nTthAbhZS5YZmgYbb2+DH8uQIZcTlIrd4eYr3UQxEjs=
 atomicgo.dev/schedule v0.1.0/go.mod h1:xeUa3oAkiuHYh8bKiQBRojqAMq3PXXbJujjb0hw8pEU=
-cel.dev/expr v0.24.0 h1:56OvJKSH3hDGL0ml5uSxZmz3/3Pq4tJ+fb1unVLAFcY=
-cel.dev/expr v0.24.0/go.mod h1:hLPLo1W4QUmuYdA72RBX06QTs6MXw941piREPl3Yfiw=
+cel.dev/expr v0.25.1 h1:1KrZg61W6TWSxuNZ37Xy49ps13NUovb66QLprthtwi4=
+cel.dev/expr v0.25.1/go.mod h1:hrXvqGP6G6gyx8UAHSHJ5RGk//1Oj5nXQ2NI02Nrsg4=
 cloud.google.com/go v0.26.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw=
 cloud.google.com/go v0.34.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw=
 cloud.google.com/go v0.38.0/go.mod h1:990N+gfupTy94rShfmMCWGDn0LpTmnzTp2qbd1dvSRU=
@@ -310,8 +310,8 @@ cloud.google.com/go/lifesciences v0.6.0/go.mod h1:ddj6tSX/7BOnhxCSd3ZcETvtNr8NZ6
 cloud.google.com/go/lifesciences v0.8.0/go.mod h1:lFxiEOMqII6XggGbOnKiyZ7IBwoIqA84ClvoezaA/bo=
 cloud.google.com/go/logging v1.6.1/go.mod h1:5ZO0mHHbvm8gEmeEUHrmDlTDSu5imF6MUP9OfilNXBw=
 cloud.google.com/go/logging v1.7.0/go.mod h1:3xjP2CjkM3ZkO73aj4ASA5wRPGGCRrPIAeNqVNkzY8M=
-cloud.google.com/go/logging v1.13.0 h1:7j0HgAp0B94o1YRDqiqm26w4q1rDMH7XNRU34lJXHYc=
-cloud.google.com/go/logging v1.13.0/go.mod h1:36CoKh6KA/M0PbhPKMq6/qety2DCAErbhXT62TuXALA=
+cloud.google.com/go/logging v1.13.1 h1:O7LvmO0kGLaHY/gq8cV7T0dyp6zJhYAOtZPX4TF3QtY=
+cloud.google.com/go/logging v1.13.1/go.mod h1:XAQkfkMBxQRjQek96WLPNze7vsOmay9H5PqfsNYDqvw=
 cloud.google.com/go/longrunning v0.1.1/go.mod h1:UUFxuDWkv22EuY93jjmDMFT5GPQKeFVJBIF6QlTqdsE=
 cloud.google.com/go/longrunning v0.3.0/go.mod h1:qth9Y41RRSUE69rDcOn6DdK3HfQfsUI0YSmW3iIlLJc=
 cloud.google.com/go/longrunning v0.4.1/go.mod h1:4iWDqhBZ70CvZ6BfETbvam3T8FMvLK+eFj0E6AaRQTo=
@@ -338,8 +338,8 @@ cloud.google.com/go/metastore v1.10.0/go.mod h1:fPEnH3g4JJAk+gMRnrAnoqyv2lpUCqJP
 cloud.google.com/go/monitoring v1.7.0/go.mod h1:HpYse6kkGo//7p6sT0wsIC6IBDET0RhIsnmlA53dvEk=
 cloud.google.com/go/monitoring v1.8.0/go.mod h1:E7PtoMJ1kQXWxPjB6mv2fhC5/15jInuulFdYYtlcvT4=
 cloud.google.com/go/monitoring v1.12.0/go.mod h1:yx8Jj2fZNEkL/GYZyTLS4ZtZEZN8WtDEiEqG4kLK50w=
-cloud.google.com/go/monitoring v1.24.2 h1:5OTsoJ1dXYIiMiuL+sYscLc9BumrL3CarVLL7dd7lHM=
-cloud.google.com/go/monitoring v1.24.2/go.mod h1:x7yzPWcgDRnPEv3sI+jJGBkwl5qINf+6qY4eq0I9B4U=
+cloud.google.com/go/monitoring v1.24.3 h1:dde+gMNc0UhPZD1Azu6at2e79bfdztVDS5lvhOdsgaE=
+cloud.google.com/go/monitoring v1.24.3/go.mod h1:nYP6W0tm3N9H/bOw8am7t62YTzZY+zUeQ+Bi6+2eonI=
 cloud.google.com/go/networkconnectivity v1.4.0/go.mod h1:nOl7YL8odKyAOtzNX73/M5/mGZgqqMeryi6UPZTk/rA=
 cloud.google.com/go/networkconnectivity v1.5.0/go.mod h1:3GzqJx7uhtlM3kln0+x5wyFvuVH1pIBJjhCpjzSt75o=
 cloud.google.com/go/networkconnectivity v1.6.0/go.mod h1:OJOoEXW+0LAxHh89nXd64uGG+FbQoeH8DtxCHVOMlaM=
@@ -393,8 +393,8 @@ cloud.google.com/go/pubsub v1.27.1/go.mod h1:hQN39ymbV9geqBnfQq6Xf63yNhUAhv9CZhz
 cloud.google.com/go/pubsub v1.28.0/go.mod h1:vuXFpwaVoIPQMGXqRyUQigu/AX1S3IWugR9xznmcXX8=
 cloud.google.com/go/pubsub v1.50.1 h1:fzbXpPyJnSGvWXF1jabhQeXyxdbCIkXTpjXHy7xviBM=
 cloud.google.com/go/pubsub v1.50.1/go.mod h1:6YVJv3MzWJUVdvQXG081sFvS0dWQOdnV+oTo++q/xFk=
-cloud.google.com/go/pubsub/v2 v2.2.1 h1:3brZcshL3fIiD1qOxAE2QW9wxsfjioy014x4yC9XuYI=
-cloud.google.com/go/pubsub/v2 v2.2.1/go.mod h1:O5f0KHG9zDheZAd3z5rlCRhxt2JQtB+t/IYLKK3Bpvw=
+cloud.google.com/go/pubsub/v2 v2.3.0 h1:DgAN907x+sP0nScYfBzneRiIhWoXcpCD8ZAut8WX9vs=
+cloud.google.com/go/pubsub/v2 v2.3.0/go.mod h1:O5f0KHG9zDheZAd3z5rlCRhxt2JQtB+t/IYLKK3Bpvw=
 cloud.google.com/go/pubsublite v1.5.0/go.mod h1:xapqNQ1CuLfGi23Yda/9l4bBCKz/wC3KIJ5gKcxveZg=
 cloud.google.com/go/pubsublite v1.6.0/go.mod h1:1eFCS0U11xlOuMFV/0iBqw3zP12kddMeCbj/F3FSj9k=
 cloud.google.com/go/recaptchaenterprise v1.3.1/go.mod h1:OdD+q+y4XGeAlxRaMn1Y7/GveP6zmq76byL6tjPE7d4=
@@ -504,8 +504,8 @@ cloud.google.com/go/tpu v1.5.0/go.mod h1:8zVo1rYDFuW2l4yZVY0R0fb/v44xLh3llq7RuV6
 cloud.google.com/go/trace v1.3.0/go.mod h1:FFUE83d9Ca57C+K8rDl/Ih8LwOzWIV1krKgxg6N0G28=
 cloud.google.com/go/trace v1.4.0/go.mod h1:UG0v8UBqzusp+z63o7FK74SdFE+AXpCLdFb1rshXG+Y=
 cloud.google.com/go/trace v1.8.0/go.mod h1:zH7vcsbAhklH8hWFig58HvxcxyQbaIqMarMg9hn5ECA=
-cloud.google.com/go/trace v1.11.6 h1:2O2zjPzqPYAHrn3OKl029qlqG6W8ZdYaOWRyr8NgMT4=
-cloud.google.com/go/trace v1.11.6/go.mod h1:GA855OeDEBiBMzcckLPE2kDunIpC72N+Pq8WFieFjnI=
+cloud.google.com/go/trace v1.11.7 h1:kDNDX8JkaAG3R2nq1lIdkb7FCSi1rCmsEtKVsty7p+U=
+cloud.google.com/go/trace v1.11.7/go.mod h1:TNn9d5V3fQVf6s4SCveVMIBS2LJUqo73GACmq/Tky0s=
 cloud.google.com/go/translate v1.3.0/go.mod h1:gzMUwRjvOqj5i69y/LYLd8RrNQk+hOmIXTi9+nb3Djs=
 cloud.google.com/go/translate v1.4.0/go.mod h1:06Dn/ppvLD6WvA5Rhdp029IX2Mi3Mn7fpMRLPvXT5Wg=
 cloud.google.com/go/translate v1.6.0/go.mod h1:lMGRudH1pu7I3n3PETiOB2507gf3HnfLV8qlkHZEyos=
@@ -687,6 +687,8 @@ github.com/andybalholm/brotli v1.2.0/go.mod h1:rzTDkvFWvIrjDXZHkuS16NPggd91W3kUS
 github.com/andybalholm/cascadia v1.3.3 h1:AG2YHrzJIm4BZ19iwJ/DAua6Btl3IwJX+VI4kktS1LM=
 github.com/andybalholm/cascadia v1.3.3/go.mod h1:xNd9bqTn98Ln4DwST8/nG+H0yuB8Hmgu1YHNnWw0GeA=
 github.com/antihax/optional v1.0.0/go.mod h1:uupD/76wgC+ih3iEmQUL+0Ugr19nfwCT1kdvxnR2qWY=
+github.com/antithesishq/antithesis-sdk-go v0.5.0-default-no-op h1:Ucf+QxEKMbPogRO5guBNe5cgd9uZgfoJLOYs8WWhtjM=
+github.com/antithesishq/antithesis-sdk-go v0.5.0-default-no-op/go.mod h1:IUpT2DPAKh6i/YhSbt6Gl3v2yvUZjmKncl7U91fup7E=
 github.com/antlr4-go/antlr/v4 v4.13.1 h1:SqQKkuVZ+zWkMMNkjy5FZe5mr5WURWnlpmOuzYWrPrQ=
 github.com/antlr4-go/antlr/v4 v4.13.1/go.mod h1:GKmUxMtwp6ZgGwZSva4eWPC5mS6vUAmOABFgjdkM7Nw=
 github.com/apache/arrow-go/v18 v18.4.1 h1:q/jVkBWCJOB9reDgaIZIdruLQUb1kbkvOnOFezVH1C4=
@@ -714,8 +716,8 @@ github.com/armon/go-metrics v0.4.1/go.mod h1:E6amYzXo6aW1tqzoZGT755KkbgrJsSdpwZ+
 github.com/atomicgo/cursor v0.0.1/go.mod h1:cBON2QmmrysudxNBFthvMtN32r3jxVRIvzkUiF/RuIk=
 github.com/aws/aws-sdk-go v1.55.8 h1:JRmEUbU52aJQZ2AjX4q4Wu7t4uZjOu71uyNmaWlUkJQ=
 github.com/aws/aws-sdk-go v1.55.8/go.mod h1:ZkViS9AqA6otK+JBBNH2++sx1sgxrPKcSzPPvQkUtXk=
-github.com/aws/aws-sdk-go-v2 v1.41.1 h1:ABlyEARCDLN034NhxlRUSZr4l71mh+T5KAeGh6cerhU=
-github.com/aws/aws-sdk-go-v2 v1.41.1/go.mod h1:MayyLB8y+buD9hZqkCW3kX1AKq07Y5pXxtgB+rRFhz0=
+github.com/aws/aws-sdk-go-v2 v1.41.3 h1:4kQ/fa22KjDt13QCy1+bYADvdgcxpfH18f0zP542kZA=
+github.com/aws/aws-sdk-go-v2 v1.41.3/go.mod h1:mwsPRE8ceUUpiTgF7QmQIJ7lgsKUPQOUl3o72QBrE1o=
 github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.4 h1:489krEF9xIGkOaaX3CE/Be2uWjiXrkCH6gUX+bZA/BU=
 github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.4/go.mod h1:IOAPF6oT9KCsceNTvvYMNHy0+kMF8akOjeDvPENWxp4=
 github.com/aws/aws-sdk-go-v2/config v1.32.7 h1:vxUyWGUwmkQ2g19n7JY/9YL8MfAIl7bTesIUykECXmY=
@@ -724,8 +726,8 @@ github.com/aws/aws-sdk-go-v2/credentials v1.19.7 h1:tHK47VqqtJxOymRrNtUXN5SP/zUT
 github.com/aws/aws-sdk-go-v2/credentials v1.19.7/go.mod h1:qOZk8sPDrxhf+4Wf4oT2urYJrYt3RejHSzgAquYeppw=
 github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.17 h1:I0GyV8wiYrP8XpA70g1HBcQO1JlQxCMTW9npl5UbDHY=
 github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.17/go.mod h1:tyw7BOl5bBe/oqvoIeECFJjMdzXoa/dfVz3QQ5lgHGA=
-github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.20.4 h1:2fjfz3/G9BRvIKuNZ655GwzpklC2kEH0cowZQGO7uBg=
-github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.20.4/go.mod h1:Ymws824lvMypLFPwyyUXM52SXuGgxpu0+DISLfKvB+c=
+github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.20.12 h1:Zy6Tme1AA13kX8x3CnkHx5cqdGWGaj/anwOiWGnA0Xo=
+github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.20.12/go.mod h1:ql4uXYKoTM9WUAUSmthY4AtPVrlTBZOvnBJTiCUdPxI=
 github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.17 h1:xOLELNKGp2vsiteLsvLPwxC+mYmO6OZ8PYgiuPJzF8U=
 github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.17/go.mod h1:5M5CI3D12dNOtH3/mk6minaRwI2/37ifCURZISxA/IQ=
 github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.17 h1:WWLqlh79iO48yLkj1v3ISRNiv+3KdQoZ6JWyfcsyQik=
@@ -746,18 +748,18 @@ github.com/aws/aws-sdk-go-v2/service/s3 v1.95.0 h1:MIWra+MSq53CFaXXAywB2qg9YvVZi
 github.com/aws/aws-sdk-go-v2/service/s3 v1.95.0/go.mod h1:79S2BdqCJpScXZA2y+cpZuocWsjGjJINyXnOsf5DTz8=
 github.com/aws/aws-sdk-go-v2/service/signin v1.0.5 h1:VrhDvQib/i0lxvr3zqlUwLwJP4fpmpyD9wYG1vfSu+Y=
 github.com/aws/aws-sdk-go-v2/service/signin v1.0.5/go.mod h1:k029+U8SY30/3/ras4G/Fnv/b88N4mAfliNn08Dem4M=
-github.com/aws/aws-sdk-go-v2/service/sns v1.34.7 h1:OBuZE9Wt8h2imuRktu+WfjiTGrnYdCIJg8IX92aalHE=
-github.com/aws/aws-sdk-go-v2/service/sns v1.34.7/go.mod h1:4WYoZAhHt+dWYpoOQUgkUKfuQbE6Gg/hW4oXE0pKS9U=
-github.com/aws/aws-sdk-go-v2/service/sqs v1.38.8 h1:80dpSqWMwx2dAm30Ib7J6ucz1ZHfiv5OCRwN/EnCOXQ=
-github.com/aws/aws-sdk-go-v2/service/sqs v1.38.8/go.mod h1:IzNt/udsXlETCdvBOL0nmyMe2t9cGmXmZgsdoZGYYhI=
+github.com/aws/aws-sdk-go-v2/service/sns v1.39.7 h1:fovS7qGMT+BBSuifkySdVaMWxXTyaYT6qaBx/1y6Ij4=
+github.com/aws/aws-sdk-go-v2/service/sns v1.39.7/go.mod h1:gFahrattA8ulEtiS4XL/fQiQ77l+Urc52Y96/r1e6ks=
+github.com/aws/aws-sdk-go-v2/service/sqs v1.42.17 h1:ZNMxVFPayuHe14u/vn+BwLi3wxQvxcNTw8WdPv2gqBc=
+github.com/aws/aws-sdk-go-v2/service/sqs v1.42.17/go.mod h1:ZxqweFQ2w6NNznWMUvWV9AvkAfM6J8F/MC250Mb4n1I=
 github.com/aws/aws-sdk-go-v2/service/sso v1.30.9 h1:v6EiMvhEYBoHABfbGB4alOYmCIrcgyPPiBE1wZAEbqk=
 github.com/aws/aws-sdk-go-v2/service/sso v1.30.9/go.mod h1:yifAsgBxgJWn3ggx70A3urX2AN49Y5sJTD1UQFlfqBw=
 github.com/aws/aws-sdk-go-v2/service/ssooidc v1.35.13 h1:gd84Omyu9JLriJVCbGApcLzVR3XtmC4ZDPcAI6Ftvds=
 github.com/aws/aws-sdk-go-v2/service/ssooidc v1.35.13/go.mod h1:sTGThjphYE4Ohw8vJiRStAcu3rbjtXRsdNB0TvZ5wwo=
 github.com/aws/aws-sdk-go-v2/service/sts v1.41.6 h1:5fFjR/ToSOzB2OQ/XqWpZBmNvmP/pJ1jOWYlFDJTjRQ=
 github.com/aws/aws-sdk-go-v2/service/sts v1.41.6/go.mod h1:qgFDZQSD/Kys7nJnVqYlWKnh0SSdMjAi0uSwON4wgYQ=
-github.com/aws/smithy-go v1.24.0 h1:LpilSUItNPFr1eY85RYgTIg5eIEPtvFbskaFcmmIUnk=
-github.com/aws/smithy-go v1.24.0/go.mod h1:LEj2LM3rBRQJxPZTB4KuzZkaZYnZPnvgIhb4pu07mx0=
+github.com/aws/smithy-go v1.24.2 h1:FzA3bu/nt/vDvmnkg+R8Xl46gmzEDam6mZ1hzmwXFng=
+github.com/aws/smithy-go v1.24.2/go.mod h1:YE2RhdIuDbA5E5bTdciG9KrW3+TiEONeUWCqxX9i1Fc=
 github.com/bahlo/generic-list-go v0.2.0 h1:5sz/EEAK+ls5wF+NeqDpk5+iNdMDXrh3z3nPnH1Wvgk=
 github.com/bahlo/generic-list-go v0.2.0/go.mod h1:2KvAjgMlE5NNynlg/5iLrrCCZ2+5xWbdbCW3pNTGyYg=
 github.com/bazelbuild/rules_go v0.46.0 h1:CTefzjN/D3Cdn3rkrM6qMWuQj59OBcuOjyIp3m4hZ7s=
@@ -855,8 +857,8 @@ github.com/cncf/xds/go v0.0.0-20211011173535-cb28da3451f1/go.mod h1:eXthEFrGJvWH
 github.com/cncf/xds/go v0.0.0-20220314180256-7f1daf1720fc/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs=
 github.com/cncf/xds/go v0.0.0-20230105202645-06c439db220b/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs=
 github.com/cncf/xds/go v0.0.0-20230310173818-32f1caf87195/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs=
-github.com/cncf/xds/go v0.0.0-20251022180443-0feb69152e9f h1:Y8xYupdHxryycyPlc9Y+bSQAYZnetRJ70VMVKm5CKI0=
-github.com/cncf/xds/go v0.0.0-20251022180443-0feb69152e9f/go.mod h1:HlzOvOjVBOfTGSRXRyY0OiCS/3J1akRGQQpRO/7zyF4=
+github.com/cncf/xds/go v0.0.0-20251110193048-8bfbf64dc13e h1:gt7U1Igw0xbJdyaCM5H2CnlAlPSkzrhsebQB6WQWjLA=
+github.com/cncf/xds/go v0.0.0-20251110193048-8bfbf64dc13e/go.mod h1:KdCmV+x/BuvyMxRnYBlmVaq4OLiKW6iRQfvC62cvdkI=
 github.com/cockroachdb/apd/v3 v3.2.1 h1:U+8j7t0axsIgvQUqthuNm82HIrYXodOV2iWLWtEaIwg=
 github.com/cockroachdb/apd/v3 v3.2.1/go.mod h1:klXJcjp+FffLTHlhIG69tezTDvdP065naDsHzKhYSqc=
 github.com/cockroachdb/errors v1.11.3 h1:5bA+k2Y6r+oz/6Z/RFlNeVCesGARKuC6YymtcDrbC/I=
@@ -873,8 +875,6 @@ github.com/colinmarc/hdfs/v2 v2.4.0 h1:v6R8oBx/Wu9fHpdPoJJjpGSUxo8NhHIwrwsfhFvU9
 github.com/colinmarc/hdfs/v2 v2.4.0/go.mod h1:0NAO+/3knbMx6+5pCv+Hcbaz4xn/Zzbn9+WIib2rKVI=
 github.com/compose-spec/compose-go/v2 v2.6.0 h1:/+oBD2ixSENOeN/TlJqWZmUak0xM8A7J08w/z661Wd4=
 github.com/compose-spec/compose-go/v2 v2.6.0/go.mod h1:vPlkN0i+0LjLf9rv52lodNMUTJF5YHVfHVGLLIP67NA=
-github.com/container-storage-interface/spec v1.10.0 h1:YkzWPV39x+ZMTa6Ax2czJLLwpryrQ+dPesB34mrRMXA=
-github.com/container-storage-interface/spec v1.10.0/go.mod h1:DtUvaQszPml1YJfIK7c00mlv6/g4wNMLanLgiUbKFRI=
 github.com/containerd/console v1.0.3/go.mod h1:7LqA/THxQ86k76b8c/EMSiaJ3h1eZkMkXar0TQ1gf3U=
 github.com/containerd/console v1.0.5 h1:R0ymNeydRqH2DmakFNdmjR2k0t7UPuiOV/N/27/qqsc=
 github.com/containerd/console v1.0.5/go.mod h1:YynlIjWYF8myEu6sdkwKIvGQq+cOckRm6So2avqoYAk=
@@ -974,8 +974,8 @@ github.com/eapache/go-xerial-snappy v0.0.0-20230731223053-c322873962e3 h1:Oy0F4A
 github.com/eapache/go-xerial-snappy v0.0.0-20230731223053-c322873962e3/go.mod h1:YvSRo5mw33fLEx1+DlK6L2VV43tJt5Eyel9n9XBcR+0=
 github.com/eapache/queue v1.1.0 h1:YOEu7KNc61ntiQlcEeUIoDTJ2o8mQznoNvUhiigpIqc=
 github.com/eapache/queue v1.1.0/go.mod h1:6eCeP0CKFpHLu8blIFXhExK/dRa7WDZfr6jVFPTqq+I=
-github.com/ebitengine/purego v0.9.1 h1:a/k2f2HQU3Pi399RPW1MOaZyhKJL9w/xFpKAg4q1s0A=
-github.com/ebitengine/purego v0.9.1/go.mod h1:iIjxzd6CiRiOG0UyXP+V1+jWqUXVjPKLAI0mRfJZTmQ=
+github.com/ebitengine/purego v0.10.0 h1:QIw4xfpWT6GWTzaW5XEKy3HXoqrJGx1ijYHzTF0/ISU=
+github.com/ebitengine/purego v0.10.0/go.mod h1:iIjxzd6CiRiOG0UyXP+V1+jWqUXVjPKLAI0mRfJZTmQ=
 github.com/eiannone/keyboard v0.0.0-20220611211555-0d226195f203 h1:XBBHcIb256gUJtLmY22n99HaZTz+r2Z51xUPi01m3wg=
 github.com/eiannone/keyboard v0.0.0-20220611211555-0d226195f203/go.mod h1:E1jcSv8FaEny+OP/5k9UxZVw9YFWGj7eI4KR/iOBqCg=
 github.com/elastic/gosigar v0.14.3 h1:xwkKwPia+hSfg9GqrCUKYdId102m9qTJIIr7egmK/uo=
@@ -1002,8 +1002,8 @@ github.com/envoyproxy/go-control-plane v0.10.3/go.mod h1:fJJn/j26vwOu972OllsvAgJ
 github.com/envoyproxy/go-control-plane v0.11.0/go.mod h1:VnHyVMpzcLvCFt9yUz1UnCwHLhwx1WguiVDV7pTG/tI=
 github.com/envoyproxy/go-control-plane v0.13.5-0.20251024222203-75eaa193e329 h1:K+fnvUM0VZ7ZFJf0n4L/BRlnsb9pL/GuDG6FqaH+PwM=
 github.com/envoyproxy/go-control-plane v0.13.5-0.20251024222203-75eaa193e329/go.mod h1:Alz8LEClvR7xKsrq3qzoc4N0guvVNSS8KmSChGYr9hs=
-github.com/envoyproxy/go-control-plane/envoy v1.35.0 h1:ixjkELDE+ru6idPxcHLj8LBVc2bFP7iBytj353BoHUo=
-github.com/envoyproxy/go-control-plane/envoy v1.35.0/go.mod h1:09qwbGVuSWWAyN5t/b3iyVfz5+z8QWGrzkoqm/8SbEs=
+github.com/envoyproxy/go-control-plane/envoy v1.36.0 h1:yg/JjO5E7ubRyKX3m07GF3reDNEnfOboJ0QySbH736g=
+github.com/envoyproxy/go-control-plane/envoy v1.36.0/go.mod h1:ty89S1YCCVruQAm9OtKeEkQLTb+Lkz0k8v9W0Oxsv98=
 github.com/envoyproxy/go-control-plane/ratelimit v0.1.0 h1:/G9QYbddjL25KvtKTv3an9lx6VBE2cnb8wp1vEGNYGI=
 github.com/envoyproxy/go-control-plane/ratelimit v0.1.0/go.mod h1:Wk+tMFAFbCXaJPzVVHnPgRKdUdwW/KdbRt94AzgRee4=
 github.com/envoyproxy/protoc-gen-validate v0.1.0/go.mod h1:iSmxcyjqTsJpI2R4NaDN7+kN2VEUnK/pcBlmesArF7c=
@@ -1053,8 +1053,8 @@ github.com/gabriel-vasile/mimetype v1.4.11 h1:AQvxbp830wPhHTqc1u7nzoLT+ZFxGY7emj
 github.com/gabriel-vasile/mimetype v1.4.11/go.mod h1:d+9Oxyo1wTzWdyVUPMmXFvp4F9tea18J8ufA774AB3s=
 github.com/geoffgarside/ber v1.2.0 h1:/loowoRcs/MWLYmGX9QtIAbA+V/FrnVLsMMPhwiRm64=
 github.com/geoffgarside/ber v1.2.0/go.mod h1:jVPKeCbj6MvQZhwLYsGwaGI52oUorHoHKNecGT85ZCc=
-github.com/getsentry/sentry-go v0.42.0 h1:eeFMACuZTbUQf90RE8dE4tXeSe4CZyfvR1MBL7RLEt8=
-github.com/getsentry/sentry-go v0.42.0/go.mod h1:eRXCoh3uvmjQLY6qu63BjUZnaBu5L5WhMV1RwYO8W5s=
+github.com/getsentry/sentry-go v0.43.0 h1:XbXLpFicpo8HmBDaInk7dum18G9KSLcjZiyUKS+hLW4=
+github.com/getsentry/sentry-go v0.43.0/go.mod h1:XDotiNZbgf5U8bPDUAfvcFmOnMQQceESxyKaObSssW0=
 github.com/ghodss/yaml v1.0.0/go.mod h1:4dBDuWmgqj2HViK6kFavaiC9ZROes6MMH2rRYeMEF04=
 github.com/gin-contrib/sse v1.1.0 h1:n0w2GMuUpWDVp7qSpvze6fAu9iRxJY4Hmj6AmBOU05w=
 github.com/gin-contrib/sse v1.1.0/go.mod h1:hxRZ5gVpWMT7Z0B0gSNYqqsSCNIJMjzvm6fqCz9vjwM=
@@ -1126,8 +1126,8 @@ github.com/go-redis/redis/v7 v7.4.1 h1:PASvf36gyUpr2zdOUS/9Zqc80GbM+9BDyiJSJDDOr
 github.com/go-redis/redis/v7 v7.4.1/go.mod h1:JDNMw23GTyLNC4GZu9njt15ctBQVn7xjRfnwdHj/Dcg=
 github.com/go-redis/redis/v8 v8.11.5 h1:AcZZR7igkdvfVmQTPnu9WE37LRrO/YrBH5zWyjDC0oI=
 github.com/go-redis/redis/v8 v8.11.5/go.mod h1:gREzHqY1hg6oD9ngVRbLStwAWKhA0FEgq8Jd4h5lpwo=
-github.com/go-redsync/redsync/v4 v4.15.0 h1:KH/XymuxSV7vyKs6z1Cxxj+N+N18JlPxgXeP6x4JY54=
-github.com/go-redsync/redsync/v4 v4.15.0/go.mod h1:qNp+lLs3vkfZbtA/aM/OjlZHfEr5YTAYhRktFPKHC7s=
+github.com/go-redsync/redsync/v4 v4.16.0 h1:bNcOzeHH9d3s6pghU9NJFMPrQa41f5Nx3L4YKr3BdEU=
+github.com/go-redsync/redsync/v4 v4.16.0/go.mod h1:V4gagqgyASWBZuwx4xGzu72aZNb/6Mo05byUa3mVmKQ=
 github.com/go-resty/resty/v2 v2.16.5 h1:hBKqmWrr7uRc3euHVqmh1HTHcKn99Smr7o5spptdhTM=
 github.com/go-resty/resty/v2 v2.16.5/go.mod h1:hkJtXbA2iKHzJheXYvQ8snQES5ZLGKMwQ07xAwp/fiA=
 github.com/go-sql-driver/mysql v1.9.3 h1:U/N249h2WzJ3Ukj8SowVFjdtZKfu9vlLZxjPXV1aweo=
@@ -1239,6 +1239,8 @@ github.com/google/go-replayers/grpcreplay v1.3.0 h1:1Keyy0m1sIpqstQmgz307zhiJ1pV
 github.com/google/go-replayers/grpcreplay v1.3.0/go.mod h1:v6NgKtkijC0d3e3RW8il6Sy5sqRVUwoQa4mHOGEy8DI=
 github.com/google/go-replayers/httpreplay v1.2.0 h1:VM1wEyyjaoU53BwrOnaf9VhAyQQEEioJvFYxYcLRKzk=
 github.com/google/go-replayers/httpreplay v1.2.0/go.mod h1:WahEFFZZ7a1P4VM1qEeHy+tME4bwyqPcwWbNlUI1Mcg=
+github.com/google/go-tpm v0.9.8 h1:slArAR9Ft+1ybZu0lBwpSmpwhRXaa85hWtMinMyRAWo=
+github.com/google/go-tpm v0.9.8/go.mod h1:h9jEsEECg7gtLis0upRBQU+GhYVH6jMjrFxI8u6bVUY=
 github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
 github.com/google/gofuzz v1.2.0 h1:xRy4A+RhZaiKjJ1bPfwQ8sedCA+YS2YcCHW6ec7JMi0=
 github.com/google/gofuzz v1.2.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
@@ -1391,8 +1393,6 @@ github.com/hpcloud/tail v1.0.0/go.mod h1:ab1qPbhIpdTxEkNHXyeSf5vhxWSCs/tWer42PpO
 github.com/iancoleman/strcase v0.2.0/go.mod h1:iwCmte+B7n89clKwxIoIXy/HfoL7AsD47ZCWhYzw7ho=
 github.com/ianlancetaylor/demangle v0.0.0-20181102032728-5e5cf60278f6/go.mod h1:aSSvb/t6k1mPoxDqO4vJh6VOCGPwU4O0C2/Eqndh1Sc=
 github.com/ianlancetaylor/demangle v0.0.0-20200824232613-28f6c0f3b639/go.mod h1:aSSvb/t6k1mPoxDqO4vJh6VOCGPwU4O0C2/Eqndh1Sc=
-github.com/iceber/iouring-go v0.0.0-20230403020409-002cfd2e2a90 h1:xrtfZokN++5kencK33hn2Kx3Uj8tGnjMEhdt6FMvHD0=
-github.com/iceber/iouring-go v0.0.0-20230403020409-002cfd2e2a90/go.mod h1:LEzdaZarZ5aqROlLIwJ4P7h3+4o71008fSy6wpaEB+s=
 github.com/imdario/mergo v0.3.16 h1:wwQJbIsHYGMUyLSPrEq1CT16AhnhNJQ51+4fdHUnCl4=
 github.com/imdario/mergo v0.3.16/go.mod h1:WBLT9ZmE3lPoWsEzCh9LPo3TiwVN+ZKEjmz+hD27ysY=
 github.com/in-toto/in-toto-golang v0.5.0 h1:hb8bgwr0M2hGdDsLjkJ3ZqJ8JFLL/tgYdAxF/XEFBbY=
@@ -1518,8 +1518,8 @@ github.com/leodido/go-urn v1.4.0 h1:WT9HwE9SGECu3lg4d/dIA+jxlljEa1/ffXKmRjqdmIQ=
 github.com/leodido/go-urn v1.4.0/go.mod h1:bvxc+MVxLKB4z00jd1z+Dvzr47oO32F/QSNjSBOlFxI=
 github.com/lib/pq v1.11.1 h1:wuChtj2hfsGmmx3nf1m7xC2XpK6OtelS2shMY+bGMtI=
 github.com/lib/pq v1.11.1/go.mod h1:/p+8NSbOcwzAEI7wiMXFlgydTwcgTr3OSKMsD2BitpA=
-github.com/linkedin/goavro/v2 v2.14.1 h1:/8VjDpd38PRsy02JS0jflAu7JZPfJcGTwqWgMkFS2iI=
-github.com/linkedin/goavro/v2 v2.14.1/go.mod h1:KXx+erlq+RPlGSPmLF7xGo6SAbh8sCQ53x064+ioxhk=
+github.com/linkedin/goavro/v2 v2.15.0 h1:pDj1UrjUOO62iXhgBiE7jQkpNIc5/tA5eZsgolMjgVI=
+github.com/linkedin/goavro/v2 v2.15.0/go.mod h1:KXx+erlq+RPlGSPmLF7xGo6SAbh8sCQ53x064+ioxhk=
 github.com/linxGnu/grocksdb v1.10.7 h1:fCi4qvZWo04VgFwGWmO8HQJgUVounJBy+C2TMVPU/ho=
 github.com/linxGnu/grocksdb v1.10.7/go.mod h1:OLQKZwiKwaJiAVCsOzWKvwiLwfZ5Vz8Md5TYR7t7pM8=
 github.com/lithammer/fuzzysearch v1.1.8 h1:/HIuJnjHuXS8bKaiTMeeDlW2/AyIWk2brx1V8LFgLN4=
@@ -1567,8 +1567,8 @@ github.com/minio/c2goasm v0.0.0-20190812172519-36a3d3bbc4f3 h1:+n/aFZefKZp7spd8D
 github.com/minio/c2goasm v0.0.0-20190812172519-36a3d3bbc4f3/go.mod h1:RagcQ7I8IeTMnF8JTXieKnO4Z6JCsikNEzj0DwauVzE=
 github.com/minio/crc64nvme v1.1.1 h1:8dwx/Pz49suywbO+auHCBpCtlW1OfpcLN7wYgVR6wAI=
 github.com/minio/crc64nvme v1.1.1/go.mod h1:eVfm2fAzLlxMdUGc0EEBGSMmPwmXD5XiNRpnu9J3bvg=
-github.com/minio/highwayhash v1.0.2 h1:Aak5U0nElisjDCfPSG79Tgzkn2gl66NxOMspRrKnA/g=
-github.com/minio/highwayhash v1.0.2/go.mod h1:BQskDq+xkJ12lmlUUi7U0M5Swg3EWR+dLTk+kldvVxY=
+github.com/minio/highwayhash v1.0.4-0.20251030100505-070ab1a87a76 h1:KGuD/pM2JpL9FAYvBrnBBeENKZNh6eNtjqytV6TYjnk=
+github.com/minio/highwayhash v1.0.4-0.20251030100505-070ab1a87a76/go.mod h1:GGYsuwP/fPD6Y9hMiXuapVvlIUEhFhMTh0rxU3ik1LQ=
 github.com/mitchellh/colorstring v0.0.0-20190213212951-d06e56a500db h1:62I3jR2EmQ4l5rM/4FEfDWcRD+abF5XlKShorW5LRoQ=
 github.com/mitchellh/colorstring v0.0.0-20190213212951-d06e56a500db/go.mod h1:l0dey0ia/Uv7NcFFVbCLtqEBQbrT4OCwCSKTEv6enCw=
 github.com/mitchellh/go-homedir v1.1.0 h1:lukF9ziXFxDFPkA1vsr5zpc1XuPDn/wFntq5mG+4E0Y=
@@ -1626,14 +1626,14 @@ github.com/mwitkow/go-conntrack v0.0.0-20161129095857-cc309e4a2223/go.mod h1:qRW
 github.com/mwitkow/go-conntrack v0.0.0-20190716064945-2f068394615f/go.mod h1:qRWi+5nqEBWmkhHvq77mSJWrCKwh8bxhgT7d/eI7P4U=
 github.com/mxk/go-flowrate v0.0.0-20140419014527-cca7078d478f h1:y5//uYreIhSUg3J1GEMiLbxo1LJaP8RfCpH6pymGZus=
 github.com/mxk/go-flowrate v0.0.0-20140419014527-cca7078d478f/go.mod h1:ZdcZmHo+o7JKHSa8/e818NopupXU1YMK5fe1lsApnBw=
-github.com/nats-io/jwt/v2 v2.5.0 h1:WQQ40AAlqqfx+f6ku+i0pOVm+ASirD4fUh+oQsiE9Ak=
-github.com/nats-io/jwt/v2 v2.5.0/go.mod h1:24BeQtRwxRV8ruvC4CojXlx/WQ/VjuwlYiH+vu/+ibI=
-github.com/nats-io/nats-server/v2 v2.9.23 h1:6Wj6H6QpP9FMlpCyWUaNu2yeZ/qGj+mdRkZ1wbikExU=
-github.com/nats-io/nats-server/v2 v2.9.23/go.mod h1:wEjrEy9vnqIGE4Pqz4/c75v9Pmaq7My2IgFmnykc4C0=
-github.com/nats-io/nats.go v1.43.0 h1:uRFZ2FEoRvP64+UUhaTokyS18XBCR/xM2vQZKO4i8ug=
-github.com/nats-io/nats.go v1.43.0/go.mod h1:iRWIPokVIFbVijxuMQq4y9ttaBTMe0SFdlZfMDd+33g=
-github.com/nats-io/nkeys v0.4.11 h1:q44qGV008kYd9W1b1nEBkNzvnWxtRSQ7A8BoqRrcfa0=
-github.com/nats-io/nkeys v0.4.11/go.mod h1:szDimtgmfOi9n25JpfIdGw12tZFYXqhGxjhVxsatHVE=
+github.com/nats-io/jwt/v2 v2.8.0 h1:K7uzyz50+yGZDO5o772eRE7atlcSEENpL7P+b74JV1g=
+github.com/nats-io/jwt/v2 v2.8.0/go.mod h1:me11pOkwObtcBNR8AiMrUbtVOUGkqYjMQZ6jnSdVUIA=
+github.com/nats-io/nats-server/v2 v2.11.12 h1:jGDXTkcjqQ5fCRstwIxvv1K0RHfftFUoSCT/iIZcqOc=
+github.com/nats-io/nats-server/v2 v2.11.12/go.mod h1:5MCp/pqm5SEfsvVZ31ll1088ZTwEUdvRX1Hmh/mTTDg=
+github.com/nats-io/nats.go v1.48.0 h1:pSFyXApG+yWU/TgbKCjmm5K4wrHu86231/w84qRVR+U=
+github.com/nats-io/nats.go v1.48.0/go.mod h1:iRWIPokVIFbVijxuMQq4y9ttaBTMe0SFdlZfMDd+33g=
+github.com/nats-io/nkeys v0.4.12 h1:nssm7JKOG9/x4J8II47VWCL1Ds29avyiQDRn0ckMvDc=
+github.com/nats-io/nkeys v0.4.12/go.mod h1:MT59A1HYcjIcyQDJStTfaOY6vhy9XTUjOFo+SVsvpBg=
 github.com/nats-io/nuid v1.0.1 h1:5iA8DT8V7q8WK2EScv2padNa/rTESc1KdnPw4TC2paw=
 github.com/nats-io/nuid v1.0.1/go.mod h1:19wcPz3Ph3q0Jbyiqsd0kePYG7A95tJPxeL+1OSON2c=
 github.com/ncruces/go-strftime v1.0.0 h1:HMFp8mLCTPp341M/ZnA4qaf7ZlsbTc+miZjCLOFAw7w=
@@ -1680,8 +1680,6 @@ github.com/pascaldekloe/goe v0.1.0 h1:cBOtyMzM9HTpWjXfbbunk26uA6nG3a8n06Wieeh0Mw
 github.com/pascaldekloe/goe v0.1.0/go.mod h1:lzWF7FIEvWOWxwDKqyGYQf6ZUaNfKdP144TG7ZOy1lc=
 github.com/patrickmn/go-cache v2.1.0+incompatible h1:HRMgzkcYKYpi3C8ajMPV8OFXaaRUnok+kx1WdO15EQc=
 github.com/patrickmn/go-cache v2.1.0+incompatible/go.mod h1:3Qf8kWWT7OJRJbdiICTKqZju1ZixQ/KpMGzzAfe6+WQ=
-github.com/pawelgaczynski/giouring v0.0.0-20230826085535-69588b89acb9 h1:Cu/CW2nKeqXinVjf5Bq1FeBD4jWG/msC5UazjjgAvsU=
-github.com/pawelgaczynski/giouring v0.0.0-20230826085535-69588b89acb9/go.mod h1:HwOQqYv/WE3RMp4iTQsS6ou8WP3wKO9UXD0oDqB3NPU=
 github.com/pelletier/go-toml v1.9.5 h1:4yBQzkHv+7BHq2PQUZF3Mx0IYxG7LsP222s7Agd3ve8=
 github.com/pelletier/go-toml v1.9.5/go.mod h1:u1nR/EPcESfeI/szUZKdtJ0xRNbUoANCkoOuaOx1Y+c=
 github.com/pelletier/go-toml/v2 v2.2.4 h1:mye9XuhQ6gvn5h28+VilKrrPoQVanw5PMw/TB0t5Ec4=
@@ -1771,8 +1769,8 @@ github.com/prometheus/procfs v0.0.2/go.mod h1:TjEm7ze935MbeOT/UhFTIMYKhuLP4wbCsT
 github.com/prometheus/procfs v0.0.8/go.mod h1:7Qr8sr6344vo1JqZ6HhLceV9o3AJ1Ff+GxbHq6oeK9A=
 github.com/prometheus/procfs v0.1.3/go.mod h1:lV6e/gmhEcM9IjHGsFOCxxuZ+z1YqCvr4OA4YeYWdaU=
 github.com/prometheus/procfs v0.6.0/go.mod h1:cz+aTbrPOrUb4q7XlbU9ygM+/jj0fzG6c1xBZuNvfVA=
-github.com/prometheus/procfs v0.19.2 h1:zUMhqEW66Ex7OXIiDkll3tl9a1ZdilUOd/F6ZXw4Vws=
-github.com/prometheus/procfs v0.19.2/go.mod h1:M0aotyiemPhBCM0z5w87kL22CxfcH05ZpYlu+b4J7mw=
+github.com/prometheus/procfs v0.20.1 h1:XwbrGOIplXW/AU3YhIhLODXMJYyC1isLFfYCsTEycfc=
+github.com/prometheus/procfs v0.20.1/go.mod h1:o9EMBZGRyvDrSPH1RqdxhojkuXstoe4UlK79eF5TGGo=
 github.com/pterm/pterm v0.12.27/go.mod h1:PhQ89w4i95rhgE+xedAoqous6K9X+r6aSOI2eFF7DZI=
 github.com/pterm/pterm v0.12.29/go.mod h1:WI3qxgvoQFFGKGjGnJR849gU0TsEOvKn5Q8LlY1U7lg=
 github.com/pterm/pterm v0.12.30/go.mod h1:MOqLIyMOgmTDz9yorcYbcw+HsgoZo3BQfg2wtl3HEFE=
@@ -1806,10 +1804,10 @@ github.com/rdleal/intervalst v1.5.0 h1:SEB9bCFz5IqD1yhfH1Wv8IBnY/JQxDplwkxHjT6ha
 github.com/rdleal/intervalst v1.5.0/go.mod h1:xO89Z6BC+LQDH+IPQQw/OESt5UADgFD41tYMUINGpxQ=
 github.com/redis/go-redis/v9 v9.18.0 h1:pMkxYPkEbMPwRdenAzUNyFNrDgHx9U+DrBabWNfSRQs=
 github.com/redis/go-redis/v9 v9.18.0/go.mod h1:k3ufPphLU5YXwNTUcCRXGxUoF1fqxnhFQmscfkCoDA0=
-github.com/redis/rueidis v1.0.69 h1:WlUefRhuDekji5LsD387ys3UCJtSFeBVf0e5yI0B8b4=
-github.com/redis/rueidis v1.0.69/go.mod h1:Lkhr2QTgcoYBhxARU7kJRO8SyVlgUuEkcJO1Y8MCluA=
-github.com/redis/rueidis/rueidiscompat v1.0.69 h1:IWVYY9lXdjNO3do2VpJT7aDFi8zbCUuQxZB6E2Grahs=
-github.com/redis/rueidis/rueidiscompat v1.0.69/go.mod h1:iC4Y8DoN0Uth0Uezg9e2trvNRC7QAgGeuP2OPLb5ccI=
+github.com/redis/rueidis v1.0.71 h1:pODtnAR5GAB7j4ekhldZ29HKOxe4Hph0GTDGk1ayEQY=
+github.com/redis/rueidis v1.0.71/go.mod h1:lfdcZzJ1oKGKL37vh9fO3ymwt+0TdjkkUCJxbgpmcgQ=
+github.com/redis/rueidis/rueidiscompat v1.0.71 h1:wNZ//kEjMZgBM0KCk7ncOX8KmAgROU2kDdDNpwheG4w=
+github.com/redis/rueidis/rueidiscompat v1.0.71/go.mod h1:esmCLJvaRzZoKlgB82G1bY7Iky5TnO9Rz+NlhbEccFI=
 github.com/rekby/fixenv v0.3.2/go.mod h1:/b5LRc06BYJtslRtHKxsPWFT/ySpHV+rWvzTg+XWk4c=
 github.com/rekby/fixenv v0.6.1 h1:jUFiSPpajT4WY2cYuc++7Y1zWrnCxnovGCIX72PZniM=
 github.com/rekby/fixenv v0.6.1/go.mod h1:/b5LRc06BYJtslRtHKxsPWFT/ySpHV+rWvzTg+XWk4c=
@@ -1863,8 +1861,8 @@ github.com/serialx/hashring v0.0.0-20200727003509-22c0c7ab6b1b h1:h+3JX2VoWTFuyQ
 github.com/serialx/hashring v0.0.0-20200727003509-22c0c7ab6b1b/go.mod h1:/yeG0My1xr/u+HZrFQ1tOQQQQrOawfyMUH13ai5brBc=
 github.com/shibumi/go-pathspec v1.3.0 h1:QUyMZhFo0Md5B8zV8x2tesohbb5kfbpTi9rBnKh5dkI=
 github.com/shibumi/go-pathspec v1.3.0/go.mod h1:Xutfslp817l2I1cZvgcfeMQJG5QnU2lh5tVaaMCl3jE=
-github.com/shirou/gopsutil/v4 v4.26.1 h1:TOkEyriIXk2HX9d4isZJtbjXbEjf5qyKPAzbzY0JWSo=
-github.com/shirou/gopsutil/v4 v4.26.1/go.mod h1:medLI9/UNAb0dOI9Q3/7yWSqKkj00u+1tgY8nvv41pc=
+github.com/shirou/gopsutil/v4 v4.26.2 h1:X8i6sicvUFih4BmYIGT1m2wwgw2VG9YgrDTi7cIRGUI=
+github.com/shirou/gopsutil/v4 v4.26.2/go.mod h1:LZ6ewCSkBqUpvSOf+LsTGnRinC6iaNUNMGBtDkJBaLQ=
 github.com/sirupsen/logrus v1.2.0/go.mod h1:LxeOpSwHxABJmUn/MG1IvRgCAasNZTLOkJPxbbu5VWo=
 github.com/sirupsen/logrus v1.4.2/go.mod h1:tLMulIdttU9McNUspp0xgXVQah82FyeX6MwdIuYE2rE=
 github.com/sirupsen/logrus v1.5.0/go.mod h1:+F7Ogzej0PZc/94MaYx/nvG9jOFMD2osvC3s+Squfpo=
@@ -2115,8 +2113,8 @@ go.etcd.io/etcd/client/pkg/v3 v3.6.7 h1:vvzgyozz46q+TyeGBuFzVuI53/yd133CHceNb/Ah
 go.etcd.io/etcd/client/pkg/v3 v3.6.7/go.mod h1:2IVulJ3FZ/czIGl9T4lMF1uxzrhRahLqe+hSgy+Kh7Q=
 go.etcd.io/etcd/client/v3 v3.6.7 h1:9WqA5RpIBtdMxAy1ukXLAdtg2pAxNqW5NUoO2wQrE6U=
 go.etcd.io/etcd/client/v3 v3.6.7/go.mod h1:2XfROY56AXnUqGsvl+6k29wrwsSbEh1lAouQB1vHpeE=
-go.mongodb.org/mongo-driver v1.17.6 h1:87JUG1wZfWsr6rIz3ZmpH90rL5tea7O3IHuSwHUpsss=
-go.mongodb.org/mongo-driver v1.17.6/go.mod h1:Hy04i7O2kC4RS06ZrhPRqj/u4DTYkFDAAccj+rVKqgQ=
+go.mongodb.org/mongo-driver v1.17.9 h1:IexDdCuuNJ3BHrELgBlyaH9p60JXAvdzWR128q+U5tU=
+go.mongodb.org/mongo-driver v1.17.9/go.mod h1:LlOhpH5NUEfhxcAwG0UEkMqwYcc4JU18gtCdGudk/tQ=
 go.opencensus.io v0.21.0/go.mod h1:mSImk1erAIZhrmZN+AvHh14ztQfjbGwt4TtuofqLduU=
 go.opencensus.io v0.22.0/go.mod h1:+kGneAE2xo2IficOXnaByMWTGM9T73dGwxeWcUqIpI8=
 go.opencensus.io v0.22.2/go.mod h1:yxeiOL68Rb0Xd1ddK5vPZ/oVn4vY4Ynel7k9FzqtOIw=
@@ -2136,35 +2134,35 @@ go.opentelemetry.io/contrib/instrumentation/net/http/httptrace/otelhttptrace v0.
 go.opentelemetry.io/contrib/instrumentation/net/http/httptrace/otelhttptrace v0.56.0/go.mod h1:3qi2EEwMgB4xnKgPLqsDP3j9qxnHDZeHsnAxfjQqTko=
 go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.63.0 h1:RbKq8BG0FI8OiXhBfcRtqqHcZcka+gU3cskNuf05R18=
 go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.63.0/go.mod h1:h06DGIukJOevXaj/xrNjhi/2098RZzcLTbc0jDAUbsg=
-go.opentelemetry.io/otel v1.38.0 h1:RkfdswUDRimDg0m2Az18RKOsnI8UDzppJAtj01/Ymk8=
-go.opentelemetry.io/otel v1.38.0/go.mod h1:zcmtmQ1+YmQM9wrNsTGV/q/uyusom3P8RxwExxkZhjM=
-go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v1.37.0 h1:zG8GlgXCJQd5BU98C0hZnBbElszTmUgCNCfYneaDL0A=
-go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v1.37.0/go.mod h1:hOfBCz8kv/wuq73Mx2H2QnWokh/kHZxkh6SNF2bdKtw=
+go.opentelemetry.io/otel v1.40.0 h1:oA5YeOcpRTXq6NN7frwmwFR0Cn3RhTVZvXsP4duvCms=
+go.opentelemetry.io/otel v1.40.0/go.mod h1:IMb+uXZUKkMXdPddhwAHm6UfOwJyh4ct1ybIlV14J0g=
+go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v1.38.0 h1:vl9obrcoWVKp/lwl8tRE33853I8Xru9HFbw/skNeLs8=
+go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v1.38.0/go.mod h1:GAXRxmLJcVM3u22IjTg74zWBrRCKq8BnOqUVLodpcpw=
 go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp v1.31.0 h1:ZsXq73BERAiNuuFXYqP4MR5hBrjXfMGSO+Cx7qoOZiM=
 go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp v1.31.0/go.mod h1:hg1zaDMpyZJuUzjFxFsRYBoccE86tM9Uf4IqNMUxvrY=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.37.0 h1:Ahq7pZmv87yiyn3jeFz/LekZmPLLdKejuO3NcK9MssM=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.37.0/go.mod h1:MJTqhM0im3mRLw1i8uGHnCvUEeS7VwRyxlLC78PA18M=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.37.0 h1:EtFWSnwW9hGObjkIdmlnWSydO+Qs8OwzfzXLUPg4xOc=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.37.0/go.mod h1:QjUEoiGCPkvFZ/MjK6ZZfNOS6mfVEVKYE99dFhuN2LI=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.38.0 h1:GqRJVj7UmLjCVyVJ3ZFLdPRmhDUp2zFmQe3RHIOsw24=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.38.0/go.mod h1:ri3aaHSmCTVYu2AWv44YMauwAQc0aqI9gHKIcSbI1pU=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.38.0 h1:lwI4Dc5leUqENgGuQImwLo4WnuXFPetmPpkLi2IrX54=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.38.0/go.mod h1:Kz/oCE7z5wuyhPxsXDuaPteSWqjSBD5YaSdbxZYGbGk=
 go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.31.0 h1:lUsI2TYsQw2r1IASwoROaCnjdj2cvC2+Jbxvk6nHnWU=
 go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.31.0/go.mod h1:2HpZxxQurfGxJlJDblybejHB6RX6pmExPNe517hREw4=
 go.opentelemetry.io/otel/exporters/stdout/stdoutmetric v1.38.0 h1:wm/Q0GAAykXv83wzcKzGGqAnnfLFyFe7RslekZuv+VI=
 go.opentelemetry.io/otel/exporters/stdout/stdoutmetric v1.38.0/go.mod h1:ra3Pa40+oKjvYh+ZD3EdxFZZB0xdMfuileHAm4nNN7w=
 go.opentelemetry.io/otel/exporters/zipkin v1.36.0 h1:s0n95ya5tOG03exJ5JySOdJFtwGo4ZQ+KeY7Zro4CLI=
 go.opentelemetry.io/otel/exporters/zipkin v1.36.0/go.mod h1:m9wRxtKA2MZ1HcnNC4BKI+9aYe434qRZTCvI7QGUN7Y=
-go.opentelemetry.io/otel/metric v1.38.0 h1:Kl6lzIYGAh5M159u9NgiRkmoMKjvbsKtYRwgfrA6WpA=
-go.opentelemetry.io/otel/metric v1.38.0/go.mod h1:kB5n/QoRM8YwmUahxvI3bO34eVtQf2i4utNVLr9gEmI=
-go.opentelemetry.io/otel/sdk v1.38.0 h1:l48sr5YbNf2hpCUj/FoGhW9yDkl+Ma+LrVl8qaM5b+E=
-go.opentelemetry.io/otel/sdk v1.38.0/go.mod h1:ghmNdGlVemJI3+ZB5iDEuk4bWA3GkTpW+DOoZMYBVVg=
-go.opentelemetry.io/otel/sdk/metric v1.38.0 h1:aSH66iL0aZqo//xXzQLYozmWrXxyFkBJ6qT5wthqPoM=
-go.opentelemetry.io/otel/sdk/metric v1.38.0/go.mod h1:dg9PBnW9XdQ1Hd6ZnRz689CbtrUp0wMMs9iPcgT9EZA=
-go.opentelemetry.io/otel/trace v1.38.0 h1:Fxk5bKrDZJUH+AMyyIXGcFAPah0oRcT+LuNtJrmcNLE=
-go.opentelemetry.io/otel/trace v1.38.0/go.mod h1:j1P9ivuFsTceSWe1oY+EeW3sc+Pp42sO++GHkg4wwhs=
+go.opentelemetry.io/otel/metric v1.40.0 h1:rcZe317KPftE2rstWIBitCdVp89A2HqjkxR3c11+p9g=
+go.opentelemetry.io/otel/metric v1.40.0/go.mod h1:ib/crwQH7N3r5kfiBZQbwrTge743UDc7DTFVZrrXnqc=
+go.opentelemetry.io/otel/sdk v1.40.0 h1:KHW/jUzgo6wsPh9At46+h4upjtccTmuZCFAc9OJ71f8=
+go.opentelemetry.io/otel/sdk v1.40.0/go.mod h1:Ph7EFdYvxq72Y8Li9q8KebuYUr2KoeyHx0DRMKrYBUE=
+go.opentelemetry.io/otel/sdk/metric v1.40.0 h1:mtmdVqgQkeRxHgRv4qhyJduP3fYJRMX4AtAlbuWdCYw=
+go.opentelemetry.io/otel/sdk/metric v1.40.0/go.mod h1:4Z2bGMf0KSK3uRjlczMOeMhKU2rhUqdWNoKcYrtcBPg=
+go.opentelemetry.io/otel/trace v1.40.0 h1:WA4etStDttCSYuhwvEa8OP8I5EWu24lkOzp+ZYblVjw=
+go.opentelemetry.io/otel/trace v1.40.0/go.mod h1:zeAhriXecNGP/s2SEG3+Y8X9ujcJOTqQ5RgdEJcawiA=
 go.opentelemetry.io/proto/otlp v0.7.0/go.mod h1:PqfVotwruBrMGOCsRd/89rSnXhoiJIqeYNgFYFoEGnI=
 go.opentelemetry.io/proto/otlp v0.15.0/go.mod h1:H7XAot3MsfNsj7EXtrA2q5xSNQ10UqI405h3+duxN4U=
 go.opentelemetry.io/proto/otlp v0.19.0/go.mod h1:H7XAot3MsfNsj7EXtrA2q5xSNQ10UqI405h3+duxN4U=
-go.opentelemetry.io/proto/otlp v1.7.0 h1:jX1VolD6nHuFzOYso2E73H85i92Mv8JQYk0K9vz09os=
-go.opentelemetry.io/proto/otlp v1.7.0/go.mod h1:fSKjH6YJ7HDlwzltzyMj036AJ3ejJLCgCSHGj4efDDo=
+go.opentelemetry.io/proto/otlp v1.9.0 h1:l706jCMITVouPOqEnii2fIAuO3IVGBRPV5ICjceRb/A=
+go.opentelemetry.io/proto/otlp v1.9.0/go.mod h1:xE+Cx5E/eEHw+ISFkwPLwCZefwVjY+pqKg1qcK03+/4=
 go.uber.org/atomic v1.6.0/go.mod h1:sABNBOSYdrvTF6hTgEIbc7YasKWGhgEQZyfxyTvoXHQ=
 go.uber.org/atomic v1.7.0/go.mod h1:fEN4uk6kAWBTFdckzkM89CLk9XfWZrxpCo0nPH17wJc=
 go.uber.org/atomic v1.9.0/go.mod h1:fEN4uk6kAWBTFdckzkM89CLk9XfWZrxpCo0nPH17wJc=
@@ -2188,10 +2186,10 @@ go.yaml.in/yaml/v2 v2.4.3 h1:6gvOSjQoTB3vt1l+CU+tSyi/HOjfOjRLJ4YwYZGwRO0=
 go.yaml.in/yaml/v2 v2.4.3/go.mod h1:zSxWcmIDjOzPXpjlTTbAsKokqkDNAVtZO0WOMiT90s8=
 go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc=
 go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
-gocloud.dev v0.44.0 h1:iVyMAqFl2r6xUy7M4mfqwlN+21UpJoEtgHEcfiLMUXs=
-gocloud.dev v0.44.0/go.mod h1:ZmjROXGdC/eKZLF1N+RujDlFRx3D+4Av2thREKDMVxY=
-gocloud.dev/pubsub/natspubsub v0.44.0 h1:1Us76ckkdgtiE1p1rJZ+38b9TQP051bmjAiQlFQzYrM=
-gocloud.dev/pubsub/natspubsub v0.44.0/go.mod h1:PvVAGIhL14PWGwWIXX/zAK42ixr2/PKP4Q4yMiAUraQ=
+gocloud.dev v0.45.0 h1:WknIK8IbRdmynDvara3Q7G6wQhmEiOGwpgJufbM39sY=
+gocloud.dev v0.45.0/go.mod h1:0kXKmkCLG6d31N7NyLZWzt7jDSQura9zD/mWgiB6THI=
+gocloud.dev/pubsub/natspubsub v0.45.0 h1:kfCupVejeynIQcS1GaIvkY3Nj/acLlM5yPWyxZN8wJ8=
+gocloud.dev/pubsub/natspubsub v0.45.0/go.mod h1:WU5SMDWuF7CCr2U8UpbrEONYYFOmvigCAvTpOOpUvYE=
 gocloud.dev/pubsub/rabbitpubsub v0.44.0 h1:MpRIO6XJ/JTqrlUWt3CxwDe1LvaiXUVu4sS5cv4f/AM=
 gocloud.dev/pubsub/rabbitpubsub v0.44.0/go.mod h1:BB9+qT3r6g4M5+4asiXaEeqw4QAOzsWusO5krYaqkdA=
 golang.org/x/arch v0.20.0 h1:dx1zTU0MAE98U+TQ8BLl7XsJbgze2WnNKF/8tGp/Q6c=
@@ -2382,8 +2380,8 @@ golang.org/x/oauth2 v0.0.0-20221014153046-6fdb5e3db783/go.mod h1:h4gKUeWbJ4rQPri
 golang.org/x/oauth2 v0.4.0/go.mod h1:RznEsdpjGAINPTOF0UH/t+xJ75L18YO3Ho6Pyn+uRec=
 golang.org/x/oauth2 v0.5.0/go.mod h1:9/XBHVqLaWO3/BRHs5jbpYCnOZVjj5V0ndyaAM7KB4I=
 golang.org/x/oauth2 v0.6.0/go.mod h1:ycmewcwgD4Rpr3eZJLSB4Kyyljb3qDh40vJ8STE5HKw=
-golang.org/x/oauth2 v0.34.0 h1:hqK/t4AKgbqWkdkcAeI8XLmbK+4m4G5YeQRrmiotGlw=
-golang.org/x/oauth2 v0.34.0/go.mod h1:lzm5WQJQwKZ3nwavOZ3IS5Aulzxi68dUSgRHujetwEA=
+golang.org/x/oauth2 v0.35.0 h1:Mv2mzuHuZuY2+bkyWXIHMfhNdJAdwW3FuWeCPYN5GVQ=
+golang.org/x/oauth2 v0.35.0/go.mod h1:lzm5WQJQwKZ3nwavOZ3IS5Aulzxi68dUSgRHujetwEA=
 golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20181221193216-37e7f081c4d4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
@@ -2444,7 +2442,6 @@ golang.org/x/sys v0.0.0-20200615200032-f1bc736245b1/go.mod h1:h1NjWce9XRLGQEsW7w
 golang.org/x/sys v0.0.0-20200625212154-ddb9806d33ae/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200803210538-64077c9b5642/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200905004654-be1d3432aa8f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200923182605-d9f96fdee20d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20201201145000-ef89a241ccb3/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
@@ -2512,8 +2509,8 @@ golang.org/x/sys v0.13.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.17.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/sys v0.20.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/sys v0.28.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
-golang.org/x/sys v0.41.0 h1:Ivj+2Cp/ylzLiEU89QhWblYnOE9zerudt9Ftecq2C6k=
-golang.org/x/sys v0.41.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks=
+golang.org/x/sys v0.42.0 h1:omrd2nAlyT5ESRdCLYdm3+fMfNFE/+Rf4bDIQImRJeo=
+golang.org/x/sys v0.42.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
 golang.org/x/telemetry v0.0.0-20240228155512-f48c80bd79b2/go.mod h1:TeRTkGYfJXctD9OcfyVLyj2J3IxLnKwHJR8f4D8a3YE=
 golang.org/x/telemetry v0.0.0-20260109210033-bd525da824e2 h1:O1cMQHRfwNpDfDJerqRoE2oD+AFlyid87D40L/OkkJo=
 golang.org/x/telemetry v0.0.0-20260109210033-bd525da824e2/go.mod h1:b7fPSJ0pKZ3ccUh8gnTONJxhn3c/PS6tyzQvyqw4iA8=
@@ -2847,8 +2844,8 @@ google.golang.org/genproto v0.0.0-20230209215440-0dfe4f8abfcc/go.mod h1:RGgjbofJ
 google.golang.org/genproto v0.0.0-20230216225411-c8e22ba71e44/go.mod h1:8B0gmkoRebU8ukX6HP+4wrVQUY1+6PkQ44BSyIlflHA=
 google.golang.org/genproto v0.0.0-20230222225845-10f96fb3dbec/go.mod h1:3Dl5ZL0q0isWJt+FVcfpQyirqemEuLAK/iFvg1UP1Hw=
 google.golang.org/genproto v0.0.0-20230306155012-7f2fa6fef1f4/go.mod h1:NWraEVixdDnqcqQ30jipen1STv2r/n24Wb7twVTGR4s=
-google.golang.org/genproto v0.0.0-20250922171735-9219d122eba9 h1:LvZVVaPE0JSqL+ZWb6ErZfnEOKIqqFWUJE2D0fObSmc=
-google.golang.org/genproto v0.0.0-20250922171735-9219d122eba9/go.mod h1:QFOrLhdAe2PsTp3vQY4quuLKTi9j3XG3r6JPPaw7MSc=
+google.golang.org/genproto v0.0.0-20251124214823-79d6a2a48846 h1:dDbsTLIK7EzwUq36kCSAsk0slouq/S0tWHeeGi97cD8=
+google.golang.org/genproto v0.0.0-20251124214823-79d6a2a48846/go.mod h1:PP0g88Dz3C7hRAfbQCQggeWAXjuqGsNPLE4s7jh0RGU=
 google.golang.org/genproto/googleapis/api v0.0.0-20251124214823-79d6a2a48846 h1:ZdyUkS9po3H7G0tuh955QVyyotWvOD4W0aEapeGeUYk=
 google.golang.org/genproto/googleapis/api v0.0.0-20251124214823-79d6a2a48846/go.mod h1:Fk4kyraUvqD7i5H6S43sj2W98fbZa75lpZz/eUyhfO0=
 google.golang.org/genproto/googleapis/rpc v0.0.0-20251213004720-97cd9d5aeac2 h1:2I6GHUeJ/4shcDpoUlLs/2WPnhg7yJwvXtqcMJt9liA=

k8s/charts/seaweedfs/Chart.yaml

@@ -1,6 +1,6 @@
 apiVersion: v1
 description: SeaweedFS
 name: seaweedfs
-appVersion: "4.13"
+appVersion: "4.17"
 # Dev note: Trigger a helm chart release by `git tag -a helm-<version>`
-version: 4.0.413
+version: 4.17.0

k8s/charts/seaweedfs/openshift-values.yaml

@@ -23,8 +23,15 @@
 #
 # Adjust storageClass and sizes to match your cluster's available StorageClasses.
 # On OpenShift you can discover them with: oc get storageclass
-
+global:
+  enableReplication: true
+  #  replication type is XYZ:
+  # X number of replica in other data centers
+  # Y number of replica in other racks in the same data center
+  # Z number of replica in other servers in the same rack
+  replicationPlacement: "000" # no data replica
 master:
+  replicas: 1
   data:
     type: "persistentVolumeClaim"
     size: "10Gi"
@@ -49,6 +56,7 @@ master:
       type: RuntimeDefault
 
 volume:
+  replicas: 1
   dataDirs:
     - name: data1
       type: "persistentVolumeClaim"
@@ -75,6 +83,7 @@ volume:
       type: RuntimeDefault
 
 filer:
+  replicas: 1
   data:
     type: "persistentVolumeClaim"
     size: "25Gi"
@@ -100,12 +109,19 @@ filer:
 
 # S3 gateway (if enabled)
 s3:
+  enabled: true
+  replicas: 1
+  port: 8333
+  enableAuth: true
   podSecurityContext:
     enabled: true
     # On OpenShift, we omit runAsUser/runAsGroup/fsGroup to let the admission
     # controller assign them automatically based on the namespace's SCC.
     runAsNonRoot: true
 
+  logs:
+    type: "emptyDir"
+
   containerSecurityContext:
     enabled: true
     allowPrivilegeEscalation: false

k8s/charts/seaweedfs/templates/admin/admin-statefulset.yaml

@@ -118,8 +118,10 @@ spec:
                   fieldPath: metadata.namespace
             - name: SEAWEEDFS_FULLNAME
               value: "{{ include "seaweedfs.fullname" . }}"
-            {{- if .Values.admin.extraEnvironmentVars }}
-            {{- range $key, $value := .Values.admin.extraEnvironmentVars }}
+            {{- $mergedExtraEnvironmentVars := dict }}
+            {{- include "seaweedfs.mergeExtraEnvironmentVars" (dict "global" .Values.global "component" .Values.admin "target" $mergedExtraEnvironmentVars) }}
+            {{- range $key := keys $mergedExtraEnvironmentVars | sortAlpha }}
+            {{- $value := index $mergedExtraEnvironmentVars $key }}
             - name: {{ $key }}
             {{- if kindIs "string" $value }}
               value: {{ tpl $value $ | quote }}
@@ -128,18 +130,6 @@ spec:
                 {{ toYaml $value | nindent 16 | trim }}
             {{- end -}}
             {{- end }}
-            {{- end }}
-            {{- if .Values.global.extraEnvironmentVars }}
-            {{- range $key, $value := .Values.global.extraEnvironmentVars }}
-            - name: {{ $key }}
-            {{- if kindIs "string" $value }}
-              value: {{ tpl $value $ | quote }}
-            {{- else }}
-              valueFrom:
-                {{ toYaml $value | nindent 16 | trim }}
-            {{- end -}}
-            {{- end }}
-            {{- end }}
           command:
             - "/bin/sh"
             - "-ec"

k8s/charts/seaweedfs/templates/all-in-one/all-in-one-deployment.yaml

@@ -243,8 +243,7 @@ spec:
               {{- if $httpsPort }}
               -s3.port.https={{ $httpsPort }} \
               {{- end }}
-              -s3.cert.file=/usr/local/share/ca-certificates/client/tls.crt \
-              -s3.key.file=/usr/local/share/ca-certificates/client/tls.key \
+              {{ include "seaweedfs.s3.tlsArgs" (dict "root" . "prefix" "s3.") | nindent 14 }}
               {{- end }}
               {{- if or .Values.allInOne.s3.enableAuth .Values.s3.enableAuth .Values.filer.s3.enableAuth }}
               -s3.config=/etc/sw/s3/seaweedfs_s3_config \
@@ -346,6 +345,9 @@ spec:
             - name: client-cert
               mountPath: /usr/local/share/ca-certificates/client/
               readOnly: true
+            {{- if .Values.allInOne.s3.enabled }}
+            {{- include "seaweedfs.s3.tlsVolumeMount" . | nindent 12 }}
+            {{- end }}
             {{- end }}
             {{ tpl .Values.allInOne.extraVolumeMounts . | nindent 12 }}
           ports:
@@ -473,6 +475,9 @@ spec:
         - name: client-cert
           secret:
             secretName: {{ include "seaweedfs.fullname" . }}-client-cert
+        {{- if .Values.allInOne.s3.enabled }}
+        {{- include "seaweedfs.s3.tlsVolume" . | nindent 8 }}
+        {{- end }}
         {{- end }}
         {{ tpl .Values.allInOne.extraVolumes . | nindent 8 }}
       {{- if .Values.allInOne.nodeSelector }}

k8s/charts/seaweedfs/templates/all-in-one/all-in-one-service.yml

@@ -17,6 +17,9 @@ metadata:
 spec:
   type: {{ .Values.allInOne.service.type | default "ClusterIP" }}
   internalTrafficPolicy: {{ .Values.allInOne.service.internalTrafficPolicy | default "Cluster" }}
+  {{- if and (semverCompare ">=1.31-0" .Capabilities.KubeVersion.GitVersion) .Values.allInOne.s3.trafficDistribution }}
+  trafficDistribution: {{ include "seaweedfs.trafficDistribution" (dict "value" .Values.allInOne.s3.trafficDistribution "Capabilities" .Capabilities) }}
+  {{- end }}
   ports:
   # Master ports
   - name: "swfs-master"

k8s/charts/seaweedfs/templates/cosi/cosi-deployment.yaml

@@ -96,8 +96,10 @@ spec:
             - name: WEED_GRPC_CA
               value: /usr/local/share/ca-certificates/client/ca.crt
             {{- end }}
-            {{- if .Values.cosi.extraEnvironmentVars }}
-            {{- range $key, $value := .Values.cosi.extraEnvironmentVars }}
+            {{- $mergedExtraEnvironmentVars := dict }}
+            {{- include "seaweedfs.mergeExtraEnvironmentVars" (dict "global" .Values.global "component" .Values.cosi "target" $mergedExtraEnvironmentVars) }}
+            {{- range $key := keys $mergedExtraEnvironmentVars | sortAlpha }}
+            {{- $value := index $mergedExtraEnvironmentVars $key }}
             - name: {{ $key }}
             {{- if kindIs "string" $value }}
               value: {{ tpl $value $ | quote }}
@@ -106,18 +108,6 @@ spec:
                 {{ toYaml $value | nindent 16 | trim }}
             {{- end -}}
             {{- end }}
-            {{- end }}
-            {{- if .Values.global.extraEnvironmentVars }}
-            {{- range $key, $value := .Values.global.extraEnvironmentVars }}
-            - name: {{ $key }}
-            {{- if kindIs "string" $value }}
-              value: {{ tpl $value $ | quote }}
-            {{- else }}
-              valueFrom:
-                {{ toYaml $value | nindent 16 | trim }}
-            {{- end -}}
-            {{- end }}
-            {{- end }}
           volumeMounts:
             - mountPath: /var/lib/cosi
               name: socket

k8s/charts/seaweedfs/templates/filer/filer-statefulset.yaml

@@ -114,8 +114,10 @@ spec:
                   optional: true
             - name: SEAWEEDFS_FULLNAME
               value: "{{ include "seaweedfs.fullname" . }}"
-            {{- if .Values.filer.extraEnvironmentVars }}
-            {{- range $key, $value := .Values.filer.extraEnvironmentVars }}
+            {{- $mergedExtraEnvironmentVars := dict }}
+            {{- include "seaweedfs.mergeExtraEnvironmentVars" (dict "global" .Values.global "component" .Values.filer "target" $mergedExtraEnvironmentVars) }}
+            {{- range $key := keys $mergedExtraEnvironmentVars | sortAlpha }}
+            {{- $value := index $mergedExtraEnvironmentVars $key }}
             - name: {{ $key }}
             {{- if kindIs "string" $value }}
               value: {{ tpl $value $ | quote }}
@@ -124,18 +126,6 @@ spec:
                 {{ toYaml $value | nindent 16 | trim }}
             {{- end -}}
             {{- end }}
-            {{- end }}
-            {{- if .Values.global.extraEnvironmentVars }}
-            {{- range $key, $value := .Values.global.extraEnvironmentVars }}
-            - name: {{ $key }}
-            {{- if kindIs "string" $value }}
-              value: {{ tpl $value $ | quote }}
-            {{- else }}
-              valueFrom:
-                {{ toYaml $value | nindent 16 | trim }}
-            {{- end -}}
-            {{- end }}
-            {{- end }}
             {{- if .Values.filer.secretExtraEnvironmentVars }}
             {{- range $key, $value := .Values.filer.secretExtraEnvironmentVars }}
             - name: {{ $key }}
@@ -210,8 +200,7 @@ spec:
               {{- if .Values.filer.s3.httpsPort }}
               -s3.port.https={{ .Values.filer.s3.httpsPort }} \
               {{- end }}
-              -s3.cert.file=/usr/local/share/ca-certificates/client/tls.crt \
-              -s3.key.file=/usr/local/share/ca-certificates/client/tls.key \
+              {{ include "seaweedfs.s3.tlsArgs" (dict "root" . "prefix" "s3.") | nindent 14 }}
               {{- end }}
               {{- if .Values.filer.s3.enableAuth }}
               -s3.config=/etc/sw/seaweedfs_s3_config \
@@ -264,6 +253,9 @@ spec:
             - name: client-cert
               readOnly: true
               mountPath: /usr/local/share/ca-certificates/client
+            {{- if .Values.filer.s3.enabled }}
+            {{- include "seaweedfs.s3.tlsVolumeMount" . | nindent 12 }}
+            {{- end }}
             {{- end }}
             {{ tpl .Values.filer.extraVolumeMounts . | nindent 12 | trim }}
           ports:
@@ -394,6 +386,9 @@ spec:
         - name: client-cert
           secret:
             secretName: {{ include "seaweedfs.fullname" . }}-client-cert
+        {{- if .Values.filer.s3.enabled }}
+        {{- include "seaweedfs.s3.tlsVolume" . | nindent 8 }}
+        {{- end }}
         {{- end }}
         {{ tpl .Values.filer.extraVolumes . | indent 8 | trim }}
       {{- if .Values.filer.nodeSelector }}

k8s/charts/seaweedfs/templates/master/master-statefulset.yaml

@@ -69,9 +69,7 @@ spec:
       priorityClassName: {{ .Values.master.priorityClassName | quote }}
       {{- end }}
       enableServiceLinks: false
-      {{- if .Values.global.createClusterRole }}
       serviceAccountName: {{ .Values.master.serviceAccountName | default (include "seaweedfs.serviceAccountName" .) | quote }} # for deleting statefulset pods after migration
-      {{- end }}
       {{- if .Values.master.initContainers }}
       initContainers:
         {{ tpl .Values.master.initContainers . | nindent 8 | trim }}
@@ -98,8 +96,10 @@ spec:
                   fieldPath: metadata.namespace
             - name: SEAWEEDFS_FULLNAME
               value: "{{ include "seaweedfs.fullname" . }}"
-            {{- if .Values.master.extraEnvironmentVars }}
-            {{- range $key, $value := .Values.master.extraEnvironmentVars }}
+            {{- $mergedExtraEnvironmentVars := dict }}
+            {{- include "seaweedfs.mergeExtraEnvironmentVars" (dict "global" .Values.global "component" .Values.master "target" $mergedExtraEnvironmentVars) }}
+            {{- range $key := keys $mergedExtraEnvironmentVars | sortAlpha }}
+            {{- $value := index $mergedExtraEnvironmentVars $key }}
             - name: {{ $key }}
             {{- if kindIs "string" $value }}
               value: {{ tpl $value $ | quote }}
@@ -108,18 +108,6 @@ spec:
                 {{ toYaml $value | nindent 16 | trim }}
             {{- end -}}
             {{- end }}
-            {{- end }}
-            {{- if .Values.global.extraEnvironmentVars }}
-            {{- range $key, $value := .Values.global.extraEnvironmentVars }}
-            - name: {{ $key }}
-            {{- if kindIs "string" $value }}
-              value: {{ tpl $value $ | quote }}
-            {{- else }}
-              valueFrom:
-                {{ toYaml $value | nindent 16 | trim }}
-            {{- end -}}
-            {{- end }}
-            {{- end }}
           command:
             - "/bin/sh"
             - "-ec"

k8s/charts/seaweedfs/templates/s3/s3-deployment.yaml

@@ -90,8 +90,10 @@ spec:
                   fieldPath: metadata.namespace
             - name: SEAWEEDFS_FULLNAME
               value: "{{ include "seaweedfs.fullname" . }}"
-            {{- if .Values.s3.extraEnvironmentVars }}
-            {{- range $key, $value := .Values.s3.extraEnvironmentVars }}
+            {{- $mergedExtraEnvironmentVars := dict }}
+            {{- include "seaweedfs.mergeExtraEnvironmentVars" (dict "global" .Values.global "component" .Values.s3 "target" $mergedExtraEnvironmentVars) }}
+            {{- range $key := keys $mergedExtraEnvironmentVars | sortAlpha }}
+            {{- $value := index $mergedExtraEnvironmentVars $key }}
             - name: {{ $key }}
             {{- if kindIs "string" $value }}
               value: {{ tpl $value $ | quote }}
@@ -100,18 +102,6 @@ spec:
                 {{ toYaml $value | nindent 16 | trim }}
             {{- end -}}
             {{- end }}
-            {{- end }}
-            {{- if .Values.global.extraEnvironmentVars }}
-            {{- range $key, $value := .Values.global.extraEnvironmentVars }}
-            - name: {{ $key }}
-            {{- if kindIs "string" $value }}
-              value: {{ tpl $value $ | quote }}
-            {{- else }}
-              valueFrom:
-                {{ toYaml $value | nindent 16 | trim }}
-            {{- end -}}
-            {{- end }}
-            {{- end }}
           command:
             - "/bin/sh"
             - "-ec"
@@ -137,8 +127,7 @@ spec:
               {{- if .Values.s3.httpsPort }}
               -port.https={{ .Values.s3.httpsPort }} \
               {{- end }}
-              -cert.file=/usr/local/share/ca-certificates/client/tls.crt \
-              -key.file=/usr/local/share/ca-certificates/client/tls.key \
+              {{ include "seaweedfs.s3.tlsArgs" (dict "root" . "prefix" "") | nindent 14 }}
               {{- end }}
               {{- if .Values.s3.domainName }}
               -domainName={{ .Values.s3.domainName }} \
@@ -186,6 +175,7 @@ spec:
             - name: client-cert
               readOnly: true
               mountPath: /usr/local/share/ca-certificates/client/
+            {{- include "seaweedfs.s3.tlsVolumeMount" . | nindent 12 }}
             {{- end }}
             {{ tpl .Values.s3.extraVolumeMounts . | nindent 12 | trim }}
           ports:
@@ -277,6 +267,7 @@ spec:
         - name: client-cert
           secret:
             secretName: {{ include "seaweedfs.fullname" . }}-client-cert
+        {{- include "seaweedfs.s3.tlsVolume" . | nindent 8 }}
         {{- end }}
         {{ tpl .Values.s3.extraVolumes . | indent 8 | trim }}
       {{- if .Values.s3.nodeSelector }}

k8s/charts/seaweedfs/templates/s3/s3-service.yaml

@@ -16,8 +16,9 @@ metadata:
 {{- end }}
 spec:
   internalTrafficPolicy: {{ .Values.s3.internalTrafficPolicy | default "Cluster" }}
-  {{- if and (semverCompare ">=1.31-0" .Capabilities.KubeVersion.GitVersion) (or .Values.s3.trafficDistribution .Values.filer.s3.trafficDistribution) }}
-  trafficDistribution: {{ include "seaweedfs.trafficDistribution" . }}
+  {{- $td := .Values.s3.trafficDistribution | default .Values.filer.s3.trafficDistribution }}
+  {{- if and (semverCompare ">=1.31-0" .Capabilities.KubeVersion.GitVersion) $td }}
+  trafficDistribution: {{ include "seaweedfs.trafficDistribution" (dict "value" $td "Capabilities" .Capabilities) }}
   {{- end }}
   ports:
   - name: "swfs-s3"

k8s/charts/seaweedfs/templates/sftp/sftp-deployment.yaml

@@ -90,8 +90,10 @@ spec:
                   fieldPath: metadata.namespace
             - name: SEAWEEDFS_FULLNAME
               value: "{{ include "seaweedfs.fullname" . }}"
-            {{- if .Values.sftp.extraEnvironmentVars }}
-            {{- range $key, $value := .Values.sftp.extraEnvironmentVars }}
+            {{- $mergedExtraEnvironmentVars := dict }}
+            {{- include "seaweedfs.mergeExtraEnvironmentVars" (dict "global" .Values.global "component" .Values.sftp "target" $mergedExtraEnvironmentVars) }}
+            {{- range $key := keys $mergedExtraEnvironmentVars | sortAlpha }}
+            {{- $value := index $mergedExtraEnvironmentVars $key }}
             - name: {{ $key }}
             {{- if kindIs "string" $value }}
               value: {{ tpl $value $ | quote }}
@@ -100,18 +102,6 @@ spec:
                 {{ toYaml $value | nindent 16 | trim }}
             {{- end -}}
             {{- end }}
-            {{- end }}
-            {{- if .Values.global.extraEnvironmentVars }}
-            {{- range $key, $value := .Values.global.extraEnvironmentVars }}
-            - name: {{ $key }}
-            {{- if kindIs "string" $value }}
-              value: {{ tpl $value $ | quote }}
-            {{- else }}
-              valueFrom:
-                {{ toYaml $value | nindent 16 | trim }}
-            {{- end -}}
-            {{- end }}
-            {{- end }}
           command:
             - "/bin/sh"
             - "-ec"

k8s/charts/seaweedfs/templates/shared/_helpers.tpl

@@ -59,6 +59,18 @@ Inject extra environment vars in the format key:value, if populated
 {{- end -}}
 {{- end -}}
 
+{{- define "seaweedfs.mergeExtraEnvironmentVars" -}}
+{{- $global := ((.global | default dict).extraEnvironmentVars | default dict) -}}
+{{- $component := ((.component | default dict).extraEnvironmentVars | default dict) -}}
+{{- $target := .target -}}
+{{- range $key, $value := $global }}
+{{- $_ := set $target $key $value }}
+{{- end }}
+{{- range $key, $value := $component }}
+{{- $_ := set $target $key $value }}
+{{- end }}
+{{- end -}}
+
 {{/* Return the proper filer image */}}
 {{- define "filer.image" -}}
 {{- if .Values.filer.imageOverride -}}
@@ -326,11 +338,41 @@ Create the name of the service account to use
 {{- .Values.global.serviceAccountName | default "seaweedfs" -}}
 {{- end -}}
 
-{{/* Generate a compatible trafficDistribution value due to "PreferClose" fast deprecation in k8s v1.35 */}}
+{{/* S3 TLS cert/key arguments, using custom secret if s3.tlsSecret is set */}}
+{{- define "seaweedfs.s3.tlsArgs" -}}
+{{- $prefix := .prefix -}}
+{{- $root := .root -}}
+{{- if $root.Values.s3.tlsSecret -}}
+-{{ $prefix }}cert.file=/usr/local/share/ca-certificates/s3/tls.crt \
+-{{ $prefix }}key.file=/usr/local/share/ca-certificates/s3/tls.key \
+{{- else -}}
+-{{ $prefix }}cert.file=/usr/local/share/ca-certificates/client/tls.crt \
+-{{ $prefix }}key.file=/usr/local/share/ca-certificates/client/tls.key \
+{{- end -}}
+{{- end -}}
+
+{{/* S3 custom TLS volume mount */}}
+{{- define "seaweedfs.s3.tlsVolumeMount" -}}
+{{- if .Values.s3.tlsSecret }}
+- name: s3-tls-cert
+  readOnly: true
+  mountPath: /usr/local/share/ca-certificates/s3/
+{{- end }}
+{{- end -}}
+
+{{/* S3 custom TLS volume */}}
+{{- define "seaweedfs.s3.tlsVolume" -}}
+{{- if .Values.s3.tlsSecret }}
+- name: s3-tls-cert
+  secret:
+    secretName: {{ .Values.s3.tlsSecret }}
+{{- end }}
+{{- end -}}
+
+{{/* Generate a compatible trafficDistribution value due to "PreferClose" fast deprecation in k8s v1.35.
+     Accepts a dict with "value" (the trafficDistribution string) and "Capabilities". */}}
 {{- define "seaweedfs.trafficDistribution" -}}
-{{- if .Values.s3.trafficDistribution -}}
-{{- and (eq .Values.s3.trafficDistribution "PreferClose") (semverCompare ">=1.35-0" .Capabilities.KubeVersion.GitVersion) | ternary "PreferSameZone" .Values.s3.trafficDistribution -}}
-{{- else if .Values.filer.s3.trafficDistribution -}}
-{{- and (eq .Values.filer.s3.trafficDistribution "PreferClose") (semverCompare ">=1.35-0" .Capabilities.KubeVersion.GitVersion) | ternary "PreferSameZone" .Values.filer.s3.trafficDistribution -}}
+{{- if .value -}}
+{{- and (eq .value "PreferClose") (semverCompare ">=1.35-0" .Capabilities.KubeVersion.GitVersion) | ternary "PreferSameZone" .value -}}
 {{- end -}}
 {{- end -}}

k8s/charts/seaweedfs/templates/shared/post-install-bucket-hook.yaml

@@ -51,7 +51,7 @@ metadata:
   annotations:
     "helm.sh/hook": post-install,post-upgrade
     "helm.sh/hook-weight": "-5"
-    "helm.sh/hook-delete-policy": hook-succeeded
+    "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded
 spec:
   template:
     metadata:
@@ -92,6 +92,7 @@ spec:
           - "/bin/sh"
           - "-ec"
           - |
+            set -o pipefail
             wait_for_service() {
               local url=$1
               local max_attempts=60  # 5 minutes total (5s * 60)
@@ -117,8 +118,7 @@ spec:
             wait_for_service "http://$WEED_CLUSTER_SW_MASTER{{ .Values.master.readinessProbe.httpGet.path }}"
             wait_for_service "http://$WEED_CLUSTER_SW_FILER{{ .Values.filer.readinessProbe.httpGet.path }}"
             {{- end }}
-          set -o pipefail
-          {{- range $createBuckets }}
+            {{- range $createBuckets }}
             {{- $bucketName := .name }}
             {{- $bucketLock := or .lock .objectLock .withLock }}
             bucket_list=$(/bin/echo 's3.bucket.list' | /usr/bin/weed shell) || { echo "Error listing s3 buckets"; exit 1; }

k8s/charts/seaweedfs/templates/volume/volume-statefulset.yaml

@@ -69,9 +69,7 @@ spec:
       priorityClassName: {{ $volume.priorityClassName | quote }}
       {{- end }}
       enableServiceLinks: false
-      {{- if $.Values.global.createClusterRole }}
       serviceAccountName: {{ $volume.serviceAccountName | default (include "seaweedfs.serviceAccountName" $) | quote }} # for deleting statefulset pods after migration
-      {{- end }}
       {{- $initContainers_exists := include "volume.initContainers_exists" $ -}}
       {{- if $initContainers_exists }}
       initContainers:
@@ -118,8 +116,10 @@ spec:
                   fieldPath: status.hostIP
             - name: SEAWEEDFS_FULLNAME
               value: "{{ include "seaweedfs.fullname" $ }}"
-            {{- if $volume.extraEnvironmentVars }}
-            {{- range $key, $value := $volume.extraEnvironmentVars }}
+            {{- $mergedExtraEnvironmentVars := dict }}
+            {{- include "seaweedfs.mergeExtraEnvironmentVars" (dict "global" $.Values.global "component" $volume "target" $mergedExtraEnvironmentVars) }}
+            {{- range $key := keys $mergedExtraEnvironmentVars | sortAlpha }}
+            {{- $value := index $mergedExtraEnvironmentVars $key }}
             - name: {{ $key }}
             {{- if kindIs "string" $value }}
               value: {{ tpl $value $ | quote }}
@@ -128,18 +128,6 @@ spec:
                 {{ toYaml $value | nindent 16 | trim }}
             {{- end -}}
             {{- end }}
-            {{- end }}
-            {{- if $.Values.global.extraEnvironmentVars }}
-            {{- range $key, $value := $.Values.global.extraEnvironmentVars }}
-            - name: {{ $key }}
-            {{- if kindIs "string" $value }}
-              value: {{ tpl $value $ | quote }}
-            {{- else }}
-              valueFrom:
-                {{ toYaml $value | nindent 16 | trim }}
-            {{- end -}}
-            {{- end }}
-            {{- end }}
           command:
             - "/bin/sh"
             - "-ec"

k8s/charts/seaweedfs/templates/worker/worker-deployment.yaml

@@ -93,8 +93,10 @@ spec:
                   fieldPath: metadata.namespace
             - name: SEAWEEDFS_FULLNAME
               value: "{{ include "seaweedfs.fullname" . }}"
-            {{- if .Values.worker.extraEnvironmentVars }}
-            {{- range $key, $value := .Values.worker.extraEnvironmentVars }}
+            {{- $mergedExtraEnvironmentVars := dict }}
+            {{- include "seaweedfs.mergeExtraEnvironmentVars" (dict "global" .Values.global "component" .Values.worker "target" $mergedExtraEnvironmentVars) }}
+            {{- range $key := keys $mergedExtraEnvironmentVars | sortAlpha }}
+            {{- $value := index $mergedExtraEnvironmentVars $key }}
             - name: {{ $key }}
             {{- if kindIs "string" $value }}
               value: {{ tpl $value $ | quote }}
@@ -103,18 +105,6 @@ spec:
                 {{ toYaml $value | nindent 16 | trim }}
             {{- end -}}
             {{- end }}
-            {{- end }}
-            {{- if .Values.global.extraEnvironmentVars }}
-            {{- range $key, $value := .Values.global.extraEnvironmentVars }}
-            - name: {{ $key }}
-            {{- if kindIs "string" $value }}
-              value: {{ tpl $value $ | quote }}
-            {{- else }}
-              valueFrom:
-                {{ toYaml $value | nindent 16 | trim }}
-            {{- end -}}
-            {{- end }}
-            {{- end }}
           command:
             - "/bin/sh"
             - "-ec"

k8s/charts/seaweedfs/values.yaml

@@ -919,6 +919,13 @@ s3:
   port: 8333
   # add additional https port
   httpsPort: 0
+  # Use a custom TLS certificate secret for the S3 HTTPS endpoint.
+  # When set, this Kubernetes Secret (must contain tls.crt and tls.key) is used
+  # instead of the internal self-signed client certificate generated by cert-manager.
+  # This allows using a publicly trusted certificate (e.g., from Let's Encrypt)
+  # so that S3 clients don't need to trust the internal CA.
+  # Requires global.enableSecurity to be true.
+  tlsSecret: null
   metricsPort: 9327
   # Iceberg catalog REST port (Apache Iceberg REST Catalog API)
   # Set to a port number to enable, or 0/null to disable
@@ -1453,6 +1460,7 @@ allInOne:
     # The s3-secret.yaml template only reads from .Values.s3.credentials.
     # See: s3.credentials.admin.accessKey, s3.credentials.read.accessKey
     auditLogConfig: null  # S3 audit log configuration (null inherits from s3.auditLogConfig)
+    trafficDistribution: null  # Service traffic distribution (e.g., "PreferClose"); auto-converts to "PreferSameZone" on k8s >=1.35
     # You may specify buckets to be created during the install process.
     # Buckets may be exposed publicly by setting `anonymousRead` to `true`
     # ttl format: [1-255][m|h|d|w|M|y] (e.g., 7d)

learn/projects/sw-block/phases/phase-5-dev-log.md

@@ -1,104 +0,0 @@
-# Phase 5 Dev Log
-
-Append-only communication between agents. Newest entries at bottom.
-Each entry: `[date] [role] message`
-
-Roles: `DEV`, `REVIEWER`, `TESTER`, `ARCHITECT`
-
----
-
-[2026-03-03] [DEV] CP5-1 ALUA + multipath complete. Added ALUA provider + REPORT TPG (implicit ALUA), VPD 0x83
-NAA+TPG+RTP descriptors, TPGS=01 in INQUIRY, standby write fencing, and -tpg-id flag. Added UUID to VolumeInfo for
-shared NAA. Added multipath config and setup script. 4 multipath integration tests added. 10 ALUA unit tests added
-(SCSI tests total 53). Reviewer fixes applied: RoleNone maps to Active/Optimized to avoid single-node regression;
-REPORT TPG advertises T_SUP when state is Transitioning; TPG ID validation; non-ASCII log fix. Added 2 tests:
-alua_role_none_allows_writes and alua_report_tpg_transitioning. All unit tests pass, Linux cross-compile verified.
-
-[2026-03-03] [TESTER] CP5-1 adversarial suite: 16 tests added/validated (state boundaries, VPD 0x83, REPORT TPG,
-concurrency, INQUIRY invariants). All 16 PASS. No regressions in engine + iSCSI tests.
-
-[2026-03-03] [DEV] CP5-2 CoW snapshots completed. Fixes applied from review: DeleteSnapshot pauses flusher before
-closing delta; RestoreSnapshot checks PauseAndFlush error + defers Resume; CreateSnapshot holds snapMu across check/insert;
-Delete/Restore use beginOp/endOp; lock order documented (flushMu -> snapMu); non-ASCII punctuation removed; persistSuperblock
-now returns error and callers propagate. All tests passing (known pre-existing flaky
-rebuild_full_extent_midcopy_writes under full-suite load).
-
-[2026-03-03] [TESTER] CP5-2 QA adversarial suite: 22 tests in 5 groups (races, role rejection, edge cases, lifecycle,
-restore correctness) all PASS. Confirms fixes for delete_during_flush_cow, concurrent_create_same_id, and restore path
-nextLSN reset.
-
-[2026-03-03] [DEV] CP5-3 implementation complete. CHAP: ValidateCHAPConfig with ErrCHAPSecretEmpty and CLI guard
-requires -chap-secret when -chap-user is set. Login SecurityNeg echoes AuthMethod=CHAP on second PDU after verify; test
-assertion added. Metrics adapter docs clarify counters count attempts; /metrics inherits admin auth noted in header
-comment. All CP5-3 tests pass; only pre-existing flaky rebuild_catchup_concurrent_writes observed under full suite.
-
-[2026-03-03] [TESTER] CP5-3 QA adversarial: 28 tests added (16 CHAP + 12 resize) all PASS. No new bugs. Full
-regression clean except pre-existing flaky rebuild_catchup_concurrent_writes.
-
-[2026-03-03] [TESTER] Failover latency probe (10 iterations, m01->M02) shows bimodal iSCSI login time dominates pause.
-Promote avg 16ms (8-20ms), FirstIO avg 12ms (6-19ms), login avg 552ms with bimodal split (~130-180ms vs ~1170ms).
-Total avg 588ms, min 99ms, max/P99 1217ms. Conclusion: storage path is fast; pause is iSCSI client reconnect.
-Multipath should keep failover near ~100-200ms; otherwise tune open-iscsi/login timeout and avoid stale portals.
-
-[2026-03-03] [DEV] CP5-4 failure injection + distributed consistency tests implemented. 5 new files:
-- `test/fault_test.go` — 7 failure injection tests (F1-F7)
-- `test/fault_helpers.go` — netem, iptables, diskfill, WAL corrupt helpers
-- `test/consistency_test.go` — 17 distributed consistency tests (C1-C17)
-- `test/pgcrash_test.go` — Postgres crash loop (50 iterations, replicated failover)
-- `test/pg_helper.go` — Postgres lifecycle helper (initdb, start, stop, pgbench, mount)
-
-Port assignments: iSCSI 3280-3281, admin 8100-8101, replData 9031, replCtrl 9032 (fault/consistency);
-iSCSI 3290-3291, admin 8110-8111, replData 9041, replCtrl 9042 (pgcrash).
-
-[2026-03-03] [TESTER] CP5-4 QA on m01/M02 remote environment. Multiple issues found and fixed:
-
-**BUG-CP54-1: Lease expiry during PgCrashLoop bootstrap** — 30s lease too short for initdb+pgbench
-(which generate hundreds of fsyncs through distributed group commit). Postgres PANIC after exactly 30s.
-Fix: increased bootstrap lease to 600000ms (10min), iteration leases to 120000ms (2min).
-
-**BUG-CP54-2: SCP volume copy auth failure** — pgcrash_test.go hardcoded `id_rsa` SSH key path.
-Fix: use `clientNode.KeyFile` and `*flagSSHUser` for cross-node scp.
-
-**BUG-CP54-3: Replica volume file permission denied** — scp as root created root-owned file,
-but iscsi-target runs as testdev. Fix: added `chown` after scp.
-
-**BUG-CP54-4: C2 EpochMonotonicThreePromotions data mismatch** — dd with `oflag=direct` doesn't
-issue SYNCHRONIZE CACHE, so WAL buffer not fsync'd before kill-9. Data lost on restart.
-Fix: added `conv=fdatasync` to dd writes in C2 test.
-
-**BUG-CP54-5: PG start failure on promoted replica** — WAL shipper degrades under pgbench fdatasync
-pressure (5s barrier timeout too short for burst writes). Promoted replica has incomplete PG data.
-Fix: added `e2fsck -y` before mount in pg_helper.go; made pg start failures non-fatal with
-mkfs+initdb reinit fallback.
-
-**BUG-CP54-6: pgbench_branches relation missing after failover** — Data divergence from degraded
-replication left pgbench database with missing tables. Fix: added dropdb+recreate fallback when
-pgbench init fails.
-
-Final combined run: **25/25 ALL PASS** (994.8s total on m01/M02):
-- TestConsistency: 17/17 PASS (194.6s)
-- TestFault: 7/7 PASS (75.5s)
-- TestPgCrashLoop: PASS — 48/49 recovered, 1 reinit (723.9s)
-
-Known limitation: WAL shipper barrier timeout (5s) causes degradation under heavy fdatasync
-workloads (pgbench). Data divergence occurs on ~50% of failovers without full rebuild between
-role swaps. This is expected behavior — production deployments would use a master-driven rebuild
-after each failover.
-
-[2026-03-03] [TESTER] CP5-4 QA review identified gap: no clean failover test proving PG data
-survives with volume-copy replication. Added `CleanFailoverNoDataLoss` test to pgcrash_test.go:
-- Bootstrap 500 rows on primary (no replication — avoids WAL shipper degradation from PG background writes)
-- Copy volume to replica, set up replication, verify with lightweight dd write
-- Kill primary, promote replica, start PG on promoted replica
-- Verify: 500 rows intact, content correct (first="row-1", last="row-500"), post-failover INSERT works
-- Proves full stack: PG → ext4 → iSCSI → BlockVol → volume copy → failover → WAL recovery → ext4 → PG recovery
-
-Design note: PG cannot run under active replication without degrading the WAL shipper (background
-checkpointer/WAL writer generate continuous iSCSI writes that hit 5s barrier timeout). The test
-separates data creation (bootstrap without replication) from replication verification (dd only).
-
-Final combined run with CleanFailoverNoDataLoss: **26/26 ALL PASS** (1067.7s total on m01/M02):
-- TestConsistency: 17/17 PASS (194.7s)
-- TestFault: 7/7 PASS (75.6s)
-- TestPgCrashLoop/CleanFailoverNoDataLoss: PASS (90.3s)
-- TestPgCrashLoop/ReplicatedFailover50: PASS — 48/49 recovered, 1 reinit (706.3s)

learn/projects/sw-block/phases/phase-5-progress.md

@@ -1,80 +0,0 @@
-# Phase 5 Progress
-
-## Status
-- CP5-1 through CP5-4 complete. Phase 5 DONE.
-
-## Completed
-- CP5-1: ALUA implicit support, REPORT TARGET PORT GROUPS, VPD 0x83 descriptors, write fencing on standby.
-- CP5-1: Multipath config + setup script, 4 multipath integration tests.
-- CP5-1: Reviewer fixes (RoleNone write regression, T_SUP flag, TPG ID validation, ASCII log).
-- CP5-1: 10 ALUA unit tests + 16 adversarial tests (all PASS).
-- CP5-2: CoW snapshots implemented with flusher-based CoW, delta files, and recovery.
-- CP5-2: Review fixes applied (PauseAndFlush safety, snapMu race fix, beginOp/endOp, lock order doc, error propagation).
-- CP5-2: 10 unit tests + 22 adversarial tests (all PASS).
-- CP5-3: CHAP auth, online resize, Prometheus metrics, admin endpoints.
-- CP5-3: Review fixes applied (empty secret validation, AuthMethod echo, docs).
-- CP5-3: 12 dev tests + 28 QA adversarial tests (all PASS).
-- CP5-4: Failure injection (7 tests) + distributed consistency (17 tests) + Postgres crash loop (50 iters).
-- CP5-4: 6 bugs found and fixed (lease expiry, scp auth, permissions, fdatasync, pg reinit, pgbench tables).
-- CP5-4: 26/26 tests ALL PASS on m01/M02 remote environment (1067.7s combined).
-- CP5-4: Added CleanFailoverNoDataLoss (500 PG rows survive failover via volume copy).
-
-## In Progress
-- None.
-
-## Blockers
-- None.
-
-## Next Steps
-- Phase 5 complete. Ready for Phase 6 (NVMe-oF) or other priorities.
-
-## Notes
-- SCSI test count: 53 (12 ALUA). Integration multipath tests require multipath-tools + sg3_utils.
-- Known flaky: rebuild_full_extent_midcopy_writes under full-suite CPU contention (pre-existing).
-- Known flaky: rebuild_catchup_concurrent_writes (WAL_RECYCLED timing, pre-existing).
-- Known limitation: WAL shipper barrier timeout (5s) causes degradation under heavy fdatasync
-  workloads. PgCrashLoop shows ~50% data divergence per failover without full rebuild. Expected
-  behavior — production would use master-driven rebuild after each failover.
-- Failover latency probe (10 iters): promote+first I/O ~30ms; total pause dominated by iSCSI
-  login (avg 552ms, bimodal 130-180ms vs ~1170ms). Multipath should keep pause near 100-200ms;
-  otherwise tune open-iscsi login timeout and avoid stale portals.
-
-## CP5-4 Test Catalog
-
-### Failure Injection (`test/fault_test.go`)
-| ID | Test | What it proves |
-|----|------|----------------|
-| F1 | PowerLossDuringFio | fdatasync'd data survives kill-9 + failover |
-| F2 | DiskFullENOSPC | reads survive ENOSPC, writes recover after space freed |
-| F3 | WALCorruption | WAL recovery discards corrupted tail, early data intact |
-| F4 | ReplicaDownDuringWrites | primary keeps serving after replica crash mid-write |
-| F5 | SlowNetworkBarrierTimeout | writes continue under 200ms netem delay (remote only) |
-| F6 | NetworkPartitionSelfFence | primary self-fences on iptables partition (remote only) |
-| F7 | SnapshotDuringFailover | snapshot + replication interaction, both patterns survive |
-
-### Distributed Consistency (`test/consistency_test.go`)
-| ID | Test | What it proves |
-|----|------|----------------|
-| C1 | EpochPersistedOnPromotion | epoch survives kill-9 + restart (superblock persistence) |
-| C2 | EpochMonotonicThreePromotions | 3 failovers, epoch 1→2→3, data from all phases intact |
-| C3 | StaleEpochWALRejected | replica at epoch=2 rejects WAL entries from epoch=1 |
-| C4 | LeaseExpiredWriteRejected | writes fail after lease expiry |
-| C5 | LeaseRenewalUnderJitter | lease survives 100ms netem jitter with 30s TTL (remote) |
-| C6 | PromotionDataIntegrityChecksum | 10MB byte-for-byte match after failover |
-| C7 | PromotionPostgresRecovery | postgres recovers from crash (single-node, no repl) |
-| C8 | DeadZoneNoWrites | fencing gap verified between old/new primary |
-| C9 | RebuildWALCatchup | WAL catch-up rebuild after brief replica outage |
-| C10 | RebuildFullExtent | full extent rebuild after heavy writes |
-| C11 | RebuildDuringActiveWrites | fio uninterrupted during rebuild |
-| C12 | GracefulDemoteNoDataLoss | data intact after demote + re-promote |
-| C13 | RapidRoleFlip10x | 10 rapid epoch bumps, no crash or panic |
-| C14 | LeaseTimerRealExpiry | lease transitions true→false at ~5s mark |
-| C15 | DistGroupCommitEndToEnd | replica WAL advances during fdatasync fio |
-| C16 | DistGroupCommitReplicaCrash | primary continues in degraded mode |
-| C17 | DistGroupCommitBarrierVerify | replica LSN >= primary after fdatasync |
-
-### Postgres Crash Loop (`test/pgcrash_test.go`)
-| ID | Test | What it proves |
-|----|------|----------------|
-| PG1 | CleanFailoverNoDataLoss | 500 PG rows survive volume-copy failover, content verified |
-| PG2 | ReplicatedFailover50 | 49 kill→promote→recover→pgbench cycles, PG recovers |

learn/projects/sw-block/phases/phase-6-dev-log.md

@@ -1,202 +0,0 @@
-# Phase 6 Dev Log
-
-Append-only communication between agents. Newest entries at bottom.
-Each entry: `[date] [role] message`
-
-Roles: `DEV`, `REVIEWER`, `TESTER`, `ARCHITECT`
-
----
-
-[2026-03-03] [DEV] CP6-1 implementation complete. 7 tasks (Task 0-6) delivered:
-- Task 0: Extracted BlockVolAdapter to shared `blockvol/adapter.go` (exported fields, ALUA methods,
-  RoleToALUA/UUIDToNAA helpers). Added DisconnectVolume(iqn) to TargetServer (kills sessions + removes
-  volume). Added Session.TargetIQN() accessor. Updated standalone binary to use shared adapter. 3 adapter tests.
-- Task 1: VolumeManager -- multi-volume BlockVol + shared TargetServer lifecycle. sync.Once start guard,
-  atomic ready flag, IQN sanitization with hash suffix for collision avoidance. 10 tests.
-- Task 2: CSI Identity service (GetPluginInfo, GetPluginCapabilities, Probe). 3 tests.
-- Task 3: CSI Controller service (CreateVolume with idempotency + size mismatch, DeleteVolume). 4 tests.
-- Task 4: CSI Node service (Stage/Unstage/Publish/Unpublish) with ISCSIUtil/MountUtil interfaces. 7 tests.
-- Task 5: gRPC server + binary entry point (unix/tcp socket, signal handler, graceful shutdown).
-- Task 6: K8s manifests (DaemonSet, StorageClass, RBAC, example PVC) + smoke-test.sh.
-Total: 12 new Go files, 2 modified, 4 YAML, 1 shell script, 25+3=28 tests. CSI spec v1.10.0 added.
-
-[2026-03-03] [REVIEWER] CP6-1 review returned 5 findings:
-1. (High) CreateVolume not idempotent after restart -- only checks in-memory map, misses existing .blk files.
-2. (Medium) NodePublishVolume doesn't validate empty StagingTargetPath.
-3. (Medium) NodeStageVolume resource leak -- OpenVolume not cleaned up on discovery/login/mount failure.
-4. (Medium) Target start race -- ListenAndServe in goroutine, ready=true set before bind confirmed.
-5. (Low) IQN collision -- truncation without hash suffix causes identical IQNs for long names.
-Open Q1: How should CreateVolume handle pre-existing .blk files on disk?
-Open Q2: What happens in NodeUnstageVolume if unmount succeeds but logout fails?
-
-[2026-03-03] [DEV] All 5 review findings + 2 open questions resolved:
-- Finding 1: CreateVolume now checks os.Stat for existing .blk files, adopts via OpenBlockVol.
-  Added ErrVolumeSizeMismatch. Controller maps it to codes.AlreadyExists.
-- Finding 2: Added stagingPath=="" check in NodePublishVolume returning InvalidArgument.
-- Finding 3: Added success flag + deferred CloseVolume after OpenVolume in NodeStageVolume.
-- Finding 4: Listener created synchronously via net.Listen before ready=true. Serve in goroutine.
-- Finding 5: SanitizeIQN appends SHA256 hash suffix (8 hex chars) when truncating to 64.
-- Open Q1: Pre-existing files adopted as idempotent success if size >= requested.
-- Open Q2: NodeUnstageVolume uses best-effort cleanup (firstErr pattern), always attempts CloseVolume.
-3 new tests: CreateIdempotentAfterRestart, IQNCollision, StageLoginFailureCleanup, PublishMissingStagingPath.
-All 25 CSI tests + full regression PASS.
-
-[2026-03-03] [TESTER] CP6-1 QA adversarial suite: 30 tests in qa_csi_test.go. 26 PASS, 4 FAIL confirming 5 bugs.
-Groups: QA-VM (8), QA-CTRL (5), QA-NODE (7), QA-SRV (3), QA-ID (1), QA-IQN (5), QA-X (1).
-Bugs: BUG-QA-1 snapshot leak, BUG-QA-2/3 sync.Once restart, BUG-QA-4 LimitBytes ignored, BUG-QA-5 case divergence.
-
-[2026-03-03] [DEV] All 5 QA bugs fixed:
-- BUG-QA-1: DeleteVolume now globs+removes volPath+".snap.*" (both tracked and untracked paths).
-- BUG-QA-2+3: Replaced sync.Once+atomic.Bool with managerState enum (stopped/starting/ready/failed).
-  Start() retryable after failure or Stop(). Stop() sets state=stopped, nils target.
-  Goroutine captures target locally before launch (prevents nil deref after Stop).
-- BUG-QA-4: Controller CreateVolume validates LimitBytes. When RequiredBytes=0 and LimitBytes set,
-  uses LimitBytes as target size. Rejects RequiredBytes > LimitBytes and post-rounding overflow.
-- BUG-QA-5: sanitizeFilename now lowercases (matching SanitizeIQN). "VolA" and "vola" produce
-  same file and same IQN — treated as same volume via file adoption path.
-- QA-CTRL-4 test updated from bug-detection to behavior-documentation (NotFound is by design;
-  volumes re-tracked via CreateVolume after restart).
-All 54 CSI tests + full regression PASS (blockvol 63s, iscsi 2.3s, csi 0.4s).
-
-[2026-03-03] [DEV] CP6-2 complete. See separate CP6-2 entries in progress.md.
-
-[2026-03-04] [TESTER] CSI Testing Ladder Levels 2-4 complete on M02 (192.168.1.184):
-
-**Level 2: csi-sanity gRPC Conformance**
-- cross-compiled block-csi (linux/amd64), installed csi-sanity on M02
-- Result: 33 Passed, 0 Failed, 58 Skipped (optional RPCs), 1 Pending
-- 6 bugs found and fixed: empty VolumeCapabilities validation (3 RPCs), bind mount for NodePublish,
-  target path removal in NodeUnpublish, IsMounted check before unmount
-- All 226 unit tests updated with VolumeCapabilities/VolumeCapability in requests
-
-**Level 3: Integration Smoke**
-- Verified via csi-sanity's "should work" tests exercising real iSCSI on M02
-- 489 real SCSI commands processed (READ_10, WRITE_10, SYNC_CACHE, INQUIRY, etc.)
-- Full lifecycle: Create → Stage (discovery+login+mkfs+mount) → Publish → Unpublish → Unstage (unmount+logout) → Delete
-- Clean state: no leftover sessions, mounts, or volume files
-
-**Level 4: k3s PVC→Pod**
-- Installed k3s v1.34.4 on M02, deployed CSI DaemonSet (block-csi + csi-provisioner + registrar)
-- DaemonSet uses nsenter wrappers for host iscsiadm/mount/umount/blkid/mountpoint/mkfs.ext4
-- Test: PVC (100Mi) → Pod writes "hello sw-block" → md5 7be761488cf480c966077c7aca4ea3ed
-  → Pod deleted → PVC retained → New pod reads same data → PASS
-- 1 additional bug: IsLoggedIn didn't handle iscsiadm exit code 21 (nsenter suppresses output)
-  → Fixed by checking ExitError.ExitCode() == 21 directly
-
-Code changes from Levels 2-4:
-- controller.go: +VolumeCapabilities validation in CreateVolume, ValidateVolumeCapabilities
-- node.go: +VolumeCapability nil check, BindMount for publish, IsMounted+RemoveAll in unpublish
-- iscsi_util.go: +BindMount interface+impl (real+mock), IsLoggedIn exit code 21 handling
-- controller_test.go, node_test.go, qa_csi_test.go, qa_cp62_test.go: testVolCaps()/testVolCap() helpers
-
-[2026-03-04] [DEV] CP6-3 Review 1+2 findings fixed (12 total, 5 High, 5 Medium, 2 Low):
-- R1-1 (High): AllocateBlockVolume now returns ReplicaDataAddr/CtrlAddr/RebuildListenAddr from ReplicationPorts().
-- R1-2 (High): setupPrimaryReplication now calls vol.StartRebuildServer(rebuildAddr) with deterministic port.
-- R1-3 (High): VS sends periodic full block heartbeat (5×sleepInterval) enabling assignment confirmation.
-- R2-F1 (High): LastLeaseGrant moved to entry initializer before Register (was after → stale-lease race).
-- R1-4 (Medium): BlockService.CollectBlockVolumeHeartbeat fills ReplicaDataAddr/CtrlAddr from replStates.
-- R1-5 (Medium): UpdateFullHeartbeat refreshes LastLeaseGrant on every heartbeat.
-- R2-F2 (Medium): Deferred promotion timers stored and cancelled on VS reconnect (prevents split-brain).
-- R2-F3 (Medium): SwapPrimaryReplica uses blockvol.RoleToWire(blockvol.RolePrimary) instead of uint32(1).
-- R2-F4 (Medium): DeleteBlockVolume now deletes replica (best-effort, non-fatal).
-- R2-F5 (Medium): SwapPrimaryReplica computes epoch+1 atomically inside lock, returns newEpoch.
-- R2-F6 (Low): Removed redundant string(server) casts.
-- R2-F7 (Low): Documented rebuild feedback as future work.
-All 293 tests PASS: blockvol (24s), csi (1.6s), iscsi (2.6s), server (3.3s).
-
-[2026-03-04] [DEV] CP6-3 implementation complete. 8 tasks (Task 0-7) delivered:
-- Task 0: Proto extension — replica/rebuild address fields in master.proto, volume_server.proto,
-  generated pb.go files, wire types, converters. AssignmentsToProto batch helper. 8 tests.
-- Task 1: Assignment queue — BlockAssignmentQueue with retain-until-confirmed (F1).
-  Enqueue/Peek/Confirm/ConfirmFromHeartbeat. Stale epoch pruning. Wired into HeartbeatResponse. 11 tests.
-- Task 2: VS assignment receiver — extracts block_volume_assignments from HeartbeatResponse,
-  calls BlockService.ProcessAssignments.
-- Task 3: BlockService replication — ProcessAssignments dispatches HandleAssignment +
-  setupPrimaryReplication/setupReplicaReceiver/startRebuild. Deterministic ports via FNV hash (F3).
-  Heartbeat reports replica addresses (F5). 9 tests.
-- Task 4: Registry replica + CreateVolume — SetReplica/ClearReplica/SwapPrimaryReplica.
-  CreateBlockVolume creates primary + replica, enqueues assignments. Single-copy mode (F4). 10 tests.
-- Task 5: Failover — failoverBlockVolumes on VS disconnect. Lease-aware promotion (F2):
-  promote only after lease expires, deferred via time.AfterFunc. SwapPrimaryReplica + epoch bump.
-  11 failover tests.
-- Task 6: ControllerPublish — ControllerPublishVolume returns fresh primary address via LookupVolume.
-  ControllerUnpublishVolume no-op. PUBLISH_UNPUBLISH_VOLUME capability. NodeStageVolume prefers
-  publish_context over volume_context. 8 tests.
-- Task 7: Rebuild on recovery — recoverBlockVolumes on VS reconnect drains pendingRebuilds,
-  enqueues Rebuilding assignments. 10 tests (shared file with Task 5).
-Total: 4 new files, ~15 modified, 67 new tests. All 5 review findings (F1-F5) addressed.
-All tests PASS: blockvol (43s), csi (1.4s), iscsi (2.5s), server (3.2s).
-Cumulative Phase 6: 293 tests.
-
-[2026-03-04] [TESTER] CP6-3 QA adversarial suite: 48 tests in qa_block_cp63_test.go. 47 PASS, 1 FAIL confirming 1 bug.
-Groups: QA-Queue (8), QA-Reg (7), QA-Failover (7), QA-Create (5), QA-Rebuild (3), QA-Integration (2), QA-Edge (5), QA-Master (5), QA-VS (6).
-
-**BUG-QA-CP63-1 (Medium): `SetReplica` leaks old replica server in `byServer` index.**
-- When calling `SetReplica("vol1", "vs3", ...)` on a volume whose replica was previously `vs2`,
-  `vs2` remains in the `byServer` index. `ListByServer("vs2")` still returns `vol1`.
-- Impact: `PickServer` over-counts old replica server's volume count (wrong placement).
-  Failover could trigger on stale index entries.
-- Fix: Added `removeFromServer(oldReplicaServer, name)` before setting new replica in `SetReplica()`.
-- File: `master_block_registry.go:285` (3 lines added).
-- Test: `TestQA_Reg_SetReplicaTwice_ReplacesOld`.
-
-All 48 QA tests + full regression PASS: blockvol (23s), csi (1.1s), iscsi (2.5s), server (4.8s).
-Cumulative Phase 6: 293 + 48 = 341 tests.
-
-[2026-03-04] [TESTER] CP6-3 integration tests: 8 tests in integration_block_test.go. All 8 PASS.
-
-**Required Tests:**
-1. `TestIntegration_FailoverCSIPublish` — Create replicated vol → kill primary → verify
-   LookupBlockVolume (CSI ControllerPublishVolume path) returns promoted replica's iSCSI addr.
-2. `TestIntegration_RebuildOnRecovery` — Failover → reconnect old primary → verify Rebuilding
-   assignment enqueued with correct epoch → confirm via heartbeat.
-3. `TestIntegration_AssignmentDeliveryConfirmation` — Create replicated vol → verify pending
-   assignments → wrong epoch doesn't confirm → correct heartbeat confirms → queue cleared.
-
-**Nice-to-have Tests:**
-4. `TestIntegration_LeaseAwarePromotion` — Lease not expired → promotion deferred → after TTL → promoted.
-5. `TestIntegration_ReplicaFailureSingleCopy` — Replica alloc fails → single-copy mode → no replica
-   assignments → failover is no-op (no replica to promote).
-6. `TestIntegration_TransientDisconnectNoSplitBrain` — VS disconnects with active lease → deferred
-   timer → VS reconnects → timer cancelled → no promotion (split-brain prevented).
-
-**Extra coverage:**
-7. `TestIntegration_FullLifecycle` — Create → publish → confirm assignments → failover → re-publish
-   → confirm → recover → rebuild → confirm → delete. Full 11-phase lifecycle.
-8. `TestIntegration_DoubleFailover` — Primary dies → promoted → promoted replica also dies → original
-   server re-promoted (epoch=3).
-9. `TestIntegration_MultiVolumeFailoverRebuild` — 3 volumes across 2 servers → kill one server → all
-   primaries promoted → reconnect → rebuild assignments for each.
-
-All 349 server+QA+integration tests PASS (6.8s).
-Cumulative Phase 6: 293 + 48 + 8 = 349 tests.
-
-[2026-03-05] [TESTER] CP6-3 real integration tests on M02 (192.168.1.184): 3 tests, all PASS.
-
-**Bug found during testing: RoleNone → RoleRebuilding transition not allowed.**
-- After VS restart, volume is RoleNone. Master sends Rebuilding assignment, but both
-  `validTransitions` (role.go) and `HandleAssignment` (promotion.go) rejected this path.
-- Fix: Added `RoleRebuilding: true` to `validTransitions[RoleNone]` in role.go.
-  Added `RoleNone → RoleRebuilding` case in HandleAssignment (promotion.go) with
-  SetEpoch + SetMasterEpoch + SetRole.
-- Infrastructure: Added `action:"connect"` to admin.go `/rebuild` endpoint to start
-  rebuild client (calls `blockvol.StartRebuild` in background goroutine).
-  Added `StartRebuildClient` method to ha_target.go.
-
-**Tests (cp63_test.go, `//go:build integration`):**
-1. `FailoverCSIAddressSwitch` (3.2s) — Write data A → kill primary → promote replica
-   → client re-discovers at new iSCSI address → verify data A → write data B →
-   verify A+B. Simulates CSI ControllerPublishVolume address-switch flow.
-2. `RebuildDataConsistency` (5.3s) — Write A (replicated) → kill replica → write B
-   (missed) → restart replica as Rebuilding → start rebuild server on primary →
-   connect rebuild client → wait for role→replica → kill primary → promote rebuilt
-   replica → verify A+B intact. Full end-to-end rebuild with data verification.
-3. `FullLifecycleFailoverRebuild` (6.4s) — Write A → kill primary → promote replica
-   → write B → start rebuild server → restart old primary as Rebuilding → rebuild
-   → write C → kill new primary → promote rebuilt old-primary → verify A+B intact.
-   11-phase lifecycle simulating master's failover→recoverBlockVolumes→rebuild flow.
-
-Existing 7 HA tests: all PASS (no regression). Total real integration: 10 tests on M02.
-Code changes: role.go (+1 line), promotion.go (+7 lines), admin.go (+15 lines),
-ha_target.go (+20 lines), cp63_test.go (new, ~350 lines).
-

learn/projects/sw-block/phases/phase-6-progress.md

@@ -1,526 +0,0 @@
-# Phase 6 Progress
-
-## Status
-- CP6-1 complete. 54 CSI tests (25 dev + 30 QA - 1 removed).
-- CP6-2 complete. 172 CP6-2 tests (118 dev/review + 54 QA). 1 QA bug found and fixed.
-- **Phase 6 cumulative: 226 tests, all PASS.**
-
-## Completed
-- CP6-1 Task 0: Extracted BlockVolAdapter to shared `blockvol/adapter.go`, added DisconnectVolume to TargetServer, added Session.TargetIQN().
-- CP6-1 Task 1: VolumeManager (multi-volume BlockVol + shared TargetServer lifecycle). 10 tests.
-- CP6-1 Task 2: CSI Identity service (GetPluginInfo, GetPluginCapabilities, Probe). 3 tests.
-- CP6-1 Task 3: CSI Controller service (CreateVolume, DeleteVolume, ValidateVolumeCapabilities). 4 tests.
-- CP6-1 Task 4: CSI Node service (NodeStageVolume, NodeUnstageVolume, NodePublishVolume, NodeUnpublishVolume). 7 tests.
-- CP6-1 Task 5: gRPC server + binary entry point (`csi/cmd/block-csi/main.go`).
-- CP6-1 Task 6: K8s manifests (DaemonSet, StorageClass, RBAC, example PVC) + smoke-test.sh.
-- CP6-1 Review fixes: 5 findings + 2 open questions resolved, 3 new tests added.
-  - Finding 1: CreateVolume idempotency after restart (adopts existing .blk files on disk).
-  - Finding 2: NodePublishVolume validates empty StagingTargetPath.
-  - Finding 3: Resource leak cleanup on error paths (success flag + deferred CloseVolume).
-  - Finding 4: Synchronous listener creation (bind errors surface immediately).
-  - Finding 5: IQN collision avoidance (SHA256 hash suffix on truncation).
-
-- CP6-1 QA adversarial: 30 tests in qa_csi_test.go. 5 bugs found and fixed:
-  - BUG-QA-1 (Medium): DeleteVolume leaked .snap.* delta files. Fixed: glob+remove snapshot files.
-  - BUG-QA-2 (High): Start not retryable after failure (sync.Once). Fixed: state machine.
-  - BUG-QA-3 (High): Stop then Start broken (sync.Once already fired). Fixed: same state machine.
-  - BUG-QA-4 (Low): CreateVolume ignored LimitBytes. Fixed: validate and cap size.
-  - BUG-QA-5 (Medium): sanitizeFilename case divergence with SanitizeIQN. Fixed: lowercase both.
-  - Additional: goroutine captured m.target by reference (nil after Stop). Fixed: local capture.
-
-- CP6-2 complete. All 7 tasks done. 63 CSI tests + 48 server block tests = 111 CP6-2 tests, all PASS.
-
-## CP6-2: Control-Plane Integration
-
-### Completed Tasks
-
-- **Task 0: Proto Extension + Code Generation** — block volume messages in master.proto/volume_server.proto, Go stubs regenerated, conversion helpers + 5 tests.
-- **Task 1: Master Block Volume Registry** — in-memory registry with Pending→Active status tracking, full/delta heartbeat reconciliation, per-name inflight lock (TOCTOU prevention), placement (fewest volumes), block-capable server tracking. 11 tests.
-- **Task 2: Volume Server Block Volume gRPC** — AllocateBlockVolume/DeleteBlockVolume gRPC handlers on VolumeServer, CreateBlockVol/DeleteBlockVol on BlockService, shared naming (blockvol/naming.go). 5 tests.
-- **Task 3: Master Block Volume RPC Handlers** — CreateBlockVolume (idempotent, inflight lock, retry up to 3 servers), DeleteBlockVolume (idempotent), LookupBlockVolume. Mock VS call injection for testability. 9 tests.
-- **Task 4: Heartbeat Wiring** — block volume fields in heartbeat stream, volume server sends initial full heartbeat + deltas, master processes via UpdateFullHeartbeat/UpdateDeltaHeartbeat.
-- **Task 5: CSI Controller Refactor** — VolumeBackend interface (LocalVolumeBackend + MasterVolumeClient), controller uses backend instead of VolumeManager, returns volume_context with iscsiAddr+iqn, mode flag (controller/node/all). 5 backend tests.
-- **Task 6: CSI Node Refactor + K8s Manifests** — Node reads volume_context for remote targets, staged volume tracking with IQN derivation fallback on restart, split K8s manifests (csi-driver.yaml, csi-controller.yaml Deployment, csi-node.yaml DaemonSet). 4 new node tests (11 total).
-
-### New Files (CP6-2)
-| File | Description |
-|------|-------------|
-| `blockvol/naming.go` | Shared SanitizeIQN + SanitizeFilename |
-| `blockvol/naming_test.go` | 4 naming tests |
-| `blockvol/block_heartbeat_proto.go` | Go wire type ↔ proto conversion |
-| `blockvol/block_heartbeat_proto_test.go` | 5 conversion tests |
-| `server/master_block_registry.go` | Block volume registry + placement |
-| `server/master_block_registry_test.go` | 11 registry tests |
-| `server/volume_grpc_block.go` | VS block volume gRPC handlers |
-| `server/volume_grpc_block_test.go` | 5 VS tests |
-| `server/master_grpc_server_block.go` | Master block volume RPC handlers |
-| `server/master_grpc_server_block_test.go` | 9 master handler tests |
-| `csi/volume_backend.go` | VolumeBackend interface + clients |
-| `csi/volume_backend_test.go` | 5 backend tests |
-| `csi/deploy/csi-controller.yaml` | Controller Deployment manifest |
-| `csi/deploy/csi-node.yaml` | Node DaemonSet manifest |
-
-### Modified Files (CP6-2)
-| File | Changes |
-|------|---------|
-| `pb/master.proto` | Block volume messages, Heartbeat fields 24-27, RPCs |
-| `pb/volume_server.proto` | AllocateBlockVolume, VolumeServerDeleteBlockVolume |
-| `server/master_server.go` | BlockVolumeRegistry + VS call fields |
-| `server/master_grpc_server.go` | Block volume heartbeat processing |
-| `server/volume_grpc_client_to_master.go` | Block volume in heartbeat stream |
-| `server/volume_server_block.go` | CreateBlockVol/DeleteBlockVol on BlockService |
-| `csi/controller.go` | VolumeBackend instead of VolumeManager |
-| `csi/controller_test.go` | Updated for VolumeBackend |
-| `csi/node.go` | Remote target support + staged volume tracking |
-| `csi/node_test.go` | 4 new remote target tests |
-| `csi/server.go` | Mode flag, MasterAddr, VolumeBackend config |
-| `csi/cmd/block-csi/main.go` | --master, --mode flags |
-| `csi/deploy/csi-driver.yaml` | CSIDriver object only (split out workloads) |
-| `csi/qa_csi_test.go` | Updated for VolumeBackend |
-
-### CP6-2 Review Fixes
-All findings from both reviewers addressed. 4 new tests added (118 total CP6-2 tests).
-
-| # | Finding | Severity | Fix |
-|---|---------|----------|-----|
-| R1-F1 | DeleteBlockVol doesn't terminate active sessions | High | Use DisconnectVolume instead of RemoveVolume |
-| R1-F2 | Block registry server list never pruned | Medium | UnmarkBlockCapable on VS disconnect in SendHeartbeat defer |
-| R1-F3 | Block volume status never updates after create | Medium | Mark StatusActive immediately after successful VS allocate |
-| R1-F4 | IQN generation on startup scan doesn't sanitize | Low | Apply blockvol.SanitizeIQN(name) in scan path |
-| R1-F5/R2-F3 | CreateBlockVol idempotent path skips TargetServer | Medium | Re-add adapter to TargetServer on idempotent path |
-| R2-F1 | UpdateFullHeartbeat doesn't update SizeBytes | Low | Copy info.VolumeSize to existing.SizeBytes |
-| R2-F2 | inflightEntry.done channel is dead code | Low | Removed done channel, simplified to empty struct |
-| R2-F4 | CreateBlockVolume idempotent check doesn't validate size | Medium | Return error if existing size < requested size |
-| R2-F5 | Full + delta heartbeat can fire on same message | Low | Changed second `if` to `else if` + comment |
-| R2-F6 | NodeUnstageVolume deletes staged entry before cleanup | Medium | Delete from staged map only after successful cleanup |
-
-New tests: TestMaster_CreateIdempotentSizeMismatch, TestRegistry_UnmarkDeadServer, TestRegistry_FullHeartbeatUpdatesSizeBytes, TestNode_UnstageRetryKeepsStagedEntry.
-
-### CP6-2 QA Adversarial Tests
-54 tests across 2 files. 1 bug found and fixed.
-
-| File | Tests | Areas |
-|------|-------|-------|
-| `server/qa_block_cp62_test.go` | 22 | Registry (8), Master RPCs (8), VS BlockService (6) |
-| `csi/qa_cp62_test.go` | 32 | Node remote (6), Controller backend (5), Backend (2), Naming (2), Lifecycle (4), Server/Driver (2), VolumeManager (4), Edge cases (7) |
-
-**BUG-QA-CP62-1 (Medium): `NewCSIDriver` accepts invalid mode strings.**
-- `NewCSIDriver(DriverConfig{Mode: "invalid"})` returns nil error. Driver runs with only identity server — no controller, no node. K8s reports capabilities but all operations fail `Unimplemented`.
-- Fix: Added `switch` validation after mode defaulting. Returns `"csi: invalid mode %q, must be controller/node/all"`.
-- Test: `TestQA_ModeInvalid`.
-
-**Final CP6-2 test count: 118 dev/review + 54 QA = 172 CP6-2 tests, all PASS.**
-
-**Cumulative Phase 6 test count: 54 CP6-1 + 172 CP6-2 = 226 tests.**
-
-## CSI Testing Ladder
-
-| Level | What | Tools | Status |
-|-------|------|-------|--------|
-| 1. Unit tests | Mock iscsiadm/mount. Confirm idempotency, error handling, edge cases. | `go test` | DONE (226 tests) |
-| 2. gRPC conformance | `csi-sanity` tool validates all CSI RPCs against spec. No K8s needed. | [csi-sanity](https://github.com/kubernetes-csi/csi-test) | DONE (33 pass, 58 skip) |
-| 3. Integration smoke | Full iSCSI lifecycle with real filesystem (via csi-sanity "should work" tests). | csi-sanity + iscsiadm | DONE (489 SCSI cmds) |
-| 4. Single-node K8s (k3s) | Deploy CSI DaemonSet on k3s. PVC → Pod → write data → delete/recreate → verify persistence. | k3s v1.34.4 | DONE |
-| 5. Failure/chaos | Kill CSI controller pod; ensure no IO outage for existing volumes. Node restart with staged volumes. | chaos-mesh or manual | TODO |
-| 6. K8s E2E suite | SIG-Storage tests validate provisioning, attach/detach, resize, snapshots. | `e2e.test` binary | TODO |
-
-### Level 2: csi-sanity Conformance (M02)
-
-**Result: 33 Passed, 0 Failed, 58 Skipped, 1 Pending.**
-
-Run on M02 (192.168.1.184) with block-csi in local mode. Used helper scripts for staging/target path management.
-
-Bugs found and fixed during csi-sanity:
-| # | Bug | Severity | Fix |
-|---|-----|----------|-----|
-| BUG-SANITY-1 | CreateVolume accepted empty VolumeCapabilities | Medium | Added `len(req.VolumeCapabilities) == 0` check |
-| BUG-SANITY-2 | ValidateVolumeCapabilities accepted empty VolumeCapabilities | Medium | Same check added |
-| BUG-SANITY-3 | NodeStageVolume accepted nil VolumeCapability | Medium | Added nil check |
-| BUG-SANITY-4 | NodePublishVolume used `mount -t ext4` instead of bind mount | High | Added BindMount method to MountUtil interface |
-| BUG-SANITY-5 | NodeUnpublishVolume didn't remove target path | Medium | Added os.RemoveAll per CSI spec |
-| BUG-SANITY-6 | NodeUnpublishVolume failed on unmounted path | Medium | Added IsMounted check before unmount |
-
-All existing unit tests updated with VolumeCapabilities/VolumeCapability in test requests.
-
-### Level 3: Integration Smoke (M02)
-
-Verified through csi-sanity's full lifecycle tests which exercised real iSCSI:
-- 489 real SCSI commands processed (READ_10, WRITE_10, SYNC_CACHE, INQUIRY, etc.)
-- Full cycle: CreateVolume → NodeStageVolume (iSCSI login + mkfs.ext4 + mount) → NodePublishVolume → NodeUnpublishVolume → NodeUnstageVolume (unmount + iSCSI logout) → DeleteVolume
-- Clean state verified: no leftover iSCSI sessions, mounts, or volume files
-
-### Level 4: k3s PVC→Pod (M02)
-
-**Result: PASS — data persists across pod deletion/recreation.**
-
-k3s v1.34.4 single-node on M02. CSI deployed as DaemonSet with 3 containers:
-1. block-csi (privileged, nsenter wrappers for host iscsiadm/mount/umount/mkfs/blkid/mountpoint)
-2. csi-provisioner (v5.1.0, --node-deployment for single-node)
-3. csi-node-driver-registrar (v2.12.0)
-
-Test sequence:
-1. Created PVC (100Mi, sw-block StorageClass) → Bound
-2. Created pod → wrote "hello sw-block" to /data/test.txt → md5: `7be761488cf480c966077c7aca4ea3ed`
-3. Deleted pod (PVC retained) → iSCSI session cleanly closed
-4. Recreated pod with same PVC → read "hello sw-block" → same md5 verified
-5. Appended "persistence works!" → confirmed read-write
-
-Additional bug fixed during k3s testing:
-| # | Bug | Severity | Fix |
-|---|-----|----------|-----|
-| BUG-K3S-1 | IsLoggedIn didn't handle iscsiadm exit code 21 (nsenter suppresses output) | Medium | Added `exitErr.ExitCode() == 21` check |
-
-DaemonSet manifest: `learn/projects/sw-block/test/csi-k3s-node.yaml`
-
-- CP6-3 complete. 67 CP6-3 tests. All PASS.
-
-## CP6-3: Failover + Rebuild in Kubernetes
-
-### Completed Tasks
-
-- **Task 0: Proto Extension + Wire Type Updates** — Added replica_data_addr, replica_ctrl_addr to BlockVolumeInfoMessage/BlockVolumeAssignment; rebuild_addr to BlockVolumeAssignment; replica_server to Create/LookupBlockVolumeResponse; replica fields to AllocateBlockVolumeResponse. Updated wire types and converters. 8 tests.
-- **Task 1: Master Assignment Queue + Delivery** — BlockAssignmentQueue with Enqueue/Peek/Confirm/ConfirmFromHeartbeat. Retain-until-confirmed pattern (F1): assignments resent on every heartbeat until VS confirms via matching (path, epoch, role). Stale epoch pruning during Peek. Wired into HeartbeatResponse delivery. 11 tests.
-- **Task 2: VS Assignment Receiver Wiring** — VS extracts block_volume_assignments from HeartbeatResponse and calls BlockService.ProcessAssignments.
-- **Task 3: BlockService Replication Support** — ProcessAssignments dispatches to HandleAssignment + setupPrimaryReplication/setupReplicaReceiver/startRebuild per role. ReplicationPorts deterministic hash (F3). Heartbeat reports replica addresses (F5). 9 tests.
-- **Task 4: Registry Replica Tracking + CreateVolume** — Added SetReplica/ClearReplica/SwapPrimaryReplica to registry. CreateBlockVolume creates on 2 servers (primary + replica), enqueues assignments. Single-copy mode if only 1 server or replica fails (F4). LookupBlockVolume returns ReplicaServer. 10 tests.
-- **Task 5: Master Failover Detection** — failoverBlockVolumes on VS disconnect. Lease-aware promotion (F2): promote only after LastLeaseGrant + LeaseTTL expires. Deferred promotion via time.AfterFunc for unexpired leases. promoteReplica swaps primary/replica, bumps epoch, enqueues new primary assignment. 11 tests.
-- **Task 6: ControllerPublishVolume/UnpublishVolume** — ControllerPublishVolume calls backend.LookupVolume, returns publish_context{iscsiAddr, iqn}. ControllerUnpublishVolume is no-op. Added PUBLISH_UNPUBLISH_VOLUME capability. NodeStageVolume prefers publish_context over volume_context (reflects current primary after failover). 8 tests.
-- **Task 7: Rebuild on Recovery** — recoverBlockVolumes on VS reconnect drains pendingRebuilds, sets reconnected server as replica, enqueues Rebuilding assignments. 10 tests (shared with Task 5 test file).
-
-### Design Review Findings Addressed
-
-| # | Finding | Severity | Resolution |
-|---|---------|----------|------------|
-| F1 | Assignment delivery can be dropped | Critical | Retain-until-confirmed: Peek+Confirm pattern, assignments resent every heartbeat |
-| F2 | Failover without lease check → split-brain | Critical | Gate promotion on `now > lastLeaseGrant + leaseTTL`; deferred promotion for unexpired leases |
-| F3 | Replication ports change on VS restart | Critical | Deterministic port = FNV hash of path, offset from base iSCSI port |
-| F4 | Partial create (replica fails) | Medium | Single-copy mode with ReplicaServer="", skip replica assignments |
-| F5 | UpdateFullHeartbeat ignores replica addresses | Medium | VS includes replica_data/ctrl in InfoMessage; registry updates on heartbeat |
-
-### Code Review 1 Findings Addressed
-
-| # | Finding | Severity | Resolution |
-|---|---------|----------|------------|
-| R1-1 | AllocateBlockVolume missing repl addrs | High | AllocateBlockVolume now returns ReplicaDataAddr/CtrlAddr/RebuildListenAddr from ReplicationPorts() |
-| R1-2 | Primary never starts rebuild server | High | setupPrimaryReplication now calls vol.StartRebuildServer(rebuildAddr) |
-| R1-3 | Assignment queue never confirms after startup | High | VS sends periodic full block heartbeat (5×sleepInterval tick) enabling master confirmation |
-| R1-4 | Replica addresses not reported in heartbeat | Medium | BlockService.CollectBlockVolumeHeartbeat wraps store's collector, fills ReplicaDataAddr/CtrlAddr from replStates |
-| R1-5 | Lease never refreshed after create | Medium | UpdateFullHeartbeat refreshes LastLeaseGrant on every heartbeat; periodic block heartbeats keep it current |
-
-### Code Review 2 Findings Addressed
-
-| # | Finding | Severity | Resolution |
-|---|---------|----------|------------|
-| R2-F1 | LastLeaseGrant set AFTER Register → stale-lease race | High | Moved to entry initializer BEFORE Register |
-| R2-F2 | Deferred promotion timer has no cancellation | Medium | Timers stored in blockFailoverState.deferredTimers; cancelled in recoverBlockVolumes on reconnect |
-| R2-F3 | SwapPrimaryReplica hardcodes uint32(1) | Medium | Changed to blockvol.RoleToWire(blockvol.RolePrimary) |
-| R2-F4 | DeleteBlockVolume doesn't delete replica | Medium | Added best-effort replica delete (non-fatal if replica VS is down) |
-| R2-F5 | promoteReplica reads epoch without lock | Medium | SwapPrimaryReplica now computes epoch+1 atomically inside lock, returns newEpoch |
-| R2-F6 | Redundant string(server) casts | Low | Removed — servers already typed as string |
-| R2-F7 | startRebuild goroutine has no feedback path | Low | Documented as future work (VS could report via heartbeat) |
-
-### New Files (CP6-3)
-
-| File | Description |
-|------|-------------|
-| `server/master_block_assignment_queue.go` | Assignment queue with retain-until-confirmed |
-| `server/master_block_assignment_queue_test.go` | 11 queue tests |
-| `server/master_block_failover.go` | Failover detection + rebuild on recovery |
-| `server/master_block_failover_test.go` | 21 failover + rebuild tests |
-
-### Modified Files (CP6-3)
-
-| File | Changes |
-|------|---------|
-| `pb/master.proto` | Replica/rebuild fields on assignment/info/response messages |
-| `pb/volume_server.proto` | Replica/rebuild fields on AllocateBlockVolumeResponse |
-| `pb/master_pb/master.pb.go` | New fields + getters |
-| `pb/volume_server_pb/volume_server.pb.go` | New fields + getters |
-| `storage/blockvol/block_heartbeat.go` | ReplicaDataAddr/CtrlAddr on InfoMessage, RebuildAddr on Assignment |
-| `storage/blockvol/block_heartbeat_proto.go` | Updated converters + AssignmentsToProto |
-| `server/master_server.go` | blockAssignmentQueue, blockFailover, blockAllocResult struct |
-| `server/master_grpc_server.go` | Assignment delivery in heartbeat, failover on disconnect, recovery on reconnect |
-| `server/master_grpc_server_block.go` | Replica creation, assignment enqueueing, tryCreateReplica; R2-F1 LastLeaseGrant fix; R2-F4 replica delete; R2-F6 cast cleanup |
-| `server/master_block_registry.go` | Replica fields, lease fields, SetReplica/ClearReplica/SwapPrimaryReplica; R2-F3 RoleToWire; R2-F5 atomic epoch; R1-5 lease refresh |
-| `server/volume_grpc_client_to_master.go` | Assignment processing from HeartbeatResponse; R1-3 periodic block heartbeat tick |
-| `server/volume_grpc_block.go` | R1-1 replication ports in AllocateBlockVolumeResponse |
-| `server/volume_server_block.go` | ProcessAssignments, replication setup, ReplicationPorts; R1-2 StartRebuildServer; R1-4 CollectBlockVolumeHeartbeat with repl addrs |
-| `server/master_block_failover.go` | R2-F2 deferred timer cancellation; R2-F5 new SwapPrimaryReplica API; R2-F7 rebuild feedback comment |
-| `storage/store_blockvol.go` | WithVolume (exported) |
-| `csi/controller.go` | ControllerPublishVolume/UnpublishVolume, PUBLISH_UNPUBLISH capability |
-| `csi/node.go` | Prefer publish_context over volume_context |
-
-### CP6-3 Test Count
-
-| File | New Tests |
-|------|-----------|
-| `blockvol/block_heartbeat_proto_test.go` | 7 |
-| `server/master_block_assignment_queue_test.go` | 11 |
-| `server/volume_server_block_test.go` | 9 |
-| `server/master_block_registry_test.go` | 5 |
-| `server/master_grpc_server_block_test.go` | 6 |
-| `server/master_block_failover_test.go` | 21 |
-| `csi/controller_test.go` | 6 |
-| `csi/node_test.go` | 2 |
-| **Total CP6-3** | **67** |
-
-**Cumulative Phase 6 test count: 54 CP6-1 + 172 CP6-2 + 67 CP6-3 = 293 tests.**
-
-### CP6-3 QA Adversarial Tests
-48 tests in `server/qa_block_cp63_test.go`. 1 bug found and fixed.
-
-| Group | Tests | Areas |
-|-------|-------|-------|
-| Assignment Queue | 8 | Wrong epoch confirm, partial heartbeat confirm, same-path different roles, concurrent ops |
-| Registry | 7 | Double swap, swap no-replica, concurrent swap+lookup, SetReplica replace, heartbeat clobber |
-| Failover | 7 | Deferred cancel on reconnect, double disconnect, mixed lease states, volume deleted during timer |
-| Create+Delete | 5 | Lease non-zero after create, replica delete on vol delete, replica delete failure |
-| Rebuild | 3 | Double reconnect, nil failover state, full cycle |
-| Integration | 2 | Failover enqueues assignment, heartbeat confirms failover assignment |
-| Edge Cases | 5 | Epoch monotonic, cancel timers no rebuilds, replica server dies, empty batch |
-| Master-level | 5 | Delete VS unreachable, sanitized name, concurrent create/delete, all VS fail, slow allocate |
-| VS-level | 6 | Concurrent create, concurrent create/delete, delete cleans snapshots, sanitization collision, idempotent re-add, nil block service |
-
-**BUG-QA-CP63-1 (Medium): `SetReplica` leaks old replica server in `byServer` index.**
-- `SetReplica` didn't remove old replica server from `byServer` when replacing with a new one.
-- Fix: Added `removeFromServer(oldReplicaServer, name)` before setting new replica (3 lines).
-- Test: `TestQA_Reg_SetReplicaTwice_ReplacesOld`.
-
-**Final CP6-3 test count: 67 dev/review + 48 QA = 115 CP6-3 tests, all PASS.**
-
-### CP6-3 Integration Tests
-8 tests in `server/integration_block_test.go`. Full cross-component flows.
-
-| # | Test | What it proves |
-|---|------|----------------|
-| 1 | FailoverCSIPublish | LookupBlockVolume returns new iSCSI addr after failover |
-| 2 | RebuildOnRecovery | Rebuilding assignment enqueued + heartbeat confirms it |
-| 3 | AssignmentDeliveryConfirmation | Queue retains until heartbeat confirms matching (path, epoch) |
-| 4 | LeaseAwarePromotion | Promotion deferred until lease TTL expires |
-| 5 | ReplicaFailureSingleCopy | Single-copy mode: no replica assignments, failover is no-op |
-| 6 | TransientDisconnectNoSplitBrain | Deferred timer cancelled on reconnect, no split-brain |
-| 7 | FullLifecycle | 11-phase lifecycle: create→publish→confirm→failover→re-publish→recover→rebuild→delete |
-| 8 | DoubleFailover | Two successive failovers: epoch 1→2→3 |
-| 9 | MultiVolumeFailoverRebuild | 3 volumes, kill 1 server, rebuild all affected |
-
-**Final CP6-3 test count: 67 dev/review + 48 QA + 8 mock integration + 3 real integration = 126 CP6-3 tests, all PASS.**
-
-**Cumulative Phase 6 with QA: 54 CP6-1 + 172 CP6-2 + 126 CP6-3 = 352 tests.**
-
-### CP6-3 Real Integration Tests (M02)
-3 tests in `blockvol/test/cp63_test.go`, run on M02 (192.168.1.184) with real iSCSI.
-
-**Bug found: RoleNone → RoleRebuilding transition not allowed.**
-After VS restart, volume is RoleNone. Master sends Rebuilding assignment, but both
-`validTransitions` (role.go) and `HandleAssignment` (promotion.go) rejected this path.
-- Fix: Added `RoleRebuilding: true` to `validTransitions[RoleNone]` in role.go.
-  Added `RoleNone → RoleRebuilding` case in HandleAssignment with SetEpoch + SetRole.
-- Admin API: Added `action:"connect"` to `/rebuild` endpoint (starts rebuild client).
-
-| # | Test | Time | What it proves |
-|---|------|------|----------------|
-| 1 | FailoverCSIAddressSwitch | 3.2s | Write A → kill primary → promote replica → re-discover at new iSCSI address → verify A → write B → verify A+B. Simulates CSI ControllerPublishVolume address-switch. |
-| 2 | RebuildDataConsistency | 5.3s | Write A (replicated) → kill replica → write B (missed) → restart replica as Rebuilding → rebuild server + client → wait role→Replica → kill primary → promote rebuilt → verify A+B. Full end-to-end rebuild with data verification. |
-| 3 | FullLifecycleFailoverRebuild | 6.4s | Write A → kill primary → promote → write B → rebuild old primary → write C → kill new primary → promote old → verify A+B. 11-phase lifecycle: failover→recoverBlockVolumes→rebuild. |
-
-All 7 existing HA tests: PASS (no regression). Total real integration: 10 tests on M02.
-
-## In Progress
-- None.
-
-## Blockers
-- None.
-
-## Next Steps
-- CP6-4: Soak testing, lease renewal timers, monitoring dashboards.
-
-## Notes
-- CSI spec dependency: `github.com/container-storage-interface/spec v1.10.0`.
-- Architecture: CSI binary embeds TargetServer + BlockVol in-process (loopback iSCSI).
-- Interface-based ISCSIUtil/MountUtil for unit testing without real iscsiadm/mount.
-- k3s deployment requires: hostNetwork, hostPID, privileged, /dev mount, nsenter wrappers for host commands.
-- Known pre-existing flaky: `TestQAPhase4ACP1/role_concurrent_transitions` (unrelated to CSI).
-
-## CP6-1 Test Catalog
-
-### VolumeManager (`csi/volume_manager_test.go`) — 10 tests
-| # | Test | What it proves |
-|---|------|----------------|
-| 1 | CreateOpenClose | Create, verify IQN, close, reopen lifecycle |
-| 2 | DeleteRemovesFile | .blk file removed on delete |
-| 3 | DuplicateCreate | Same size idempotent; different size returns ErrVolumeSizeMismatch |
-| 4 | ListenAddr | Non-empty listen address after start |
-| 5 | OpenNonExistent | Error on opening non-existent volume |
-| 6 | CloseAlreadyClosed | Idempotent close of non-tracked volume |
-| 7 | ConcurrentCreateDelete | 10 parallel create+delete, no races |
-| 8 | SanitizeIQN | Special char replacement, truncation to 64 chars |
-| 9 | CreateIdempotentAfterRestart | Existing .blk file adopted on restart |
-| 10 | IQNCollision | Long names with same prefix get distinct IQNs via hash suffix |
-
-### Identity (`csi/identity_test.go`) — 3 tests
-| # | Test | What it proves |
-|---|------|----------------|
-| 1 | GetPluginInfo | Returns correct driver name + version |
-| 2 | GetPluginCapabilities | Returns CONTROLLER_SERVICE capability |
-| 3 | Probe | Returns ready=true |
-
-### Controller (`csi/controller_test.go`) — 4 tests
-| # | Test | What it proves |
-|---|------|----------------|
-| 1 | CreateVolume | Volume created and tracked |
-| 2 | CreateIdempotent | Same name+size succeeds, different size returns AlreadyExists |
-| 3 | DeleteVolume | Volume removed after delete |
-| 4 | DeleteNotFound | Delete non-existent returns success (CSI spec) |
-
-### Node (`csi/node_test.go`) — 7 tests
-| # | Test | What it proves |
-|---|------|----------------|
-| 1 | StageUnstage | Full stage flow (discovery+login+mount) and unstage (unmount+logout+close) |
-| 2 | PublishUnpublish | Bind mount from staging to target path |
-| 3 | StageIdempotent | Already-mounted staging path returns OK without side effects |
-| 4 | StageLoginFailure | iSCSI login error propagated as Internal |
-| 5 | StageMkfsFailure | mkfs error propagated as Internal |
-| 6 | StageLoginFailureCleanup | Volume closed after login failure (no resource leak) |
-| 7 | PublishMissingStagingPath | Empty StagingTargetPath returns InvalidArgument |
-
-### Adapter (`blockvol/adapter_test.go`) — 3 tests
-| # | Test | What it proves |
-|---|------|----------------|
-| 1 | AdapterALUAProvider | ALUAState/TPGroupID/DeviceNAA correct values |
-| 2 | RoleToALUA | All role→ALUA state mappings |
-| 3 | UUIDToNAA | NAA-6 byte layout from UUID |
-
-## CP6-2 Test Catalog
-
-### Registry (`server/master_block_registry_test.go`) — 11 tests
-| # | Test | What it proves |
-|---|------|----------------|
-| 1 | RegisterLookup | Register + Lookup returns entry |
-| 2 | DuplicateRegister | Second register same name errors |
-| 3 | Unregister | Unregister removes entry |
-| 4 | ListByServer | Returns only entries for given server |
-| 5 | FullHeartbeat | Marks active, removes stale, adds new |
-| 6 | DeltaHeartbeat | Add/remove deltas applied correctly |
-| 7 | PickServer | Fewest-volumes placement |
-| 8 | Inflight | AcquireInflight blocks duplicate, ReleaseInflight unblocks |
-| 9 | BlockCapable | MarkBlockCapable / UnmarkBlockCapable tracking |
-| 10 | UnmarkDeadServer | R1-F2 regression test |
-| 11 | FullHeartbeatUpdatesSizeBytes | R2-F1 regression test |
-
-### Master RPCs (`server/master_grpc_server_block_test.go`) — 9 tests
-| # | Test | What it proves |
-|---|------|----------------|
-| 1 | CreateHappyPath | Create → register → lookup works |
-| 2 | CreateIdempotent | Same name+size returns same entry |
-| 3 | CreateIdempotentSizeMismatch | Same name, smaller size → error |
-| 4 | CreateInflightBlock | Concurrent create same name → one fails |
-| 5 | Delete | Delete → VS called → unregistered |
-| 6 | DeleteNotFound | Delete non-existent → success |
-| 7 | Lookup | Lookup returns entry |
-| 8 | LookupNotFound | Lookup non-existent → NotFound |
-| 9 | CreateRetryNextServer | First VS fails → retries on next |
-
-### VS Block gRPC (`server/volume_grpc_block_test.go`) — 5 tests
-| # | Test | What it proves |
-|---|------|----------------|
-| 1 | Allocate | Create via gRPC returns path+iqn+addr |
-| 2 | AllocateEmptyName | Empty name → error |
-| 3 | AllocateZeroSize | Zero size → error |
-| 4 | Delete | Delete via gRPC succeeds |
-| 5 | DeleteNilService | Nil blockService → error |
-
-### Naming (`blockvol/naming_test.go`) — 4 tests
-| # | Test | What it proves |
-|---|------|----------------|
-| 1 | SanitizeFilename | Lowercases, replaces invalid chars |
-| 2 | SanitizeIQN | Lowercases, replaces, truncates with hash |
-| 3 | IQNMaxLength | 64-char names pass through unchanged |
-| 4 | IQNHashDeterministic | Same input → same hash suffix |
-
-### Proto conversion (`blockvol/block_heartbeat_proto_test.go`) — 5 tests
-| # | Test | What it proves |
-|---|------|----------------|
-| 1 | RoundTrip | Go→proto→Go preserves all fields |
-| 2 | NilSafe | Nil input → nil output |
-| 3 | ShortRoundTrip | Short info round-trip |
-| 4 | AssignmentRoundTrip | Assignment round-trip |
-| 5 | SliceHelpers | Slice conversion helpers |
-
-### Backend (`csi/volume_backend_test.go`) — 5 tests
-| # | Test | What it proves |
-|---|------|----------------|
-| 1 | LocalCreate | LocalVolumeBackend.CreateVolume creates + returns info |
-| 2 | LocalDelete | LocalVolumeBackend.DeleteVolume removes volume |
-| 3 | LocalLookup | LocalVolumeBackend.LookupVolume returns info |
-| 4 | LocalLookupNotFound | Lookup non-existent returns not-found |
-| 5 | LocalDeleteNotFound | Delete non-existent returns success |
-
-### Node remote (`csi/node_test.go` additions) — 4 tests
-| # | Test | What it proves |
-|---|------|----------------|
-| 1 | StageRemoteTarget | volume_context drives iSCSI instead of local mgr |
-| 2 | UnstageRemoteTarget | Staged map IQN used for logout |
-| 3 | UnstageAfterRestart | IQN derived from iqnPrefix when staged map empty |
-| 4 | UnstageRetryKeepsStagedEntry | R2-F6 regression: staged entry preserved on failure |
-
-### QA Server (`server/qa_block_cp62_test.go`) — 22 tests
-| # | Test | What it proves |
-|---|------|----------------|
-| 1 | Reg_FullHeartbeatCrossTalk | Heartbeat from s2 doesn't remove s1 volumes |
-| 2 | Reg_FullHeartbeatEmptyServer | Empty heartbeat marks server block-capable |
-| 3 | Reg_ConcurrentHeartbeatAndRegister | 10 goroutines heartbeat+register, no races |
-| 4 | Reg_DeltaHeartbeatUnknownPath | Delta for unknown path is no-op |
-| 5 | Reg_PickServerTiebreaker | PickServer returns first server on tie |
-| 6 | Reg_ReregisterDifferentServer | Re-register same name on different server fails |
-| 7 | Reg_InflightIndependence | Inflight lock for vol-a doesn't block vol-b |
-| 8 | Reg_BlockCapableServersAfterUnmark | Unmark removes from block-capable list |
-| 9 | Master_DeleteVSUnreachable | Delete fails if VS delete fails (no orphan) |
-| 10 | Master_CreateSanitizedName | Names with special chars go through |
-| 11 | Master_ConcurrentCreateDelete | Concurrent create+delete on same name, no panic |
-| 12 | Master_AllVSFailNoOrphan | All 3 servers fail → error, no registry entry |
-| 13 | Master_SlowAllocateBlocksSecond | Inflight lock blocks concurrent same-name create |
-| 14 | Master_CreateZeroSize | Zero size → InvalidArgument |
-| 15 | Master_CreateEmptyName | Empty name → InvalidArgument |
-| 16 | Master_EmptyNameValidation | Whitespace-only name → InvalidArgument |
-| 17 | VS_ConcurrentCreate | 20 goroutines create same vol, no crash |
-| 18 | VS_ConcurrentCreateDelete | 20 goroutines create+delete interleaved |
-| 19 | VS_DeleteCleansSnapshots | Delete removes .snap.* files |
-| 20 | VS_SanitizationCollision | Idempotent create after sanitization matches |
-| 21 | VS_CreateIdempotentReaddTarget | Idempotent create re-adds adapter to TargetServer |
-| 22 | VS_GrpcNilBlockService | Nil blockService returns error (not panic) |
-
-### QA CSI (`csi/qa_cp62_test.go`) — 32 tests
-| # | Test | What it proves |
-|---|------|----------------|
-| 1 | Node_RemoteUnstageNoCloseVolume | Remote unstage doesn't call CloseVolume |
-| 2 | Node_RemoteUnstageFailPreservesStaged | Failed unstage preserves staged entry |
-| 3 | Node_ConcurrentStageUnstage | 20 concurrent stage+unstage, no races |
-| 4 | Node_RemotePortalUsedCorrectly | Remote portal used for discovery (not local) |
-| 5 | Node_PartialVolumeContext | Missing iqn falls back to local mgr |
-| 6 | Node_UnstageNoMgrNoPrefix | No mgr + no prefix → empty IQN (graceful) |
-| 7 | Ctrl_VolumeContextPresent | CreateVolume returns iscsiAddr+iqn in context |
-| 8 | Ctrl_ValidateUsesBackend | ValidateVolumeCapabilities uses backend lookup |
-| 9 | Ctrl_CreateLargerSizeRejected | Existing vol + larger size → AlreadyExists |
-| 10 | Ctrl_ExactBlockSizeBoundary | Exact 4MB boundary succeeds |
-| 11 | Ctrl_ConcurrentCreate | 10 concurrent creates, one succeeds |
-| 12 | Backend_LookupAfterRestart | Volume found after VolumeManager restart |
-| 13 | Backend_DeleteThenLookup | Lookup after delete → not found |
-| 14 | Naming_CrossLayerConsistency | CSI and blockvol SanitizeIQN produce same result |
-| 15 | Naming_LongNameHashCollision | Two 70-char names → distinct IQNs |
-| 16 | RemoteLifecycleFull | Full remote stage→publish→unpublish→unstage→delete |
-| 17 | ModeControllerNoMgr | Controller mode with masterAddr, no local mgr |
-| 18 | ModeNodeOnly | Node mode creates mgr but no controller |
-| 19 | ModeInvalid | Invalid mode → error (BUG-QA-CP62-1) |
-| 20 | Srv_AllModeLocalBackend | All mode without master uses local backend |
-| 21 | Srv_DoubleStop | Double Stop doesn't panic |
-| 22 | VM_CreateAfterStop | Create after stop returns error |
-| 23 | VM_OpenNonExistent | Open non-existent returns error |
-| 24 | VM_ListenAddrAfterStop | ListenAddr after stop returns empty |
-| 25 | VM_VolumeIQNSanitized | VolumeIQN applies sanitization |
-| 26 | Edge_MinSize | Minimum 4MB volume succeeds |
-| 27 | Edge_BelowMinSize | Below minimum → error |
-| 28 | Edge_RequiredEqualsLimit | Required == limit succeeds |
-| 29 | Edge_RoundingExceedsLimit | Rounding up exceeds limit → error |
-| 30 | Edge_EmptyVolumeIDNode | Empty volumeID → InvalidArgument |
-| 31 | Node_PublishWithoutStaging | Publish unstaged vol → still works (mock) |
-| 32 | Node_DoubleUnstage | Double unstage → idempotent success |

other/java/client/src/main/proto/filer.proto

@@ -100,10 +100,12 @@ message ListEntriesRequest {
     string startFromFileName = 3;
     bool inclusiveStartFrom = 4;
     uint32 limit = 5;
+    int64 snapshot_ts_ns = 6;
 }
 
 message ListEntriesResponse {
     Entry entry = 1;
+    int64 snapshot_ts_ns = 2;
 }
 
 message RemoteEntry {
@@ -203,6 +205,7 @@ message CreateEntryRequest {
 
 message CreateEntryResponse {
     string error = 1;
+    SubscribeMetadataResponse metadata_event = 2;
 }
 
 message UpdateEntryRequest {
@@ -212,6 +215,7 @@ message UpdateEntryRequest {
     repeated int32 signatures = 4;
 }
 message UpdateEntryResponse {
+    SubscribeMetadataResponse metadata_event = 1;
 }
 
 message AppendToEntryRequest {
@@ -236,6 +240,7 @@ message DeleteEntryRequest {
 
 message DeleteEntryResponse {
     string error = 1;
+    SubscribeMetadataResponse metadata_event = 2;
 }
 
 message AtomicRenameEntryRequest {
@@ -469,6 +474,7 @@ message CacheRemoteObjectToLocalClusterRequest {
 }
 message CacheRemoteObjectToLocalClusterResponse {
     Entry entry = 1;
+    SubscribeMetadataResponse metadata_event = 2;
 }
 
 /////////////////////////

seaweedfs-rdma-sidecar/Dockerfile.sidecar

@@ -1,5 +1,5 @@
 # Multi-stage build for Go Sidecar
-FROM golang:1.24-alpine AS builder
+FROM golang:1.25-alpine AS builder
 
 # Install build dependencies
 RUN apk add --no-cache git ca-certificates tzdata

seaweedfs-rdma-sidecar/Dockerfile.test-client

@@ -1,5 +1,5 @@
 # Multi-stage build for Test Client
-FROM golang:1.23-alpine AS builder
+FROM golang:1.25-alpine AS builder
 
 # Install build dependencies
 RUN apk add --no-cache git ca-certificates tzdata

sw-block/.gocache_v2/README

@@ -1,4 +0,0 @@
-This directory holds cached build artifacts from the Go build system.
-Run "go clean -cache" if the directory is getting too large.
-Run "go clean -fuzzcache" to delete the fuzz cache.
-See go.dev to learn more about Go.

sw-block/.gocache_v2/trim.txt

@@ -1 +0,0 @@
-1774577367

sw-block/.private/README.md

@@ -1,27 +0,0 @@
-# .private
-
-Private working area for `sw-block`.
-
-Use this for:
-- phase development notes
-- roadmap/progress tracking
-- draft handoff notes
-- temporary design comparisons
-- prototype scratch work not ready for `design/` or `prototype/`
-
-Recommended layout:
-- `.private/phase/`: phase-by-phase development notes
-- `.private/roadmap/`: short-term and medium-term execution notes
-- `.private/handoff/`: notes for `sw`, `qa`, or future sessions
-
-Phase protocol:
-- each phase should normally have:
-  - `phase-xx.md`
-  - `phase-xx-log.md`
-  - `phase-xx-decisions.md`
-- details are defined in `.private/phase/README.md`
-
-Promotion rules:
-- stable vision/design docs go to `../design/`
-- real prototype code stays in `../prototype/`
-- `.private/` is for working material, not source of truth

sw-block/.private/phase/README.md

@@ -1,36 +0,0 @@
-# Phase Dev
-
-Use this directory for private phase development notes.
-
-## Phase Protocol
-
-Each phase should use this file set:
-
-- `phase-01.md`
-  - plan
-  - scope
-  - progress
-  - active tasks
-  - exit criteria
-- `phase-01-log.md`
-  - dated development log
-  - experiments
-  - test runs
-  - failures and findings
-- `phase-01-decisions.md`
-  - key algorithm decisions
-  - tradeoffs
-  - rejected alternatives
-
-Suggested naming pattern:
-- `phase-01.md`
-- `phase-01-log.md`
-- `phase-01-decisions.md`
-- `phase-02.md`
-- `phase-02-log.md`
-- `phase-02-decisions.md`
-
-Rule of use:
-1. if it is what we are doing -> `phase-xx.md`
-2. if it is what happened -> `phase-xx-log.md`
-3. if it is why we chose something -> `phase-xx-decisions.md`

sw-block/.private/phase/phase-01-decisions.md

@@ -1,97 +0,0 @@
-# Phase 01 Decisions
-
-Date: 2026-03-26
-Status: active
-
-## Purpose
-
-Capture the key design decisions made during Phase 01 simulator work.
-
-## Initial Decisions
-
-### 1. `design/` vs `.private/phase/`
-
-Decision:
-- `sw-block/design/` holds shared design truth
-- `sw-block/.private/phase/` holds execution planning and progress
-
-Reason:
-- design backlog and execution checklist should not be mixed
-
-### 2. Scenario source of truth
-
-Decision:
-- `sw-block/design/v2_scenarios.md` is the scenario backlog and coverage matrix
-
-Reason:
-- all contributors need one visible scenario list
-
-### 3. Phase 01 priority
-
-Decision:
-- first close:
-  - `S19`
-  - `S20`
-
-Reason:
-- they are the biggest remaining distributed lineage/partition scenarios
-
-### 4. Current simulator scope
-
-Decision:
-- use the simulator as a V2 design-validation tool, not a product/perf harness
-
-Reason:
-- current goal is correctness and protocol coverage, not productization
-
-### 5. Phase execution format
-
-Decision:
-- keep phase execution in three files:
-  - `phase-xx.md`
-  - `phase-xx-log.md`
-  - `phase-xx-decisions.md`
-
-Reason:
-- separates plan, evidence, and reasoning
-- reduces drift between roadmap and findings
-
-### 6. Design backlog vs execution plan
-
-Decision:
-- `sw-block/design/v2_scenarios.md` remains the source of truth for scenario backlog and coverage
-- `.private/phase/phase-01.md` is the execution layer for `sw`
-
-Reason:
-- design truth should be stable and shareable
-- execution tasks should be easier to edit without polluting design docs
-
-### 7. Immediate Phase 01 priorities
-
-Decision:
-- prioritize:
-  - `S19` chain of custody across multiple promotions
-  - `S20` live partition with competing writes
-
-Reason:
-- these are the biggest remaining distributed-lineage gaps after current simulator milestone
-
-### 8. Coverage status should be conservative
-
-Decision:
-- mark scenarios as `partial` unless the test actually exercises the core protocol obligation, not just a simplified happy path
-
-Reason:
-- avoids overstating simulator coverage
-- keeps the backlog honest for follow-up strengthening
-
-### 9. Protocol-version comparison belongs in the simulator
-
-Decision:
-- compare `V1`, `V1.5`, and `V2` using the same scenario set where possible
-
-Reason:
-- this is the clearest way to show:
-  - where V1 breaks
-  - where V1.5 improves but still strains
-  - why V2 is architecturally cleaner

sw-block/.private/phase/phase-01-log.md

@@ -1,67 +0,0 @@
-# Phase 01 Log
-
-Date: 2026-03-26
-Status: active
-
-## Log Protocol
-
-Use dated entries like:
-
-## 2026-03-26
-- work completed
-- tests run
-- failures found
-- seeds/traces worth keeping
-- follow-up items
-
-## Initial State
-
-- Phase 01 created from the earlier `phase-01-v2-scenarios.md` working note
-- scenario source of truth remains:
-  - `sw-block/design/v2_scenarios.md`
-- current active asks for `sw`:
-  - `S19`
-  - `S20`
-
-## 2026-03-26
-
-- created Phase 01 file set:
-  - `phase-01.md`
-  - `phase-01-log.md`
-  - `phase-01-decisions.md`
-- promoted scenario execution checklist into `phase-01.md`
-- kept `sw-block/design/v2_scenarios.md` as the shared backlog and coverage matrix
-- current simulator milestone:
-  - `fsmv2` passing
-  - `volumefsm` passing
-  - `distsim` passing
-  - randomized `distsim` seeds passing
-  - event/interleaving simulator work present in `sw-block/prototype/distsim/simulator.go`
-- current immediate development priority for `sw`:
-  - implement `S19`
-  - implement `S20`
-- `sw` added Phase 01 P0/P1 scenario tests in `distsim`:
-  - `S19`
-  - `S20`
-  - `S5`
-  - `S6`
-  - `S18`
-  - stronger `S12`
-- review result:
-  - `S19` looks solid
-  - stronger `S12` now looks solid
-  - `S20`, `S5`, `S6`, `S18` are better classified as `partial` than fully closed
-- updated `v2_scenarios.md` coverage matrix to reflect actual status
-- next development focus:
-  - P2 scenarios
-  - stronger versions of current partial scenarios
-- added protocol-version comparison design:
-  - `sw-block/design/protocol-version-simulation.md`
-- added minimal protocol policy prototype in `distsim`:
-  - `ProtocolV1`
-  - `ProtocolV15`
-  - `ProtocolV2`
-  - focused on:
-    - catch-up policy
-    - tail-chasing outcome policy
-    - restart/rejoin policy

sw-block/.private/phase/phase-01-v2-scenarios.md

@@ -1,11 +0,0 @@
-# Deprecated
-
-This file is deprecated.
-
-Use instead:
-- `phase-01.md`
-- `phase-01-log.md`
-- `phase-01-decisions.md`
-
-The scenario source of truth remains:
-- `sw-block/design/v2_scenarios.md`

sw-block/.private/phase/phase-01.md

@@ -1,164 +0,0 @@
-# Phase 01
-
-Date: 2026-03-26
-Status: completed
-Purpose: drive V2 simulator development by closing the scenario backlog in `sw-block/design/v2_scenarios.md`
-
-## Goal
-
-Make the V2 simulator cover the important protocol scenarios as explicitly as possible.
-
-This phase is about:
-- simulator fidelity
-- scenario coverage
-- invariant quality
-
-This phase is not about:
-- product integration
-- SPDK
-- raw allocator
-- production transport
-
-## Source Of Truth
-
-Design/source-of-truth:
-- `sw-block/design/v2_scenarios.md`
-
-Prototype code:
-- `sw-block/prototype/fsmv2/`
-- `sw-block/prototype/volumefsm/`
-- `sw-block/prototype/distsim/`
-
-## Assigned Tasks For `sw`
-
-### P0
-
-1. `S19` chain of custody across multiple promotions
-- add fixed test(s)
-- verify committed data from `A -> B -> C`
-- update coverage matrix
-
-2. `S20` live partition with competing writes
-- add fixed test(s)
-- stale side must not advance committed lineage
-- update coverage matrix
-
-### P1
-
-3. `S5` flapping replica stays recoverable
-- repeated disconnect/reconnect
-- no unnecessary rebuild while recovery remains possible
-
-4. `S6` tail-chasing under load
-- primary keeps writing while replica catches up
-- explicit outcome:
-  - converge and promote
-  - or abort to rebuild
-
-5. `S18` primary restart without failover
-- same-lineage restart behavior
-- no stale session assumptions
-
-6. stronger `S12`
-- more than one promotion candidate
-- choose valid lineage, not merely highest apparent LSN
-
-### P2
-
-7. protocol-version comparison support
-- model:
-  - `V1`
-  - `V1.5`
-  - `V2`
-- use the same scenario set to show:
-  - V1 breaks
-  - V1.5 improves but still strains
-  - V2 handles recovery more explicitly
-
-8. richer Smart WAL scenarios
-- time-varying `ExtentReferenced` availability
-- recoverable then unrecoverable transitions
-
-9. delayed/drop network scenarios beyond simple disconnect
-
-10. multi-node reservation expiry / rebuild timeout cases
-
-## Invariants To Preserve
-
-After every scenario or random run, preserve:
-
-1. committed data is durable per policy
-2. uncommitted data is not revived as committed
-3. stale epoch traffic does not mutate current lineage
-4. recovered/promoted node matches reference state at target `LSN`
-5. committed prefix remains contiguous
-
-## Required Updates Per Task
-
-For each completed scenario:
-
-1. add or update test(s)
-2. update `sw-block/design/v2_scenarios.md`
-   - package
-   - test name
-   - status
-3. note any missing simulator capability
-
-## Current Progress
-
-Already in place before this phase:
-- `fsmv2` local FSM prototype
-- `volumefsm` orchestrator prototype
-- `distsim` distributed simulator
-- randomized `distsim` runs
-- first event/interleaving simulator work in `distsim/simulator.go`
-
-Open focus:
-- `S19` covered in `distsim`
-- `S20` partially covered in `distsim`
-- `S5` partially covered in `distsim`
-- `S6` partially covered in `distsim`
-- `S18` partially covered in `distsim`
-- stronger `S12` covered in `distsim`
-- protocol-version comparison design added in:
-  - `sw-block/design/protocol-version-simulation.md`
-- remaining focus is now P2 plus stronger versions of partial scenarios
-
-## Phase Status
-
-### P0
-
-- `S19` chain of custody across multiple promotions: done
-- `S20` live partition with competing writes: partial
-
-### P1
-
-- `S5` flapping replica stays recoverable: partial
-- `S6` tail-chasing under load: partial
-- `S18` primary restart without failover: partial
-- stronger `S12`: done
-
-### P2
-
-- active next step:
-  - protocol-version comparison support
-  - stronger versions of current partial scenarios
-
-## Exit Criteria
-
-Phase 01 is done when:
-
-1. `S19` and `S20` are covered
-2. `S5`, `S6`, `S18`, and stronger `S12` are at least partially covered
-3. coverage matrix in `v2_scenarios.md` is current
-4. random simulation still passes after added scenarios
-
-## Completion Note
-
-Phase 01 completed with:
-- `S19` covered
-- stronger `S12` covered
-- `S20`, `S5`, `S6`, `S18` strengthened but correctly left as `partial`
-
-Next execution phase:
-- `sw-block/.private/phase/phase-02.md`

sw-block/.private/phase/phase-02-decisions.md

@@ -1,51 +0,0 @@
-# Phase 02 Decisions
-
-Date: 2026-03-26
-Status: active
-
-## Decision 1: Extend `distsim` Instead Of Forking A New Protocol Simulator
-
-Reason:
-- current `distsim` already has:
-  - node/storage model
-  - coordinator/epoch model
-  - reference oracle
-  - randomized runs
-- the missing layer is protocol-state fidelity, not a new simulation foundation
-
-Implication:
-- add lightweight per-node replication state and protocol decisions to `distsim`
-- do not build a separate fourth simulator yet
-
-## Decision 2: Keep Coverage Status Conservative
-
-Reason:
-- `S20`, `S6`, and `S18` currently prove important safety properties
-- but they do not yet fully assert message-level or explicit state-transition behavior
-
-Implication:
-- leave them `partial` until the model can assert protocol behavior directly
-
-## Decision 3: Use Versioned Scenario Comparison To Justify V2
-
-Reason:
-- the simulator should not only say "V2 works"
-- it should show:
-  - where `V1` fails
-  - where `V1.5` improves but still strains
-  - why `V2` is worth the complexity
-
-Implication:
-- Phase 02 includes explicit `V1` / `V1.5` / `V2` scenario comparison work
-
-## Decision 4: V2 Must Not Be Described As "Always Catch-Up"
-
-Reason:
-- that wording is too optimistic and hides the real V2 design rule
-- V2 is better because it makes recoverability explicit, not because it retries forever
-
-Implication:
-- describe V2 as:
-  - catch-up if explicitly recoverable
-  - otherwise explicit rebuild
-- keep this wording consistent in tests and docs

sw-block/.private/phase/phase-02-log.md

@@ -1,93 +0,0 @@
-# Phase 02 Log
-
-Date: 2026-03-26
-Status: active
-
-## 2026-03-26
-
-- Phase 02 created to move `distsim` from final-state safety validation toward explicit protocol-state simulation.
-- Initial focus:
-  - close `S20`, `S6`, and `S18` at protocol level
-  - compare `V1`, `V1.5`, and `V2` on the same scenarios
-- Known model gap at phase start:
-  - current `distsim` is strong at final-state safety invariants
-  - current `distsim` is weaker at mid-flow protocol assertions and message-level rejection reasons
-- Phase 02 progress now in place:
-  - delivery accept/reject tracking
-  - protocol-level stale-epoch rejection assertions
-  - explicit non-convergent catch-up state transition assertions
-  - initial version-comparison tests for disconnect, tail-chasing, and restart/rejoin policy
-- Next simulator target:
-  - reproduce real `V1.5` address-instability and control-plane-recovery failures as named scenarios
-- Immediate coding asks for `sw`:
-  - changed-address restart failure in `V1.5`
-  - same-address transient outage comparison across `V1` / `V1.5` / `V2`
-  - slow control-plane reassignment scenario derived from `CP13-8 T4b`
-- Local housekeeping done:
-  - corrected V2 wording from "always catch-up" to "catch-up if explicitly recoverable; otherwise rebuild"
-  - added explicit brief-disconnect and changed-address restart policy helpers
-  - verified `distsim` test suite still passes with the Windows-safe runner
-- Scenario status update:
-  - `S20` now covered via protocol-level stale-traffic rejection + committed-prefix stability
-  - `S6` now covered via explicit `CatchingUp -> NeedsRebuild` assertions
-  - `S18` now covered via explicit stale `MsgBarrierAck` rejection + prefix stability
-- Next asks for `sw` after this closure:
-  - changed-address restart scenario tied directly to `CP13-8 T4b`
-  - same-address transient outage comparison across `V1` / `V1.5` / `V2`
-  - slow control-plane reassignment scenario
-  - Smart WAL recoverable -> unrecoverable transition scenarios
-- Additional closure completed:
-  - `S5` now covered with both:
-    - repeated recoverable flapping
-    - budget-exceeded escalation to `NeedsRebuild`
-  - Smart WAL transitions now exercised with:
-    - recoverable -> unrecoverable during active recovery
-    - mixed `WALInline` + `ExtentReferenced` success
-    - time-varying payload availability
-- Updated next asks for `sw`:
-  - changed-address restart scenario tied directly to `CP13-8 T4b`
-  - same-address transient outage comparison across `V1` / `V1.5` / `V2`
-  - slow control-plane reassignment scenario
-  - delayed/drop network beyond simple disconnect
-  - multi-node reservation expiry / rebuild timeout cases
-- Additional Phase 02 coverage delivered:
-  - delayed stale messages after promote/failover
-  - delayed stale barrier ack rejection
-  - selective write-drop with barrier delivery under `sync_all`
-  - multi-node mixed reservation expiry outcome
-  - multi-node `NeedsRebuild` / snapshot rebuild recovery
-  - partial rebuild timeout / retry completion
-- Remaining asks are now narrower:
-  - changed-address restart scenario tied directly to `CP13-8 T4b`
-  - same-address transient outage comparison across `V1` / `V1.5` / `V2`
-  - slow control-plane reassignment scenario
-  - stronger coordinator candidate-selection scenarios
-- Additional closure after review:
-  - safe default promotion selector now refuses `NeedsRebuild` candidates
-  - explicit desperate-promotion API separated from safe selection
-  - changed-address and slow-control-plane comparison tests now prove actual data divergence / healing, not only policy shape
-- New next-step assignment:
-  - strengthen model depth around endpoint identity and control-plane reassignment
-  - replace abstract repair helpers with more explicit event flow where practical
-  - reduce direct recovery state injection in comparison tests
-  - extend candidate selection from ranking into validity rules
-
-## 2026-03-27
-
-- Phase 02 core simulator hardening is effectively complete.
-- Delivered since the previous checkpoint:
-  - endpoint identity / endpoint-version modeling
-  - stale-endpoint rejection in delivery path
-  - heartbeat -> coordinator detect -> assignment-update control-plane flow
-  - recovery-session trigger API for `V1.5` and `V2`
-  - explicit candidate eligibility checks:
-    - running
-    - epoch alignment
-    - state eligibility
-    - committed-prefix sufficiency
-  - safe default promotion now rejects candidates without the committed prefix
-- Current `distsim` status at latest review:
-  - 73 tests passing
-- Manager bookkeeping decision:
-  - keep Phase 02 active only for doc maintenance / wrap-up
-  - treat further simulator depth as likely Phase 03 work, not unbounded Phase 02 scope creep

sw-block/.private/phase/phase-02.md

@@ -1,191 +0,0 @@
-# Phase 02
-
-Date: 2026-03-27
-Status: active
-Purpose: extend the V2 simulator from final-state safety checking into protocol-state simulation that can reproduce `V1`, `V1.5`, and `V2` behavior on the same scenarios
-
-## Goal
-
-Make the simulator model enough node-local replication state and message-level behavior to:
-
-1. reproduce `V1` / `V1.5` failure modes
-2. show why those failures are structural
-3. close the current `partial` V2 scenarios with stronger protocol assertions
-
-This phase is about:
-- protocol-version comparison
-- per-node replication state
-- message-level fencing / accept / reject behavior
-- explicit catch-up abort / rebuild transitions
-
-This phase is not about:
-- product integration
-- production transport
-- SPDK
-- raw allocator
-
-## Source Of Truth
-
-Design/source-of-truth:
-- `sw-block/design/v2_scenarios.md`
-- `sw-block/design/protocol-version-simulation.md`
-- `sw-block/design/v1-v15-v2-simulator-goals.md`
-
-Prototype code:
-- `sw-block/prototype/distsim/`
-
-## Assigned Tasks For `sw`
-
-### P0
-
-1. Add per-node replication state to `distsim`
-- minimum states:
-  - `InSync`
-  - `Lagging`
-  - `CatchingUp`
-  - `NeedsRebuild`
-  - `Rebuilding`
-- keep state lightweight; do not clone full `fsmv2` into `distsim`
-
-2. Add message-level protocol decisions
-- stale-epoch write / ship / barrier traffic must be explicitly rejected
-- record whether a message was:
-  - accepted
-  - rejected by epoch
-  - rejected by state
-
-3. Add explicit catch-up abort / rebuild entry
-- non-convergent catch-up must move to explicit modeled failure:
-  - `NeedsRebuild`
-  - or equivalent abort outcome
-
-### P1
-
-4. Re-close `S20` at protocol level
-- stale-side writes must go through protocol delivery path
-- prove stale-side traffic cannot advance committed lineage
-
-5. Re-close `S6` at protocol level
-- assert explicit abort/escalation on non-convergence
-- not only final-state safety
-
-6. Re-close `S18` at protocol level
-- assert committed-prefix behavior around delayed old ack / restart races
-- not only final-state oracle checks
-
-### P2
-
-7. Expand protocol-version comparison
-- run selected scenarios under:
-  - `V1`
-  - `V1.5`
-  - `V2`
-- at minimum:
-  - brief disconnect
-  - restart with changed address
-  - tail-chasing
-
-8. Add V1.5-derived failure scenarios
-- replica restart with changed receiver address
-- same-address transient outage
-- slow control-plane recovery vs fast local reconnect
-
-9. Prepare richer recovery modeling
-- time-varying recoverability
-- reservation loss during active catch-up
-- rebuild timeout / retry in mixed-state cluster
-
-## Invariants To Preserve
-
-After every scenario or random run, preserve:
-
-1. committed data is durable per policy
-2. uncommitted data is not revived as committed
-3. stale epoch traffic does not mutate current lineage
-4. recovered/promoted node matches reference state at target `LSN`
-5. committed prefix remains contiguous
-6. protocol-state transitions are explicit, not inferred from final data only
-
-## Required Updates Per Task
-
-For each completed task:
-
-1. add or update test(s)
-2. update `sw-block/design/v2_scenarios.md`
-   - package
-   - test name
-   - status
-   - source if new scenario was derived from V1/V1.5 behavior
-3. add a short note to:
-   - `sw-block/.private/phase/phase-02-log.md`
-4. if a design choice changed, record it in:
-   - `sw-block/.private/phase/phase-02-decisions.md`
-
-## Current Progress
-
-Already in place before this phase:
-- `distsim` final-state safety invariants
-- randomized simulation
-- event/interleaving simulator work
-- initial `ProtocolVersion` / policy scaffold
-- `S19` covered
-- stronger `S12` covered
-
-Known partials to close in this phase:
-- none in the current named backlog slice
-
-Delivered in this phase so far:
-- delivery accept/reject tracking added
-- protocol-level rejection assertions added
-- explicit `CatchingUp -> NeedsRebuild` state transition tested
-- selected protocol-version comparison tests added
-- `S20`, `S6`, and `S18` moved from `partial` to `covered`
-- Smart WAL transition scenarios added
-- `S5` moved from `partial` to `covered`
-- endpoint identity / endpoint-version modeling added
-- explicit heartbeat -> detect -> assignment-update control-plane flow added for changed-address restart
-- explicit recovery-session triggers added for `V1.5` and `V2`
-- promotion selection now uses explicit eligibility, including committed-prefix gating
-- safe and desperate promotion paths are separated
-- full `distsim` suite at latest review: 73 tests passing
-
-Remaining focus for `sw`:
-- Phase 02 core scope is now largely delivered
-- remaining work should be treated as future-strengthening, not baseline closure
-- if more simulator depth is needed next, it should likely start as Phase 03:
-  - timeout semantics
-  - timer races
-  - richer event/interleaving behavior
-  - stronger endpoint/control-plane realism beyond the current abstract model
-
-## Immediate Next Tasks For `sw`
-
-1. Add a documented compare artifact for new scenarios
-- for each new `V1` / `V1.5` / `V2` comparison:
-  - record scenario name
-  - what fails in `V1`
-  - what improves in `V1.5`
-  - what is explicit in `V2`
-- keep `sw-block/design/v1-v15-v2-comparison.md` updated
-
-2. Keep the coverage matrix honest
-- do not mark a scenario `covered` unless the test asserts protocol behavior directly
-- final-state oracle checks alone are not enough
-
-3. Prepare Phase 03 proposal instead of broadening ad hoc
-- if more depth is needed, define it cleanly first:
-  - timers / timeout events
-  - event ordering races
-  - richer endpoint lifecycle
-  - recovery-session uniqueness across competing triggers
-
-## Exit Criteria
-
-Phase 02 is done when:
-
-1. `S5`, `S6`, `S18`, and `S20` are covered at protocol level
-2. `distsim` can reproduce at least one `V1` failure, one `V1.5` failure, and the corresponding `V2` behavior on the same named scenario
-3. protocol-level rejection/accept behavior is asserted in tests, not only inferred from final-state oracle checks
-4. coverage matrix in `v2_scenarios.md` is current
-5. changed-address and reconnect scenarios are modeled through explicit endpoint / control-plane behavior rather than helper-only abstraction
-6. promotion selection uses explicit eligibility, including committed-prefix safety

sw-block/.private/phase/phase-03-decisions.md

@@ -1,97 +0,0 @@
-# Phase 03 Decisions
-
-Date: 2026-03-27
-Status: initial
-
-## Why Phase 03 Exists
-
-Phase 02 already covered the main protocol-state story:
-
-- V1 / V1.5 / V2 comparison
-- stale traffic rejection
-- catch-up vs rebuild
-- changed-address restart control-plane flow
-- committed-prefix-safe promotion eligibility
-
-The next simulator problems are different:
-
-- timer semantics
-- timeout races
-- event ordering under contention
-
-That deserves a separate phase so the model boundary stays clear.
-
-## Initial Boundary
-
-### `distsim`
-
-Keep for:
-
-- protocol correctness
-- reference-state validation
-- recoverability logic
-- promotion / lineage rules
-
-### `eventsim`
-
-Grow for:
-
-- explicit event queue behavior
-- timeout events
-- equal-time scheduling choices
-- race exploration
-
-## Working Rule
-
-Do not move all scenarios into `eventsim`.
-
-Only move or duplicate scenarios when:
-
-- timer or event ordering is the real bug surface
-- `distsim` abstraction hides the important behavior
-
-## Accepted Phase 03 Decisions
-
-### Same-tick rule
-
-Within one tick:
-
-- data/message delivery is evaluated before timeout firing
-
-Meaning:
-
-- if an ack arrives in the same tick as a timeout deadline, the ack wins and may cancel the timeout
-
-This is now an explicit simulator rule, not accidental behavior.
-
-### Timeout authority
-
-Not every timeout that reaches its deadline still has authority to mutate state.
-
-So we now distinguish:
-
-- `FiredTimeouts`
-  - timeout had authority and changed the model
-- `IgnoredTimeouts`
-  - timeout reached deadline but was stale and ignored
-
-This keeps replay/debug output honest.
-
-### Late barrier ack rule
-
-Once a barrier instance times out:
-
-- it is marked expired
-- late ack for that barrier instance is rejected
-
-That prevents a stale ack from reviving old durability state.
-
-### Review gate rule for timer work
-
-Timer/race work is easy to get subtly wrong while still having green tests.
-
-So timer-related work is not accepted until:
-
-- code path is reviewed
-- tests assert the real protocol obligation
-- stale and authoritative timer behavior are clearly distinguished

sw-block/.private/phase/phase-03-log.md

@@ -1,36 +0,0 @@
-# Phase 03 Log
-
-Date: 2026-03-27
-Status: active
-
-## 2026-03-27
-
-- Phase 03 created after Phase 02 core scope was effectively delivered.
-- Reason for new phase:
-  - remaining simulator work is about timer semantics and race behavior, not basic protocol-state coverage
-- Initial target:
-  - define `distsim` vs `eventsim` split more clearly
-  - add explicit timeout semantics
-  - add timer-race scenarios without bloating `distsim` ad hoc
-- P0 delivered:
-  - timeout model added for barrier / catch-up / reservation
-  - timeout-backed scenarios added
-  - same-tick ordering rule defined as data-before-timers
-- First review result:
-  - timeout semantics accepted only after making cancellation model-driven
-  - late barrier ack after timeout required explicit rejection
-- P0 hardening delivered:
-  - recovery timeout cancellation moved into model logic
-  - stale late barrier ack rejected via expired-barrier tracking
-  - stale vs authoritative timeout distinction added:
-    - `FiredTimeouts`
-    - `IgnoredTimeouts`
-- P1 delivered and reviewed:
-  - promotion vs stale timeout race
-  - rebuild completion vs epoch bump race
-  - trace builder moved into reusable code
-- Current suite state at latest accepted review:
-  - 86 `distsim` tests passing
-- Manager decision:
-  - Phase 03 P0/P1 are accepted
-  - next work should move to deliberate P2 selection rather than broadening the phase ad hoc

sw-block/.private/phase/phase-03.md

@@ -1,193 +0,0 @@
-# Phase 03
-
-Date: 2026-03-27
-Status: active
-Purpose: define the next simulator tier after Phase 02, focused on timeout semantics, timer races, and a cleaner split between protocol simulation and event/interleaving simulation
-
-## Goal
-
-Phase 03 exists to cover behavior that current `distsim` still abstracts away:
-
-1. timeout semantics
-2. timer races
-3. event ordering under competing triggers
-4. clearer separation between:
-   - protocol / lineage simulation
-   - event / race simulation
-
-This phase should not reopen already-closed Phase 02 protocol scope unless a clear bug is found.
-
-## Why A New Phase
-
-Phase 02 already delivered:
-
-- protocol-state assertions
-- V1 / V1.5 / V2 comparison scenarios
-- endpoint identity modeling
-- control-plane assignment-update flow
-- committed-prefix-aware promotion eligibility
-
-What remains is different in character:
-
-- timers
-- delayed events racing with each other
-- timeout-triggered state changes
-- more explicit event scheduling
-
-That deserves a new phase boundary.
-
-## Source Of Truth
-
-Design/source-of-truth:
-- `sw-block/design/v2_scenarios.md`
-- `sw-block/design/v2-dist-fsm.md`
-- `sw-block/design/v2-scenario-sources-from-v1.md`
-- `sw-block/design/v1-v15-v2-comparison.md`
-
-Current prototype base:
-- `sw-block/prototype/distsim/`
-- `sw-block/prototype/distsim/simulator.go`
-
-## Scope
-
-### In scope
-
-1. timeout semantics
-- barrier timeout
-- catch-up timeout
-- reservation expiry timeout
-- rebuild timeout
-
-2. timer races
-- delayed ack vs timeout
-- timeout vs promotion
-- reconnect vs timeout
-- catch-up completion vs expiry
-- rebuild completion vs epoch bump
-
-3. simulator split clarification
-- `distsim` keeps:
-  - protocol correctness
-  - lineage
-  - recoverability
-  - reference-state checking
-- `eventsim` grows into:
-  - event scheduling
-  - timer firing
-  - same-time interleavings
-  - race exploration
-
-### Out of scope
-
-- production integration
-- real transport
-- real disk timings
-- SPDK
-- raw allocator
-
-## Assigned Tasks For `sw`
-
-### P0
-
-1. Write a concrete `eventsim` scope note in code/docs
-- define what stays in `distsim`
-- define what moves to `eventsim`
-- avoid overlap and duplicated semantics
-
-2. Add minimal timeout event model
-- first-class timeout event type(s)
-- at minimum:
-  - barrier timeout
-  - catch-up timeout
-  - reservation expiry
-
-3. Add timeout-backed scenarios
-- stale delayed ack vs timeout
-- catch-up timeout before convergence
-- reservation expiry during active recovery
-
-### P1
-
-4. Add race-focused tests
-- promotion vs delayed stale ack
-- rebuild completion vs epoch bump
-- reconnect success vs timeout firing
-
-5. Keep traces debuggable
-- failing runs must dump:
-  - seed
-  - event order
-  - timer events
-  - node states
-  - committed prefix
-
-### P2
-
-6. Decide whether selected `distsim` scenarios should also exist in `eventsim`
-- only when timer/event ordering is the real point
-- do not duplicate every scenario blindly
-
-## Current Progress
-
-Delivered in this phase so far:
-
-- `eventsim` scope note added in code
-- explicit timeout model added:
-  - barrier timeout
-  - catch-up timeout
-  - reservation timeout
-- timeout-backed scenarios added and reviewed
-- same-tick rule made explicit:
-  - data before timers
-- recovery timeout cancellation is now model-driven, not test-driven
-- stale barrier ack after timeout is explicitly rejected
-- stale timeouts are separated from authoritative timeouts:
-  - `FiredTimeouts`
-  - `IgnoredTimeouts`
-- race-focused scenarios added and reviewed:
-  - promotion vs stale catch-up timeout
-  - promotion vs stale barrier timeout
-  - rebuild completion vs epoch bump
-  - epoch bump vs stale catch-up timeout
-- reusable trace builder added for replay/debug support
-- current `distsim` suite at latest review:
-  - 86 tests passing
-
-Remaining focus for `sw`:
-
-- Phase 03 P0 and P1 are effectively complete
-- Phase 03 P2 is also effectively complete after review
-- any further simulator work should now be narrow and evidence-driven
-- recommended next simulator additions only:
-  - control-plane latency parameter
-  - sustained-write convergence / tail-chasing load test
-  - one multi-promotion lineage extension
-
-## Invariants To Preserve
-
-1. committed data remains durable per policy
-2. uncommitted data is never revived as committed
-3. stale epoch traffic never mutates current lineage
-4. committed prefix remains contiguous
-5. timeout-triggered transitions are explicit and explainable
-6. races do not silently bypass fencing or rebuild boundaries
-
-## Required Updates Per Task
-
-For each completed task:
-
-1. add or update tests
-2. update `sw-block/design/v2_scenarios.md` if scenario coverage changed
-3. add a short note to:
-   - `sw-block/.private/phase/phase-03-log.md`
-4. if the simulator boundary changed, record it in:
-   - `sw-block/.private/phase/phase-03-decisions.md`
-
-## Exit Criteria
-
-Phase 03 is done when:
-
-1. timeout semantics exist as explicit simulator behavior
-2. at least three important timer-race scenarios are modeled and tested
-3. `distsim` vs `eventsim` responsibilities are clearly separated
-4. failure traces from race/timeout scenarios are replayable enough to debug

sw-block/.private/phase/phase-04-decisions.md

@@ -1,200 +0,0 @@
-# Phase 04 Decisions
-
-Date: 2026-03-27
-Status: complete
-
-## First Slice Decision
-
-The first standalone V2 implementation slice is:
-
-- per-replica sender ownership
-- one active recovery session per replica per epoch
-
-## Why Not Start In V1
-
-V1/V1.5 remains:
-
-- production line
-- maintenance/fix line
-
-It should not be the place where V2 architecture is first implemented.
-
-## Why This Slice
-
-This slice:
-
-- directly addresses the clearest V1.5 structural pain
-- maps cleanly to the V2-boundary tests
-- is narrow enough to implement without dragging in the entire future architecture
-
-## Accepted P0 Refinements
-
-### Sender epoch coherence
-
-Sender-owned epoch is real state, not decoration.
-
-So:
-
-- reconcile/update paths must refresh sender epoch
-- stale active session must be invalidated on epoch advance
-
-### Session lifecycle
-
-The first slice should not use a totally loose lifecycle shell.
-
-So:
-
-- session phase changes now follow an explicit transition map
-- invalid jumps are rejected
-
-### Session attach rule
-
-Attaching a session at the wrong epoch is invalid.
-
-So:
-
-- `AttachSession(epoch, kind)` must reject epoch mismatch with the owning sender
-
-## Accepted P1 Refinements
-
-### Session identity fencing
-
-The standalone V2 slice must reject stale completion by explicit session identity.
-
-So:
-
-- `RecoverySession` has stable unique identity
-- sender completion must be by session ID, not by "current pointer"
-- stale session results are rejected at the sender authority boundary
-
-### Ownership vs execution
-
-Ownership creation is not the same as execution start.
-
-So:
-
-- `AttachSession()` and `SupersedeSession()` establish ownership only
-- `BeginConnect()` is the first execution-state mutation
-
-### Completion authority
-
-An ID match alone is not enough to complete recovery.
-
-So:
-
-- completion must require a valid completion-ready phase
-- normal completion requires converged catch-up
-- zero-gap fast completion is allowed explicitly from handshake
-
-## P2 Direction
-
-The next prototype step is not broader simulation.
-
-It is:
-
-- recovery outcome branching
-- assignment-intent orchestration
-- prototype-level end-to-end recovery flow
-
-## Accepted P2 Refinements
-
-### Recovery boundary
-
-Recovery classification must use a lineage-safe boundary, not a raw primary WAL head.
-
-So:
-
-- handshake outcome classification uses committed/safe recovery boundary
-- stale or divergent extra tail must not be treated as zero-gap by default
-
-### Stale assignment fencing
-
-Assignment intent must not create current live sessions from stale epoch input.
-
-So:
-
-- stale assignment epoch is rejected
-- assignment result distinguishes:
-  - created
-  - superseded
-  - failed
-
-### Phase discipline on outcome classification
-
-The outcome API must respect execution entry rules.
-
-So:
-
-- handshake-with-outcome requires valid connecting phase before acting
-
-## P3 Direction
-
-The next prototype step is:
-
-- minimal historical-data model
-- recoverability proof
-- explicit safe-boundary / divergent-tail handling
-
-## Accepted P3 Refinements
-
-### Recoverability proof
-
-The historical-data prototype must prove why catch-up is allowed.
-
-So:
-
-- recoverability now checks retained start, end within head, and contiguous coverage
-- rebuild fallback is backed by executable unrecoverability
-
-### Historical state after recycling
-
-Retained-prefix modeling needs a base state, not only remaining WAL entries.
-
-So:
-
-- tail advance captures a base snapshot
-- historical state reconstruction uses snapshot + retained WAL
-
-### Divergent tail handling
-
-Replica-ahead state must not collapse directly to `InSync`.
-
-So:
-
-- divergent tail requires explicit truncation
-- completion is gated on recorded truncation when required
-
-## P4 Direction
-
-The next prototype step is:
-
-- prototype scenario closure
-- acceptance-criteria to prototype traceability
-- explicit expression of the 4 V2-boundary cases against `enginev2`
-
-## Accepted P4 Refinements
-
-### Prototype scenario closure
-
-The prototype must stop being only a set of local mechanisms.
-
-So:
-
-- acceptance criteria are mapped to prototype evidence
-- key V2-boundary scenarios are expressed directly against `enginev2`
-- prototype behavior is reviewable scenario-by-scenario
-
-### Phase 04 completion decision
-
-Phase 04 has now met its intended prototype scope:
-
-- ownership
-- execution gating
-- outcome branching
-- minimal historical-data model
-- prototype scenario closure
-
-So:
-
-- no broad new Phase 04 work should be added
-- next work should move to `Phase 4.5` gate-hardening

sw-block/.private/phase/phase-04-log.md

@@ -1,76 +0,0 @@
-# Phase 04 Log
-
-Date: 2026-03-27
-Status: complete
-
-## 2026-03-27
-
-- Phase 04 created to start the first standalone V2 implementation slice.
-- Decision:
-  - do not begin in `weed/storage/blockvol/`
-  - begin under `sw-block/`
-- first slice chosen:
-  - per-replica sender ownership
-  - explicit recovery-session ownership
-- Initial slice delivered under `sw-block/prototype/enginev2/`:
-  - sender
-  - recovery session
-  - sender group
-- First review found:
-  - sender/session epoch coherence gap
-  - session lifecycle was shell-only, not enforcing real transitions
-  - attach-session epoch mismatch was not rejected
-- Follow-up delivered and accepted:
-  - reconcile updates preserved sender epoch
-  - epoch bump invalidates stale session
-  - session transition map enforced
-  - attach-session rejects epoch mismatch
-  - enginev2 tests increased to 26 passing
-- Phase 04a created to close the ownership-validation gap:
-  - explicit session identity in `distsim`
-  - bridge tests into `enginev2`
-- Phase 04a ownership problem closed well enough:
-  - stale completion rejected by session ID
-  - endpoint invalidation includes `CtrlAddr`
-  - boundary doc aligned with real simulator/prototype evidence
-- Phase 04 P1 delivered and accepted:
-  - sender-owned execution APIs added
-  - all execution APIs fence on `sessionID`
-  - completion now requires valid completion point
-  - attach/supersede now establish ownership only
-  - handshake range validation added
-  - enginev2 tests increased to 46 passing
-- Phase 04 P2 delivered and accepted:
-  - outcome branching added:
-    - `OutcomeZeroGap`
-    - `OutcomeCatchUp`
-    - `OutcomeNeedsRebuild`
-  - assignment-intent orchestration added
-  - stale assignment epoch now rejected
-  - assignment result now distinguishes created / superseded / failed
-  - end-to-end prototype recovery tests added
-  - zero-gap classification tightened:
-    - exact equality to committed boundary only
-    - replica-ahead is not zero-gap
-  - enginev2 tests increased to 63 passing
-- Phase 04 P3 delivered and accepted:
-  - `WALHistory` added as minimal historical-data model
-  - recoverability proof strengthened:
-    - retained start
-    - end within head
-    - contiguous coverage
-  - base snapshot added for correct `StateAt()` after tail advance
-  - divergent-tail truncation made explicit in sender/session execution
-  - WAL-backed prototype recovery tests added
-  - enginev2 tests increased to 83 passing
-- Phase 04 P4 delivered and accepted:
-  - acceptance criteria mapped to prototype evidence
-  - V2-boundary scenarios expressed against `enginev2`
-  - prototype scenario closure achieved
-  - enginev2 tests increased to 95 passing
-- Phase 04 is now complete for its intended prototype scope.
-- Next recommended phase:
-  - `Phase 4.5`
-  - tighten bounded `CatchUp`
-  - formalize `Rebuild`
-  - strengthen crash-consistency / recoverability / liveness proof

sw-block/.private/phase/phase-04.md

@@ -1,216 +0,0 @@
-# Phase 04
-
-Date: 2026-03-27
-Status: complete
-Purpose: start the first standalone V2 implementation slice under `sw-block/`, centered on per-replica sender ownership and explicit recovery-session ownership
-
-## Goal
-
-Build the first real V2 implementation slice without destabilizing V1.
-
-This slice should prove:
-
-1. per-replica sender identity
-2. explicit one-session-per-replica recovery ownership
-3. endpoint/assignment-driven recovery updates
-4. clean handoff between normal sender and recovery session
-
-## Why This Phase Exists
-
-The simulator and design work are now strong enough to support a narrow implementation slice.
-
-We should not start with:
-
-- Smart WAL
-- new storage engine
-- frontend integration
-
-We should start with the ownership problem that most clearly separates V2 from V1.5.
-
-## Source Of Truth
-
-Design:
-- `sw-block/docs/archive/design/v2-first-slice-session-ownership.md`
-- `sw-block/design/v2-acceptance-criteria.md`
-- `sw-block/design/v2-open-questions.md`
-
-Simulator reference:
-- `sw-block/prototype/distsim/`
-
-## Scope
-
-### In scope
-
-1. per-replica sender owner object
-2. explicit recovery session object
-3. session lifecycle rules
-4. endpoint update handling
-5. basic tests for sender/session ownership
-
-### Out of scope
-
-- Smart WAL in production code
-- real block backend redesign
-- V1 integration
-- frontend publication
-
-## Assigned Tasks For `sw`
-
-### P0
-
-1. create standalone V2 implementation area under `sw-block/`
-- recommended:
-  - `sw-block/prototype/enginev2/`
-
-2. define sender/session types
-- sender owner per replica
-- recovery session per replica per epoch
-
-3. implement basic lifecycle
-- create sender
-- attach session
-- supersede stale session
-- close session on success / invalidation
-
-## Current Progress
-
-Delivered in this phase so far:
-
-- standalone V2 area created under:
-  - `sw-block/prototype/enginev2/`
-- core types added:
-  - `Sender`
-  - `RecoverySession`
-  - `SenderGroup`
-- sender/session lifecycle shell implemented
-- per-replica ownership implemented
-- endpoint-change invalidation implemented
-- sender epoch coherence implemented
-- session epoch attach validation implemented
-- session phase transitions now enforce a real transition map
-- session identity fencing implemented
-- stale completion rejected by session ID
-- execution APIs implemented:
-  - `BeginConnect`
-  - `RecordHandshake`
-  - `RecordHandshakeWithOutcome`
-  - `BeginCatchUp`
-  - `RecordCatchUpProgress`
-  - `CompleteSessionByID`
-- completion authority tightened:
-  - catch-up must converge
-  - zero-gap handshake fast path allowed
-- attach/supersede now establish ownership only
-- sender-group orchestration tests added
-- recovery outcome branching implemented:
-  - `OutcomeZeroGap`
-  - `OutcomeCatchUp`
-  - `OutcomeNeedsRebuild`
-- assignment-intent orchestration implemented:
-  - reconcile + recovery target session creation
-  - stale assignment epoch rejected
-  - created/superseded/failed outcomes distinguished
-- P2 data-boundary correction accepted:
-  - zero-gap now requires exact equality to committed boundary
-  - replica-ahead is not zero-gap
-- minimal historical-data prototype implemented:
-  - `WALHistory`
-  - retained-prefix / recycled-range semantics
-  - executable recoverability proof
-  - base snapshot for historical state after tail advance
-- explicit safe-boundary handling implemented:
-  - divergent tail requires truncation before `InSync`
-  - truncation recorded via sender-owned execution API
-- WAL-backed prototype tests added:
-  - catch-up recovery with data verification
-  - rebuild fallback with proof of unrecoverability
-  - truncate-then-`InSync` with committed-boundary verification
-- current `enginev2` test state at latest review:
--  - 95 tests passing
-- prototype scenario closure completed:
-  - acceptance criteria mapped to prototype evidence
-  - V2-boundary scenarios expressed against `enginev2`
-  - small end-to-end prototype harness added
-
-Next phase:
-
-- `Phase 4.5`
-  - bounded `CatchUp`
-  - first-class `Rebuild`
-  - crash-consistency / recoverability / liveness proof hardening
-- do not integrate into V1 production tree yet
-
-### P1
-
-4. implement endpoint update handling
-- changed-address update must refresh the right sender owner
-
-5. implement epoch invalidation
-- stale session must stop after epoch bump
-
-6. add tests matching the slice acceptance
-
-### P2
-
-7. add recovery outcome branching
-- distinguish:
-  - zero-gap fast completion
-  - positive-gap catch-up completion
-  - unrecoverable gap / `NeedsRebuild`
-
-8. add assignment-intent driven orchestration
-- move beyond raw reconcile-only tests
-- make sender-group react to explicit recovery intent
-
-9. add prototype-level end-to-end flow tests
-- assignment/update
-- session creation
-- execution
-- completion / invalidation
-- rebuild escalation
-
-### P3
-
-10. add minimal historical-data prototype
-- retained prefix/window
-- minimal recoverability state
-- explicit "why catch-up is allowed" proof
-
-11. make safe-boundary data handling explicit
-- divergent tail cleanup / truncate rule
-- or equivalent explicit boundary handling before `InSync`
-
-12. strengthen recoverability/rebuild tests
-- executable proof of:
-- recoverable gap
-- unrecoverable gap
-- rebuild fallback boundary
-
-### P4
-
-13. close prototype scenario coverage
-- map key acceptance criteria onto `enginev2` scenarios/tests
-- make prototype evidence reviewable scenario-by-scenario
-
-14. express the 4 V2-boundary cases against the prototype
-- changed-address identity-preserving recovery
-- `NeedsRebuild` persistence
-- catch-up without overwriting safe data
-- repeated disconnect/reconnect cycles
-
-15. add one small prototype harness if needed
-- enough to show assignment -> recovery -> outcome flow end-to-end
-- no product/backend integration yet
-
-## Exit Criteria
-
-Phase 04 is done when:
-
-1. standalone V2 sender/session slice exists under `sw-block/`
-2. sender ownership is per replica, not set-global
-3. one active recovery session per replica per epoch is enforced
-4. endpoint update and epoch invalidation are tested
-5. sender-owned execution flow is validated
-6. recovery outcome branching exists at prototype level
-7. minimal historical-data / recoverability model exists at prototype level
-8. prototype scenario closure is achieved for key V2 acceptance cases

sw-block/.private/phase/phase-04a-decisions.md

@@ -1,49 +0,0 @@
-# Phase 04a Decisions
-
-Date: 2026-03-27
-Status: initial
-
-## Core Decision
-
-The next must-fix validation problem is:
-
-- sender/session ownership semantics
-
-This outranks:
-
-- more timing realism
-- more WAL detail
-- broader scenario growth
-
-## Why
-
-V2's core claim over V1.5 is not only:
-
-- better recovery policy
-
-It is also:
-
-- stable per-replica sender identity
-- one active recovery owner
-- stale work cannot mutate current state
-
-If those ownership rules are not validated, the simulator can overstate confidence.
-
-## Validation Rule
-
-For this phase, a scenario is only complete when it is expressed at two levels:
-
-1. simulator ownership model (`distsim`)
-2. standalone implementation slice (`enginev2`)
-
-Real `weed/` adversarial tests remain the system-level gate.
-
-## Scope Discipline
-
-Do not expand this phase into:
-
-- generic simulator feature growth
-- Smart WAL design growth
-- V1 integration work
-
-Keep it focused on the ownership model.

sw-block/.private/phase/phase-04a-log.md

@@ -1,22 +0,0 @@
-# Phase 04a Log
-
-Date: 2026-03-27
-Status: active
-
-## 2026-03-27
-
-- Phase 04a created as a narrow validation phase.
-- Reason:
-  - the biggest remaining V2 validation gap is ownership semantics
-  - not general scenario count
-  - not more timer realism
-  - not more WAL detail
-- Scope chosen:
-  - sender identity
-  - recovery session identity
-  - supersede / invalidate rules
-  - stale completion rejection
-  - `distsim` to `enginev2` bridge tests
-- This phase is intentionally separate from broad Phase 04 implementation growth.
-- Goal:
-  - gain confidence that V2 is validated as owned session/sender protocol state, not only as policy

sw-block/.private/phase/phase-04a.md

@@ -1,113 +0,0 @@
-# Phase 04a
-
-Date: 2026-03-27
-Status: active
-Purpose: close the critical V2 ownership-validation gap by making sender/session ownership explicit in both simulation and the standalone `enginev2` slice
-
-## Goal
-
-Validate the core V2 claim more deeply:
-
-1. one stable sender identity per replica
-2. one active recovery session per replica
-3. endpoint change, epoch bump, and supersede rules invalidate stale work
-4. stale late results from old sessions cannot mutate current state
-
-This phase is not about adding broad new simulator surface.
-It is about proving the ownership model that is supposed to make V2 better than V1.5.
-
-## Why This Phase Exists
-
-Current simulation is already strong on:
-
-- quorum / commit rules
-- stale epoch rejection
-- catch-up vs rebuild
-- timeout / race ordering
-- changed-address recovery at the policy level
-
-The remaining critical risk is narrower:
-
-- the simulator still validates V2 strongly as policy
-- but not yet strongly enough as owned sender/session protocol state
-
-That is the highest-value validation gap to close before trusting V2 too much.
-
-## Source Of Truth
-
-Design:
-- `sw-block/docs/archive/design/v2-first-slice-session-ownership.md`
-- `sw-block/design/v2-acceptance-criteria.md`
-- `sw-block/design/v2-open-questions.md`
-- `sw-block/design/protocol-development-process.md`
-
-Simulator / prototype:
-- `sw-block/prototype/distsim/`
-- `sw-block/prototype/enginev2/`
-
-Historical / review context:
-- `learn/projects/sw-block/phases/phase-13-v2-boundary-tests.md`
-- `sw-block/design/v2-scenario-sources-from-v1.md`
-
-## Scope
-
-### In scope
-
-1. explicit sender/session identity validation in `distsim`
-2. explicit stale-session invalidation rules
-3. bridge tests from `distsim` scenarios to `enginev2` sender/session invariants
-4. doc cleanup so V2-boundary tests point to real simulator and `enginev2` coverage
-
-### Out of scope
-
-- Smart WAL expansion
-- broad new timing realism
-- TCP / disk realism
-- V1 production integration
-- new backend/storage engine work
-
-## Critical Questions To Close
-
-1. can an old session completion mutate state after a new session supersedes it?
-2. does endpoint change invalidate or supersede the active session cleanly?
-3. does epoch bump remove all authority from prior sessions?
-4. can duplicate recovery triggers create overlapping active sessions?
-
-## Assigned Tasks For `sw`
-
-### P0
-
-1. add explicit session identity to `distsim`
-- model session ID or equivalent ownership token
-- make stale session results rejectable by identity, not just by coarse state
-
-2. add ownership scenarios to `distsim`
-- endpoint change during active catch-up
-- epoch bump during active catch-up
-- stale late completion from old session
-- duplicate recovery trigger while a session is already active
-
-3. add bridge tests in `enginev2`
-- same-address reconnect preserves sender identity
-- endpoint bump supersedes or invalidates active session
-- epoch bump rejects stale completion
-- only one active session per sender
-
-### P1
-
-4. tighten `learn/projects/sw-block/phases/phase-13-v2-boundary-tests.md`
-- point to actual `distsim` scenarios
-- point to actual `enginev2` bridge tests
-- state what remains real-engine-only
-
-5. only add simulator mechanics if a bridge test exposes a real ownership gap
-
-## Exit Criteria
-
-Phase 04a is done when:
-
-1. `distsim` explicitly validates sender/session ownership invariants
-2. `enginev2` has bridge tests for the same invariants
-3. stale session work is shown unable to mutate current sender state
-4. V2-boundary doc no longer has stale simulator references
-5. we can say with confidence that V2 ownership semantics, not just V2 policy, are validated at prototype level

sw-block/.private/phase/phase-05-decisions.md

@@ -1,94 +0,0 @@
-# Phase 05 Decisions
-
-## Decision 1: Real V2 engine work lives under `sw-block/engine/replication/`
-
-The first real engine slice is established under:
-
-- `sw-block/engine/replication/`
-
-This keeps V2 separate from:
-
-- `sw-block/prototype/`
-- `weed/storage/blockvol/`
-
-## Decision 2: Slice 1 is accepted
-
-Accepted scope:
-
-1. stable per-replica sender identity
-2. stable recovery-session identity
-3. stale authority fencing
-4. endpoint / epoch invalidation
-5. ownership registry
-
-## Decision 3: Stable identity must not be address-shaped
-
-The engine registry is now keyed by stable `ReplicaID`, not mutable endpoint address.
-
-This is a required structural break from the V1/V1.5 identity-loss pattern.
-
-## Decision 4: Slice 2 is accepted
-
-Accepted scope:
-
-1. connect / handshake / catch-up flow
-2. zero-gap / catch-up / needs-rebuild branching
-3. stale execution rejection during active recovery
-4. bounded catch-up semantics in engine path
-5. rebuild execution shell
-
-## Decision 5: Slice 3 owns real recoverability inputs
-
-Slice 3 should be the point where:
-
-1. recoverable vs unrecoverable gap uses real engine inputs
-2. trusted-base / rebuild-source decision uses real engine data inputs
-3. truncation / safe-boundary handling is tied to real engine state
-4. historical correctness at recovery target is validated from engine inputs
-
-## Decision 6: Slice 3 is accepted
-
-Accepted scope:
-
-1. real engine recoverability input path
-2. trusted-base / rebuild-source decision from engine data inputs
-3. truncation / safe-boundary handling tied to engine state
-4. recoverability gating without overclaiming full historical reconstruction in engine
-
-## Decision 7: Slice 3 should replace carried-forward heuristics where appropriate
-
-In particular:
-
-1. simple rebuild-source heuristics carried from prototype should not become permanent engine policy
-2. Slice 3 should tighten these decisions against real engine recoverability inputs
-
-## Decision 8: Slice 4 is the engine integration closure slice
-
-Next focus:
-
-1. real assignment/control intent entry path
-2. engine observability / debug surface
-3. focused integration tests for V2-boundary cases
-4. validation against selected real failure classes from `learn/projects/sw-block/` and `weed/storage/block*`
-
-## Decision 9: Slice 4 is accepted
-
-Accepted scope:
-
-1. real orchestrator entry path
-2. assignment/update-driven recovery through that path
-3. engine observability / causal recovery logging
-4. diagnosable V2-boundary integration tests
-
-## Decision 10: Phase 05 is complete
-
-Reason:
-
-1. ownership core is accepted
-2. recovery execution core is accepted
-3. data / recoverability core is accepted
-4. integration closure is accepted
-
-Next:
-
-- `Phase 06` broader engine implementation stage

sw-block/.private/phase/phase-05-log.md

@@ -1,78 +0,0 @@
-# Phase 05 Log
-
-## 2026-03-29
-
-### Opened
-
-`Phase 05` opened as:
-
-- V2 engine planning + Slice 1 ownership core
-
-### Accepted
-
-1. engine module location
-   - `sw-block/engine/replication/`
-
-2. Slice 1 ownership core
-   - stable per-replica sender identity
-   - stable recovery-session identity
-   - sender/session fencing
-   - endpoint / epoch invalidation
-   - ownership registry
-
-3. Slice 1 identity correction
-   - registry now keyed by stable `ReplicaID`
-   - mutable `Endpoint` separated from identity
-   - real changed-`DataAddr` preservation covered by test
-
-4. Slice 1 encapsulation
-   - mutable sender/session authority state no longer exposed directly
-   - snapshot/read-only inspection path in place
-
-5. Slice 2 recovery execution core
-   - connect / handshake / catch-up flow
-   - explicit zero-gap / catch-up / needs-rebuild branching
-   - stale execution rejection during active recovery
-   - bounded catch-up semantics
-   - rebuild execution shell
-
-6. Slice 2 validation
-   - corrected tester summary accepted
-   - `12` ownership tests + `18` recovery tests = `30` total
-   - Slice 2 accepted for progression to Slice 3 planning
-
-7. Slice 3 data / recoverability core
-   - `RetainedHistory` introduced as engine-level recoverability input
-   - history-driven sender APIs added for handshake and rebuild-source selection
-   - trusted-base decision now requires both checkpoint trust and replayable tail
-   - truncation remains a completion gate / protocol boundary
-
-8. Slice 3 validation
-   - corrected tester summary accepted
-   - `12` ownership tests + `18` recovery tests + `18` recoverability tests = `48` total
-   - accepted boundary:
-     - engine proves historical-correctness prerequisites
-     - simulator retains stronger historical reconstruction proof
-   - Slice 3 accepted for progression to Slice 4 planning
-
-9. Slice 4 integration closure
-   - `RecoveryOrchestrator` added as integrated engine entry path
-   - assignment/update-driven recovery is exercised through orchestrator
-   - observability surface added:
-     - `RegistryStatus`
-     - `SenderStatus`
-     - `SessionSnapshot`
-     - `RecoveryLog`
-   - causal recovery logging now covers invalidation, escalation, truncation, completion, rebuild transitions
-
-10. Slice 4 validation
-   - corrected tester summary accepted
-   - `12` ownership tests + `18` recovery tests + `18` recoverability tests + `11` integration tests = `59` total
-   - Slice 4 accepted
-   - `Phase 05` accepted as complete
-
-### Next
-
-1. `Phase 06` planning
-2. broader engine implementation stage
-3. real-engine integration against selected `weed/storage/block*` constraints and failure classes

sw-block/.private/phase/phase-05.md

@@ -1,356 +0,0 @@
-# Phase 05
-
-Date: 2026-03-29
-Status: complete
-Purpose: begin the real V2 engine track under `sw-block/` by moving from prototype proof to the first engine slice
-
-## Why This Phase Exists
-
-The project has now completed:
-
-1. V2 design/FSM closure
-2. V2 protocol/simulator validation
-3. Phase 04 prototype closure
-4. Phase 4.5 evidence hardening
-
-So the next step is no longer:
-
-- extend prototype breadth
-
-The next step is:
-
-- start disciplined real V2 engine work
-
-## Phase Goal
-
-Start the real V2 engine line under `sw-block/` with:
-
-1. explicit engine module location
-2. Slice 1 ownership-core boundaries
-3. first engine ownership-core implementation
-4. engine-side validation tied back to accepted prototype invariants
-
-## Relationship To Previous Phases
-
-`Phase 05` is built on:
-
-- `sw-block/docs/archive/design/v2-engine-readiness-review.md`
-- `sw-block/docs/archive/design/v2-engine-slicing-plan.md`
-- `sw-block/.private/phase/phase-04.md`
-- `sw-block/.private/phase/phase-4.5.md`
-
-This is a new implementation phase.
-
-It is not:
-
-1. more prototype expansion
-2. V1 integration
-3. backend redesign
-
-## Scope
-
-### In scope
-
-1. choose real V2 engine module location under `sw-block/`
-2. define Slice 1 file/module boundaries
-3. write short engine ownership-core spec
-4. start Slice 1 implementation:
-   - stable per-replica sender object
-   - stable recovery-session object
-   - session identity fencing
-   - endpoint / epoch invalidation
-   - ownership registry / sender-group equivalent
-5. add focused engine-side ownership/fencing tests
-
-### Out of scope
-
-1. Smart WAL expansion
-2. full storage/backend redesign
-3. full rebuild-source decision logic
-4. V1 production integration
-5. performance work
-6. full product integration
-
-## Planned Slices
-
-### P0: Engine Planning Setup
-
-1. choose real V2 engine module location under `sw-block/`
-2. define Slice 1 file/module boundaries
-3. write ownership-core spec
-4. map 3-5 acceptance scenarios to Slice 1 expectations
-
-Status:
-
-- accepted
-- engine module location chosen: `sw-block/engine/replication/`
-- Slice 1 boundaries are explicit enough to start implementation
-
-### P1: Slice 1 Ownership Core
-
-1. implement stable per-replica sender object
-2. implement stable recovery-session object
-3. implement sender/session identity fencing
-4. implement endpoint / epoch invalidation
-5. implement ownership registry
-
-Status:
-
-- accepted
-- stable `ReplicaID` is now explicit and separate from mutable `Endpoint`
-- engine registry is keyed by stable identity, not address-shaped strings
-- real changed-`DataAddr` preservation is covered by test
-
-### P2: Slice 1 Validation
-
-1. engine-side tests for ownership/fencing
-2. changed-address case
-3. stale-session rejection case
-4. epoch-bump invalidation case
-5. traceability back to accepted prototype behavior
-
-Status:
-
-- accepted
-- Slice 1 ownership/fencing tests are in place and passing
-- acceptance/gate mapping is strong enough to move to Slice 2
-
-### P3: Slice 2 Planning Setup
-
-1. define Slice 2 boundaries explicitly
-2. distinguish Slice 2 core from carried-forward prototype support
-3. map Slice 2 engine expectations from accepted prototype evidence
-4. prepare Slice 2 validation targets
-
-Status:
-
-- accepted
-- Slice 2 recovery execution core is implemented and validated
-- corrected tester summary accepted:
-  - `12` ownership tests
-  - `18` recovery tests
-  - `30` total
-
-### P4: Slice 3 Planning Setup
-
-1. define Slice 3 boundaries explicitly
-2. connect recovery decisions to real engine recoverability inputs
-3. make trusted-base / rebuild-source decision use real engine data inputs
-4. prepare Slice 3 validation targets
-
-Status:
-
-- accepted
-- Slice 3 data / recoverability core is implemented and validated
-- corrected tester summary accepted:
-  - `12` ownership tests
-  - `18` recovery tests
-  - `18` recoverability tests
-  - `48` total
-- important boundary preserved:
-  - engine proves historical-correctness prerequisites
-  - full historical reconstruction proof remains simulator-side
-
-## Slice 3 Guardrails
-
-Slice 3 is the point where V2 must move from:
-
-- recovery automaton is coherent
-
-to:
-
-- recovery basis is provable
-
-So Slice 3 must stay tight.
-
-### Guardrail 1: No optimistic watermark in place of recoverability proof
-
-Do not accept:
-
-- loose head/tail watermarks
-- "looks retained enough"
-- heuristic recoverability
-
-Slice 3 should prove:
-
-1. why a gap is recoverable
-2. why a gap is unrecoverable
-
-### Guardrail 2: No current extent state pretending to be historical correctness
-
-Do not accept:
-
-- current extent image as substitute for target-LSN truth
-- checkpoint/base state that leaks newer state into older historical queries
-
-Slice 3 should prove historical correctness at the actual recovery target.
-
-### Guardrail 3: No `snapshot + tail` without trusted-base proof
-
-Do not accept:
-
-- "snapshot exists" as sufficient
-
-Require:
-
-1. trusted base exists
-2. trusted base covers the required base state
-3. retained tail can be replayed continuously from that base to the target
-
-If not, recovery must use:
-
-- `FullBase`
-
-### Guardrail 4: Truncation is protocol boundary, not cleanup policy
-
-Do not treat truncation as:
-
-- optional cleanup
-- post-recovery tidying
-
-Treat truncation as:
-
-1. divergent tail removal
-2. explicit safe-boundary restoration
-3. prerequisite for safe `InSync` / recovery completion where applicable
-
-### P5: Slice 4 Planning Setup
-
-1. define Slice 4 boundaries explicitly
-2. connect engine control/recovery core to real assignment/control intent entry path
-3. add engine observability / debug surface for ownership and recovery failures
-4. prepare integration validation against V2-boundary failure classes
-
-Status:
-
-- accepted
-- Slice 4 integration closure is implemented and validated
-- corrected tester summary accepted:
-  - `12` ownership tests
-  - `18` recovery tests
-  - `18` recoverability tests
-  - `11` integration tests
-  - `59` total
-
-## Slice 4 Guardrails
-
-Slice 4 should close integration, not just add an entry point and some logs.
-
-### Guardrail 1: Entry path must actually drive recovery
-
-Do not accept:
-
-- tests that manually push sender/session state while only pretending to use integration entry points
-
-Require:
-
-1. real assignment/control intent entry path
-2. session creation / invalidation / restart triggered through that path
-3. recovery flow driven from that path, not only from unit-level helper calls
-
-### Guardrail 2: Changed-address must survive the real entry path
-
-Do not accept:
-
-- changed-address correctness proven only at local object level
-
-Require:
-
-1. stable `ReplicaID` survives real assignment/update entry path
-2. endpoint update invalidates old session correctly
-3. new recovery session is created correctly on updated endpoint
-
-### Guardrail 3: Observability must show protocol causality
-
-Do not accept:
-
-- only state snapshots
-- only phase dumps
-
-Require observability that can explain:
-
-1. why recovery entered `NeedsRebuild`
-2. why a session was superseded
-3. why a completion or progress update was rejected
-4. why endpoint / epoch change caused invalidation
-
-### Guardrail 4: Failure replay must be explainable
-
-Do not accept:
-
-- a replay that reproduces failure but cannot explain the cause from engine observability
-
-Require:
-
-1. selected failure-class replays through the real entry path
-2. observability sufficient to explain the control/recovery decision
-3. reviewability against key V2-boundary failures
-
-## Exit Criteria
-
-Phase 05 Slice 1 is done when:
-
-1. the real V2 engine module location is chosen
-2. Slice 1 boundaries are explicit
-3. engine ownership core exists under `sw-block/`
-4. engine-side ownership/fencing tests pass
-5. Slice 1 evidence is reviewable against prototype expectations
-
-This bar is now met.
-
-Phase 05 Slice 2 is done when:
-
-1. engine-side recovery execution flow exists
-2. zero-gap / catch-up / needs-rebuild branching is explicit
-3. stale execution is rejected during active recovery
-4. bounded catch-up semantics are enforced in engine path
-5. rebuild execution shell is validated
-
-This bar is now met.
-
-Phase 05 Slice 3 is done when:
-
-1. recoverable vs unrecoverable gap uses real engine recoverability inputs
-2. trusted-base / rebuild-source decision uses real engine data inputs
-3. truncation / safe-boundary handling is tied to real engine state
-4. history-driven engine APIs exist for recovery decisions
-5. Slice 3 validation is reviewable without overclaiming full historical reconstruction
-
-This bar is now met.
-
-Phase 05 Slice 4 is done when:
-
-1. real assignment/control intent entry path exists
-2. changed-address recovery works through the real entry path
-3. observability explains protocol causality, not only state snapshots
-4. selected V2-boundary failures are replayable and diagnosable through engine integration tests
-
-This bar is now met.
-
-## Assignment For `sw`
-
-Phase 05 is now complete.
-
-Next phase:
-
-- `Phase 06` broader engine implementation stage
-
-## Assignment For `tester`
-
-Phase 05 validation is complete.
-
-Next phase:
-
-- `Phase 06` engine implementation validation against real-engine constraints and failure classes
-
-## Management Rule
-
-`Phase 05` should stay narrow.
-
-It should start the engine line with:
-
-1. ownership
-2. fencing
-3. validation
-
-It should not try to absorb later slices early.

sw-block/.private/phase/phase-06-decisions.md

@@ -1,68 +0,0 @@
-# Phase 06 Decisions
-
-## Decision 1: Phase 06 is broader engine implementation, not new design
-
-The protocol shape and engine core contracts were already accepted.
-
-Phase 06 implemented around them.
-
-## Decision 2: Phase 06 must connect to real constraints
-
-This phase explicitly used:
-
-1. `learn/projects/sw-block/` for failure gates and test lineage
-2. `weed/storage/block*` for real implementation constraints
-
-without importing V1 structure as the V2 design template.
-
-## Decision 3: Phase 06 should replace key synchronous conveniences
-
-The accepted Slice 4 convenience flows were sufficient for closure work, but broader engine work required real step boundaries.
-
-This is now satisfied via planner/executor separation.
-
-## Decision 4: Phase 06 ends with a runnable engine stage decision
-
-Result:
-
-- yes, the project now has a broader runnable engine stage that is ready to proceed to real-system integration / product-path work
-
-## Decision 5: Phase 06 P0 is accepted
-
-Accepted scope:
-
-1. adapter/module boundaries
-2. convenience-flow classification
-3. initial real-engine stage framing
-
-## Decision 6: Phase 06 P1 is accepted
-
-Accepted scope:
-
-1. storage/control adapter interfaces
-2. `RecoveryDriver` planner/resource-acquisition layer
-3. full-base and WAL retention resource contracts
-4. fail-closed preconditions on planning paths
-
-## Decision 7: Phase 06 P2 is accepted
-
-Accepted scope:
-
-1. explicit planner/executor split on top of `RecoveryPlan`
-2. executor-owned cleanup symmetry on success/failure/cancellation
-3. plan-bound rebuild execution with no policy re-derivation at execute time
-4. synchronous orchestrator completion helpers remain test-only convenience
-
-## Decision 8: Phase 06 P3 is accepted
-
-Accepted scope:
-
-1. selected real failure classes validated through the engine path
-2. cross-layer engine/storage proof validation
-3. diagnosable failure when proof or resource acquisition cannot be established
-
-## Decision 9: Phase 06 is complete
-
-Next step:
-
-- `Phase 07` real-system integration / product-path decision

sw-block/.private/phase/phase-06-log.md

@@ -1,51 +0,0 @@
-# Phase 06 Log
-
-## 2026-03-30
-
-### Opened
-
-`Phase 06` opened as:
-
-- broader engine implementation stage
-
-### Starting basis
-
-1. `Phase 05`: complete
-2. engine core and integration closure accepted
-3. next work moves from slice proof to broader runnable engine stage
-
-### Accepted
-
-1. Phase 06 P0
-   - adapter/module boundaries defined
-   - convenience flows explicitly classified
-
-2. Phase 06 P1
-   - storage/control adapter surfaces defined
-   - `RecoveryDriver` added as planner/resource-acquisition layer
-   - full-base rebuild now has explicit resource contract
-   - WAL pin contract tied to actual recovery need
-   - driver preconditions fail closed
-
-3. Phase 06 P2
-   - explicit planner/executor split accepted
-   - executor owns release symmetry on success, failure, and cancellation
-   - rebuild execution now consumes plan-bound source/target values
-   - tester final validation accepted with reduced-but-sufficient rebuild failure-path coverage
-
-4. Phase 06 P3
-   - selected real failure classes validated through the engine path
-   - changed-address restart now uses plan cancellation and re-plan flow
-   - stale execution is caught through the executor-managed loop
-   - cross-layer trusted-base / replayable-tail proof path validated end-to-end
-   - rebuild planning failures now clean up sessions and remain diagnosable
-
-### Closed
-
-`Phase 06` closed as complete.
-
-### Next
-
-1. Phase 07 real-system integration / product-path decision
-2. service-slice integration against real control/storage surroundings
-3. first product-path gating decision

sw-block/.private/phase/phase-06.md

@@ -1,193 +0,0 @@
-# Phase 06
-
-Date: 2026-03-30
-Status: complete
-Purpose: move from validated engine slices to the first broader runnable V2 engine stage
-
-## Why This Phase Exists
-
-`Phase 05` established and validated:
-
-1. ownership core
-2. recovery execution core
-3. recoverability/data gating core
-4. integration closure
-
-What still does not exist is a broader engine stage that can run with:
-
-1. real control-plane inputs
-2. real persistence/backing inputs
-3. non-trivial execution loops instead of only synchronous convenience paths
-
-So `Phase 06` exists to turn the accepted engine shape into the first broader runnable engine stage.
-
-Phase 06 must connect the accepted engine core to real control and real storage truth, not just wrap current abstractions with adapters.
-
-## Phase Goal
-
-Build the first broader V2 engine stage without reopening protocol shape.
-
-This phase should focus on:
-
-1. real engine adapters around the accepted core
-2. asynchronous or stepwise execution paths where Slice 4 used synchronous helpers
-3. real retained-history / checkpoint input plumbing
-4. validation against selected real failure classes and real implementation constraints
-
-## Overall Roadmap
-
-Completed:
-
-1. Phase 01-03: design + simulator
-2. Phase 04: prototype closure
-3. Phase 4.5: evidence hardening
-4. Phase 05: engine slice closure
-5. Phase 06: broader engine implementation stage
-
-Next:
-
-1. Phase 07: real-system integration / product-path decision
-
-This roadmap should stay strict:
-
-- no return to broad prototype expansion
-- no uncontrolled engine sprawl
-
-## Scope
-
-### In scope
-
-1. control-plane adapter into `sw-block/engine/replication/`
-2. retained-history / checkpoint adapter into engine recoverability APIs
-3. replacement of synchronous convenience flows with explicit engine steps where needed
-4. engine error taxonomy and observability tightening
-5. validation against selected real failure classes from:
-   - `learn/projects/sw-block/`
-   - `weed/storage/block*`
-
-### Out of scope
-
-1. Smart WAL expansion
-2. full backend redesign
-3. performance optimization as primary goal
-4. V1 replacement rollout
-5. full product integration
-
-## Phase 06 Items
-
-### P0: Engine Stage Plan
-
-Status:
-
-- accepted
-- module boundaries now explicit:
-  - `adapter.go`
-  - `driver.go`
-  - `orchestrator.go` classification
-- convenience flows are now classified as:
-  - test-only convenience wrapper
-  - stepwise engine task
-  - planner/executor split
-
-### P1: Control / History Adapters
-
-Status:
-
-- accepted
-- `StorageAdapter` boundary exists and is exercised by tests
-- full-base rebuild now has a real pin/release contract
-- WAL pinning is tied to actual recovery contract, not loose watermark use
-- planner fails closed on missing sender / missing session / wrong session kind
-
-### P2: Execution Driver
-
-Status:
-
-- accepted
-- executor now owns resource lifecycle on success / failure / cancellation
-- catch-up execution is stepwise and budget-checked per progress step
-- rebuild execution consumes plan-bound source/target values and does not re-derive policy at execute time
-- `CompleteCatchUp` / `CompleteRebuild` remain test-only convenience wrappers
-- tester validation accepted with reduced-but-sufficient rebuild failure-path coverage
-
-### P3: Validation Against Real Failure Classes
-
-Status:
-
-- accepted
-- changed-address restart now validated through planner/executor path with plan cancellation
-- stale epoch/session during active execution now validated through the executor-managed loop
-- cross-layer trusted-base / replayable-tail proof path validated end-to-end
-- rebuild fallback and pin-failure cleanup now fail closed and are diagnosable
-
-## Guardrails
-
-### Guardrail 1: Do not reopen protocol shape
-
-Phase 06 implemented around accepted engine slices and did not reopen:
-
-1. sender/session authority model
-2. bounded catch-up contract
-3. recoverability/truncation boundary
-
-### Guardrail 2: Do not let adapters smuggle V1 structure back in
-
-V1 code and docs remain:
-
-1. constraints
-2. failure gates
-3. integration references
-
-not the V2 architecture template.
-
-### Guardrail 3: Prefer explicit engine steps over synchronous convenience
-
-Key convenience helpers remain test-only. Real engine work now has explicit planner/executor boundaries.
-
-### Guardrail 4: Keep evidence quality high
-
-Phase 06 improved:
-
-1. cross-layer traceability
-2. diagnosability
-3. real-failure validation
-
-without growing protocol surface.
-
-### Guardrail 5: Do not fake storage truth with metadata-only adapters
-
-Phase 06 now requires:
-
-1. trusted base to come from storage-side truth
-2. replayable tail to be grounded in retention state
-3. observable rejection when those proofs cannot be established
-
-## Exit Criteria
-
-Phase 06 is done when:
-
-1. engine has real control/history adapters into the accepted core
-2. engine has real storage/base adapters into the accepted core
-3. key synchronous convenience paths are explicitly classified or replaced by real engine steps where necessary
-4. selected real failure classes are validated against the engine stage
-5. at least one cross-layer storage/engine proof path is validated end-to-end
-6. engine observability remains good enough to explain recovery causality
-
-Status:
-
-- met
-
-## Closeout
-
-`Phase 06` is complete.
-
-It established:
-
-1. a broader runnable engine stage around the accepted Phase 05 core
-2. real planner/executor/resource contracts
-3. validated failure-class behavior through the engine path
-4. diagnosable proof rejection and cleanup behavior
-
-Next step:
-
-- `Phase 07` real-system integration / product-path decision

sw-block/.private/phase/phase-07-decisions.md

@@ -1,119 +0,0 @@
-# Phase 07 Decisions
-
-## Decision 1: Phase 07 is real-system integration, not protocol redesign
-
-The V2 protocol shape, engine core, and broader runnable engine stage are already accepted.
-
-Phase 07 should integrate them into a real-system service slice.
-
-## Decision 2: Phase 07 should make the first product-path decision
-
-This phase should not only integrate a service slice.
-
-It should also decide:
-
-1. what the first product path is
-2. what remains before pre-production hardening
-
-## Decision 3: Phase 07 must preserve accepted V2 boundaries
-
-Phase 07 should preserve:
-
-1. narrow catch-up semantics
-2. rebuild as the formal recovery path
-3. trusted-base / replayable-tail proof boundaries
-4. stable identity / fenced execution / diagnosable failure handling
-
-## Decision 4: Phase 07 P0 service-slice direction is set
-
-Current direction:
-
-1. first service slice = `RF=2` block volume primary + one replica
-2. engine remains in `sw-block/engine/replication/`
-3. current bridge work starts in `sw-block/bridge/blockvol/`
-4. deferred real blockvol-side bridge target = `weed/storage/blockvol/v2bridge/`
-5. stable identity mapping is explicit:
-   - `ReplicaID = <volume-name>/<server-id>`
-6. `blockvol` executes I/O but does not own recovery policy
-
-## Decision 5: Phase 07 P1 is accepted with explicit scope limits
-
-Accepted `P1` coverage is:
-
-1. real reader mapping from `BlockVol` state
-2. real retention hold / release wiring into the flusher retention floor
-3. one real WAL catch-up scan path through `v2bridge`
-4. direct real-adapter tests under `weed/storage/blockvol/v2bridge/`
-
-This acceptance means:
-
-1. the real bridge path is now integrated and evidenced
-2. `P1` is not yet acceptance proof of general post-checkpoint catch-up viability
-
-Not accepted as part of `P1`:
-
-1. snapshot transfer execution
-2. full-base transfer execution
-3. WAL truncation execution
-4. master-side confirmed failover / control-intent integration
-
-## Decision 6: Interim committed-truth limitation remains active
-
-`Phase 07 P1` is accepted with an explicit carry-forward limitation:
-
-1. interim `CommittedLSN = CheckpointLSN` is a service-slice mapping, not final V2 protocol truth
-2. post-checkpoint catch-up semantics are therefore narrower than final V2 intent
-3. later `Phase 07` work must not overclaim this limitation as solved until commit truth is separated from checkpoint truth
-
-## Decision 7: Phase 07 P2 is accepted with scoped replay claims
-
-Accepted `P2` coverage is:
-
-1. real service-path replay for changed-address restart
-2. stale epoch / stale session invalidation through the integrated path
-3. unrecoverable-gap / needs-rebuild replay with diagnosable proof
-4. explicit replay of the post-checkpoint boundary under the interim model
-
-Not accepted as part of `P2`:
-
-1. general integrated engine-driven post-checkpoint catch-up semantics
-2. real control-plane delivery from master heartbeat into the bridge
-3. rebuild execution beyond the already-deferred executor stubs
-
-## Decision 8: Phase 07 now moves to product-path choice, not more bridge-shape proof
-
-With `P0`, `P1`, and `P2` accepted, the next step is:
-
-1. choose the first product path from accepted service-slice evidence
-2. define what remains before pre-production hardening
-3. keep unresolved limits explicit rather than hiding them behind broader claims
-
-## Decision 7: Phase 07 P2 must replay the interim limitation explicitly
-
-`Phase 07 P2` should not only replay happy-path or ordinary failure-path integration.
-
-It should also include one explicit replay where:
-
-1. the live bridge path is exercised after checkpoint truth has advanced
-2. the observed catch-up limitation is diagnosed as a consequence of the interim mapping
-3. the result is not overclaimed as proof of final V2 post-checkpoint catch-up semantics
-
-## Decision 10: Phase 07 P3 is accepted and Phase 07 is complete
-
-The first V2 product path is now explicitly chosen as:
-
-1. `RF=2`
-2. `sync_all`
-3. existing master / volume-server heartbeat path
-4. V2 engine owns recovery policy
-5. `v2bridge` provides real storage truth
-
-This decision is accepted with explicit non-claims:
-
-1. not production-ready
-2. no real master-side control delivery proof yet
-3. no full rebuild execution proof yet
-4. no general post-checkpoint catch-up proof yet
-5. no full integrated engine -> executor -> `v2bridge` catch-up proof yet
-
-Phase 07 is therefore complete, and the next phase is pre-production hardening.

sw-block/.private/phase/phase-07-log.md

@@ -1,63 +0,0 @@
-# Phase 07 Log
-
-## 2026-03-30
-
-### Opened
-
-`Phase 07` opened as:
-
-- real-system integration / product-path decision
-
-### Starting basis
-
-1. `Phase 06`: complete
-2. broader runnable engine stage accepted
-3. next work moves from engine-stage validation to real-system service-slice integration
-
-### Delivered
-
-1. Phase 07 P0
-   - service-slice plan defined
-   - implementation slice proposal delivered
-   - bridge layer introduced as:
-     - `sw-block/bridge/blockvol/` for current bridge work
-     - `weed/storage/blockvol/v2bridge/` as the deferred real integration target
-   - stable identity mapping made explicit:
-     - `ReplicaID = <volume-name>/<server-id>`
-   - engine / blockvol policy boundary made explicit
-   - initial bridge tests delivered (`8`)
-2. Phase 07 P1
-   - real blockvol reader integrated via `weed/storage/blockvol/v2bridge/reader.go`
-   - real pinner integrated via `weed/storage/blockvol/v2bridge/pinner.go`
-   - one real catch-up executor path integrated via `weed/storage/blockvol/v2bridge/executor.go`
-   - direct real-adapter tests delivered in:
-     - `weed/storage/blockvol/v2bridge/bridge_test.go`
-   - accepted with explicit carry-forward:
-     - interim `CommittedLSN = CheckpointLSN` limits post-checkpoint catch-up semantics and is not final V2 commit truth
-     - acceptance is for the real integrated bridge path, not for general post-checkpoint catch-up viability
-3. Phase 07 P2
-   - real service-path failure replay accepted
-   - accepted replay set includes:
-     - changed-address restart
-     - stale epoch / stale session invalidation
-     - unrecoverable-gap / needs-rebuild replay
-     - explicit post-checkpoint boundary replay
-   - evidence kept explicitly scoped:
-     - real `v2bridge` WAL-scan execution proven
-     - general integrated post-checkpoint catch-up semantics not overclaimed under the interim model
-4. Phase 07 P3
-   - product-path decision accepted
-   - first product path chosen as:
-     - `RF=2`
-     - `sync_all`
-     - existing master / volume-server heartbeat path
-     - V2 engine recovery ownership with `v2bridge` real storage truth
-   - pre-hardening prerequisites made explicit
-   - intentional deferrals and non-claims recorded
-   - `Phase 07` completed
-
-### Next
-
-1. Phase 08 pre-production hardening
-2. real master/control delivery integration
-3. integrated catch-up / rebuild execution closure

sw-block/.private/phase/phase-07.md

@@ -1,220 +0,0 @@
-# Phase 07
-
-Date: 2026-03-30
-Status: complete
-Purpose: connect the broader runnable V2 engine stage to a real-system service slice and decide the first product path
-
-## Why This Phase Exists
-
-`Phase 06` completed the broader runnable engine stage:
-
-1. planner/executor/resource contracts are real
-2. selected real failure classes are validated through the engine path
-3. cross-layer trusted-base / replayable-tail proof path is validated
-
-What still does not exist is a real-system slice where the engine runs inside actual service boundaries with real control/storage surroundings.
-
-So `Phase 07` exists to answer:
-
-1. how the engine runs as a real subsystem
-2. what the first product path should be
-3. what integration risks remain before pre-production hardening
-
-## Phase Goal
-
-Establish a real-system integration slice for the V2 engine and make the first product-path decision without reopening protocol shape.
-
-## Scope
-
-### In scope
-
-1. service-slice integration around `sw-block/engine/replication/`
-2. real control-plane / lifecycle entry path into the engine
-3. real storage-side adapter hookup into existing system boundaries
-4. selected real-system failure replay and diagnosis
-5. explicit product-path decision framing
-
-### Out of scope
-
-1. broad performance optimization
-2. Smart WAL expansion
-3. full V1 replacement rollout
-4. broad backend redesign
-5. production rollout itself
-
-## Phase 07 Items
-
-### P0: Service-Slice Plan
-
-1. define the first real-system service slice that will host the engine
-2. define adapter/module boundaries at the service boundary
-3. choose the concrete integration path to exercise first
-4. identify which current adapters are still mock/test-only and must be replaced first
-5. make the first-slice identity/epoch mapping explicit
-6. treat `blockvol` as execution backend only, not recovery-policy owner
-
-Status:
-
-- delivered
-- planning artifact:
-  - `sw-block/docs/archive/design/phase-07-service-slice-plan.md`
-- implementation slice proposal:
-  - engine core: `sw-block/engine/replication/`
-  - bridge adapters: `sw-block/bridge/blockvol/`
-  - real blockvol integration target: `weed/storage/blockvol/v2bridge/` (`P1`)
-- adapter replacement order:
-  - `control_adapter.go` (`P0`) done
-  - `storage_adapter.go` (`P0`) done
-  - `executor_bridge.go` (`P1`) deferred
-  - `observe_adapter.go` (`P1`) deferred
-- first-slice identity mapping is explicit:
-  - `ReplicaID = <volume-name>/<server-id>`
-  - not derived from any address field
-- engine / blockvol boundary is explicit:
-  - bridge maps intent and state
-  - `blockvol` executes I/O
-  - `blockvol` does not own recovery policy
-- service-slice validation gaps called out for `P1`:
-  - real blockvol field mapping
-  - real pin/release lifecycle against reclaim/GC
-  - assignment timing vs engine session lifecycle
-  - executor bridge into real WAL/snapshot work
-
-### P1: Real Entry-Path Integration
-
-1. connect real control/lifecycle events into the engine entry path
-2. connect real storage/base/recoverability signals into the engine adapters
-3. preserve accepted engine authority/execution/recoverability contracts
-
-Status:
-
-- accepted
-- real integration now established for:
-  - reader via `weed/storage/blockvol/v2bridge/reader.go`
-  - pinner via `weed/storage/blockvol/v2bridge/pinner.go`
-  - catch-up executor path via `weed/storage/blockvol/v2bridge/executor.go`
-- direct real-adapter tests now exist in:
-  - `weed/storage/blockvol/v2bridge/bridge_test.go`
-- accepted scope is explicit:
-  - real reader
-  - real retention hold / release
-  - real WAL catch-up scan path
-  - direct real bridge evidence for the integrated path
-- still deferred:
-  - `TransferSnapshot`
-  - `TransferFullBase`
-  - `TruncateWAL`
-  - control intent from confirmed failover / master-side integration
-- carry-forward limitation:
-  - under interim `CommittedLSN = CheckpointLSN`, this slice proves a real bridge path, not general post-checkpoint catch-up viability
-  - post-checkpoint catch-up semantics therefore remain narrower than final V2 intent and do not represent final V2 commit semantics
-
-### P2: Real-System Failure Replay
-
-1. replay selected real failure classes against the integrated service slice
-2. confirm diagnosability from logs/status
-3. identify any remaining mismatch between engine-stage assumptions and real system behavior
-
-Status:
-
-- accepted
-- real service-path replay now accepted for:
-  - changed-address restart
-  - stale epoch / stale session invalidation
-  - unrecoverable-gap / needs-rebuild replay
-  - explicit post-checkpoint boundary replay under the interim model
-- accepted with scoped limitation:
-  - real `v2bridge` WAL-scan execution is proven
-  - full integrated engine-driven catch-up semantics are not overclaimed under interim `CommittedLSN = CheckpointLSN`
-- control-plane delivery remains simulated via direct `AssignmentIntent` construction
-- carry-forward remains explicit:
-  - post-checkpoint catch-up semantics are still narrower than final V2 intent
-
-### P3: Product-Path Decision
-
-1. choose the first product path for V2
-2. define what remains before pre-production hardening
-3. record what is still intentionally deferred
-
-Status:
-
-- accepted
-- first product path chosen:
-  - `RF=2`
-  - `sync_all`
-  - existing master / volume-server heartbeat path
-  - V2 engine owns recovery policy
-  - `v2bridge` provides real storage truth
-- proposal is evidence-grounded and explicitly bounded by accepted `P0/P1/P2` evidence
-- pre-hardening prerequisites are explicit:
-  - real master control delivery
-  - full integrated engine -> executor -> `v2bridge` catch-up chain
-  - separation of committed truth from checkpoint truth
-  - rebuild execution (`snapshot` / `full-base` / `truncation`)
-  - pinner / flusher behavior under concurrent load
-- intentionally deferred:
-  - `RF>2`
-  - Smart WAL optimizations
-  - `best_effort` background recovery
-  - performance tuning
-  - full V1 replacement
-- non-claims remain explicit:
-  - not production-ready
-  - no end-to-end rebuild proof yet
-  - no general post-checkpoint catch-up proof
-  - no real master heartbeat/control delivery proof yet
-  - no full integrated engine -> executor -> `v2bridge` catch-up proof yet
-
-## Guardrails
-
-### Guardrail 1: Do not re-import V1 structure as the design owner
-
-Use `weed/storage/block*` and `learn/projects/sw-block/` as constraints and validation sources, not as the architecture template.
-
-### Guardrail 2: Keep catch-up narrow and rebuild explicit
-
-Do not use integration work as an excuse to widen catch-up semantics or blur rebuild as the formal recovery path.
-
-### Guardrail 3: Prefer real entry paths over test-only wrappers
-
-The integrated slice should exercise real service boundaries, not only internal engine helpers.
-
-### Guardrail 4: Observability must explain causality
-
-Integrated logs/status must explain:
-
-1. why rebuild was required
-2. why proof was rejected
-3. why execution was cancelled or invalidated
-4. why a product-path integration failed
-
-### Guardrail 5: Stable identity must not collapse back to address shape
-
-For the first slice, `ReplicaID` must be derived from master/block-registry identity, not current endpoint addresses.
-
-### Guardrail 6: `blockvol` executes I/O but does not own recovery policy
-
-The service bridge may translate engine decisions into concrete blockvol actions, but it must not re-decide:
-
-1. zero-gap / catch-up / rebuild
-2. trusted-base validity
-3. replayable-tail sufficiency
-4. rebuild fallback requirement
-
-## Exit Criteria
-
-Phase 07 is done when:
-
-1. one real-system service slice is integrated with the engine
-2. selected real-system failure classes are replayed through that slice
-3. diagnosability is sufficient for service-slice debugging
-4. the first product path is explicitly chosen
-5. the remaining work to pre-production hardening is clear
-
-## Assignment For `sw`
-
-Next tasks move to `Phase 08`.
-
-## Assignment For `tester`
-
-Next tasks move to `Phase 08`.

sw-block/.private/phase/phase-08-decisions.md

@@ -1,187 +0,0 @@
-# Phase 08 Decisions
-
-## Decision 1: Phase 08 is pre-production hardening, not protocol rediscovery
-
-The accepted V2 product path from `Phase 07` is the basis.
-
-`Phase 08` should harden that path rather than reopen accepted protocol shape.
-
-## Decision 2: The first hardening priorities are control delivery and execution closure
-
-The most important remaining gaps are:
-
-1. real master/control delivery into the bridge/engine path
-2. integrated engine -> executor -> `v2bridge` catch-up execution closure
-3. first rebuild execution path for the chosen product path
-
-## Decision 3: Carry-forward limitations remain explicit until closed
-
-Phase 08 must keep explicit:
-
-1. committed truth is still not separated from checkpoint truth
-2. rebuild execution is still incomplete
-3. current control delivery is still simulated
-
-## Decision 4: Phase 08 P0 is accepted
-
-The hardening plan is sufficiently specified to begin implementation work.
-
-In particular, `P0` now fixes:
-
-1. the committed-truth gate decision requirement
-2. the unified replay requirement after control and execution closure
-3. the need for at least one real failover / reassignment validation target
-## Decision 5: The committed-truth limitation must become a hardening gate
-
-Phase 08 must explicitly decide one of:
-
-1. `CommittedLSN != CheckpointLSN` separation is mandatory before a production-candidate phase
-2. the first candidate path is intentionally bounded to the currently proven pre-checkpoint replay behavior
-
-It must not remain only a documented carry-forward.
-
-## Decision 6: Unified-path replay is required after control and execution closure
-
-Once real control delivery and integrated execution closure land, `Phase 08` must replay the accepted failure-class set again on the unified live path.
-
-This prevents independent closure of:
-
-1. control delivery
-2. execution closure
-
-without proving that they behave correctly together.
-
-## Decision 7: Real failover / reassignment validation is mandatory for the chosen path
-
-Because the chosen product path depends on the existing master / volume-server heartbeat path, at least one real failover / promotion / reassignment cycle must be a named hardening target in `Phase 08`.
-
-## Decision 8: Phase 08 should reuse the existing Seaweed control/runtime path, not invent a new one
-
-For the first hardening path, implementation should preferentially reuse:
-
-1. existing master / heartbeat / assignment delivery
-2. existing volume-server assignment receive/apply path
-3. existing `blockvol` runtime and `v2bridge` storage/runtime hooks
-
-This reuse is about:
-
-1. control-plane reality
-2. storage/runtime reality
-3. execution-path reality
-
-It is not permission to inherit old policy semantics as V2 truth.
-
-The hard rule remains:
-
-1. engine owns recovery policy
-2. bridge translates confirmed control/storage truth
-3. `blockvol` executes I/O
-
-## Decision 9: Phase 08 P1 is accepted with explicit scope limits
-
-Accepted `P1` coverage is:
-
-1. real `ProcessAssignments()` path drives V2 engine sender/session state change
-2. stable remote `ReplicaID` is derived from `ServerID`, not address
-3. address change preserves sender identity through the live control path
-4. stale epoch/session invalidation occurs through the live control path
-5. missing `ServerID` fails closed
-
-Not accepted as part of `P1`:
-
-1. full end-to-end gRPC heartbeat delivery proof
-2. integrated catch-up execution through the live path
-3. rebuild execution through the live path
-4. final local stable identity beyond transport-shaped `listenAddr`
-
-## Decision 10: Phase 08 P2 is accepted as real execution closure
-
-Accepted `P2` coverage is:
-
-1. `CommittedLSN` is separated from `CheckpointLSN` on the chosen `sync_all` path
-2. catch-up is proven as one live chain:
-   - engine plan
-   - engine executor
-   - `v2bridge`
-   - real `blockvol` I/O
-   - completion
-   - cleanup
-3. rebuild is proven as one live chain for the delivered path
-4. cleanup/pin release is asserted after execution
-
-Residual non-blocking scope notes:
-
-1. `CatchUpStartLSN` is not directly asserted in tests
-2. rebuild source variants are not all forced and individually asserted
-
-## Decision 11: Phase 08 now moves to unified hardening validation
-
-With `P1` and `P2` accepted, the next required step is:
-
-1. replay the accepted failure-class set again on the unified live path
-2. validate at least one real failover / reassignment cycle
-3. validate concurrent retention/pinner behavior
-4. make the committed-truth gate decision explicit for the chosen candidate path
-
-## Decision 12: Phase 08 P3 is accepted as unified hardening validation
-
-Accepted `P3` coverage is:
-
-1. replay of the accepted failure-class set on the unified `P1` + `P2` live path
-2. at least one real failover / reassignment cycle through the live control path
-3. one true simultaneous-overlap retention/pinner safety proof
-4. stronger causality assertions for invalidation, escalation, catch-up, and completion
-
-## Decision 13: The committed-truth gate is decided for the chosen candidate path
-
-For the chosen `RF=2 sync_all` candidate path:
-
-1. `CommittedLSN = WALHeadLSN`
-2. `CheckpointLSN` remains the durable base-image boundary
-3. this separation is accepted as sufficient for the candidate-path hardening boundary
-
-This decision is intentionally scoped:
-
-1. it is accepted for the chosen candidate path
-2. it is not yet a blanket truth for every future path or durability mode
-
-## Decision 14: Phase 08 P4 is candidate-path judgment, not broad new engineering expansion
-
-`P4` should close `Phase 08` by producing one explicit candidate-path judgment.
-
-Its main output is not more isolated engineering progress, but:
-
-1. a bounded candidate-path statement
-2. an evidence-to-claim mapping from accepted `P1` / `P2` / `P3` results
-3. an explicit list of accepted bounds, remaining deferrals, and production blockers
-
-`P4` may include small closure work if needed to make the candidate statement coherent, but it should not reopen protocol design or grow into another broad hardening slice.
-
-## Decision 15: Phase 08 P4 is accepted as candidate package closure
-
-Accepted `P4` coverage is:
-
-1. one explicit candidate package for the chosen `RF=2 sync_all` path
-2. candidate-safe claims mapped to accepted `P1` / `P2` / `P3` evidence
-3. explicit bounds, deferred items, and production blockers
-4. committed-truth decision scoped to the chosen candidate path
-5. module/package boundary summary for the next heavy engineering phase
-
-Accepted judgment:
-
-1. candidate-safe-with-bounds
-2. not production-ready
-
-## Decision 16: Phase 08 is closed and the next heavy phase is production execution closure
-
-With `P0` through `P4` accepted, `Phase 08` is closed.
-
-The next phase should not be a light packaging-only round.
-It should begin with:
-
-1. `Phase 09: Production Execution Closure`
-2. `P0` planning for:
-   - real `TransferFullBase`
-   - real `TransferSnapshot`
-   - real `TruncateWAL`
-   - stronger live runtime execution ownership

sw-block/.private/phase/phase-08-log.md

@@ -1,414 +0,0 @@
-# Phase 08 Log
-
-## 2026-03-31
-
-### Opened
-
-`Phase 08` opened as:
-
-- pre-production hardening
-
-### Starting basis
-
-1. `Phase 07`: complete
-2. first V2 product path chosen
-3. remaining gaps are integration and hardening gaps, not protocol-discovery gaps
-
-### Next
-
-1. Phase 08 P0 accepted
-2. Phase 08 P1 accepted
-3. Phase 08 P2 accepted
-4. Phase 08 P3 hardening validation on the unified live path
-5. Phase 08 P4 candidate package closure accepted
-6. Phase 08 closeout bookkeeping complete
-7. next: open Phase 09 P0 for production execution closure planning
-
-### P3 Technical Pack
-
-Purpose:
-
-- provide the minimum design/algo/test detail needed to execute `P3`
-- reuse accepted `P1` / `P2` live-path closure
-- avoid broad scenario growth or repeated proof of already accepted mechanics
-
-#### Design / algo focus
-
-`P3` is not another execution-closure slice.
-It assumes these are already accepted on the chosen path:
-
-- real control delivery
-- real catch-up one-chain closure
-- real rebuild one-chain closure
-
-What `P3` adds is hardening evidence on top of that live path:
-
-1. replay accepted failure classes again on the unified path
-2. prove one real failover / reassignment cycle
-3. prove one overlapping retention/pinner safety case
-4. produce one explicit committed-truth gate decision
-
-Key algorithm rules for `P3`:
-
-- control truth remains primary:
-  - failover / reassignment is driven by new assignment / epoch truth
-  - storage/runtime must not invent role changes
-- recovery choice remains engine-owned:
-  - engine chooses `zero_gap` / `catchup` / `needs_rebuild`
-  - bridge and `blockvol` execute what the engine already decided
-- overlapping recovery must remain fail-closed:
-  - retained floor = minimum active retention requirement
-  - stale or cancelled plan must release its hold
-  - a new authoritative plan must not inherit leaked resources from an old one
-- committed-truth gate must be output, not discussed informally:
-  - either the chosen candidate path is accepted with current committed/checkpoint semantics
-  - or the next phase is blocked on further separation/bounding work
-
-#### Validation matrix
-
-Use one compact replay matrix rather than many near-duplicate tests.
-
-1. Changed-address restart
-   - trigger: address refresh / reassignment while prior identity is preserved
-   - expected: old session invalidated, same logical `ReplicaID`, new recovery starts cleanly
-   - assert:
-     - no stale session mutation
-     - no leaked pins
-     - logs show why identity stayed and session changed
-
-2. Stale epoch / stale session
-   - trigger: epoch bump during or before recovery continuation
-   - expected: stale execution loses authority immediately
-   - assert:
-     - old session cannot mutate
-     - replacement assignment/session becomes the only live authority
-     - logs show invalidation reason
-
-3. Unrecoverable gap / needs-rebuild
-   - trigger: replica falls behind retained WAL
-   - expected: engine chooses `needs_rebuild`, rebuild path executes or is prepared according to accepted boundary
-   - assert:
-     - no catch-up overclaim
-     - correct rebuild source/result logged
-     - no leaked pins after completion/failure
-
-4. Post-checkpoint boundary behavior
-   - trigger: replica state around checkpoint / committed boundary
-   - expected: classification and execution match the chosen candidate-path semantics
-   - assert:
-     - chosen path does not overclaim beyond the accepted boundary
-     - committed/checkpoint truth used here matches the explicit gate decision
-
-#### Required extra cases
-
-Besides the replay matrix, `P3` should add only two new validation cases:
-
-1. One real failover / promotion / reassignment cycle
-   - primary change or reassignment through the live control path
-   - verify old authority dies, new authority starts, recovery resumes/starts correctly
-
-2. One true simultaneous-overlap retention/pinner case
-   - two live recovery holds coexist before the earlier one is released
-   - verify:
-     - minimum retention floor is respected while both are live
-     - releasing one hold leaves the other hold still contributing the correct floor
-     - released/cancelled plan stops contributing to retention floor
-     - final hold count returns to zero
-
-#### Expected evidence
-
-For each accepted `P3` case, prefer explicit evidence blocks:
-
-- entry truth:
-  - assignment / epoch / role that started the case
-- engine result:
-  - selected outcome or invalidation result
-- execution result:
-  - completion / cancel / failure
-- cleanup result:
-  - `ActiveHoldCount() == 0`
-  - no surviving active session when case should be closed
-- observability result:
-  - logs explain:
-    - why control truth changed
-    - why session changed
-    - why catch-up vs rebuild happened
-    - why execution completed / failed / cancelled
-
-#### Efficient test plan
-
-Keep `P3` small and high-signal:
-
-- one unified replay test package or compact matrix
-- one real failover-cycle test
-- one overlapping-retention test
-- one explicit gate-decision record in delivery / phase status
-
-Avoid:
-
-- re-proving isolated `P2` one-chain mechanics
-- broad combinatorial growth across many replicas / roles / timing permutations
-- turning `P3` into another protocol-design slice
-
-### P4 Technical Pack
-
-Purpose:
-
-- provide the minimum design/algo/test detail needed to close `Phase 08`
-- convert accepted `P1` / `P2` / `P3` evidence into one candidate-path judgment
-- keep `P4` as a closure slice, not another broad engineering slice
-
-#### Delivery sequence
-
-Use this order:
-
-1. `sw` develops the candidate package
-2. `architect` reviews code/claim shape before tester time is spent
-3. `tester` validates the evidence-to-claim mapping
-4. `manager` records the final phase/accounting decision
-
-Do not collapse these roles:
-
-- `sw` builds the candidate statement and supporting artifacts
-- `architect` checks whether the resulting package has obvious semantic, scope, or evidence-shape problems before tester validation
-- `tester` checks whether every claim is actually supported
-- `manager` decides acceptance/bookkeeping after architect + tester feedback
-
-Recommended handoff gate before tester:
-
-- if architect finds obvious overclaim, missing evidence mapping, or broken candidate shape, return to `sw` first
-- do not spend tester time on a package that is clearly not ready
-
-#### Design / algo focus
-
-`P4` should not introduce new protocol shape.
-It consumes already accepted results:
-
-- `P1`: real control delivery
-- `P2`: real execution closure
-- `P3`: unified hardening validation
-
-The main design task is to classify the chosen path into three buckets:
-
-1. candidate-safe
-   - supported by accepted evidence
-   - allowed to appear in the candidate statement
-2. intentionally bounded
-   - accepted only within narrow limits
-   - must appear as explicit candidate bounds
-3. deferred or blocking
-   - not yet supported enough
-   - must not be implied as candidate-ready
-
-Algorithmically, `P4` is a classification/output slice:
-
-- no new recovery FSM
-- no new identity model
-- no new rebuild policy
-- no new durability model
-
-It should only:
-
-- map accepted evidence to accepted candidate claims
-- map residual limitations to explicit bounds or blockers
-- separate candidate readiness from production readiness
-
-#### Required output artifacts
-
-`sw` should produce exactly these artifacts:
-
-1. Candidate statement
-   - what the chosen `RF=2 sync_all` path is allowed to claim
-
-2. Evidence-to-claim map
-   - each candidate claim points to accepted evidence from `P1` / `P2` / `P3`
-
-3. Bound list
-   - explicit candidate-safe bounds, for example:
-     - chosen path only
-     - chosen durability mode only
-     - accepted rebuild coverage only
-
-4. Deferred / blocking list
-   - what remains outside the candidate path
-   - what still blocks production readiness
-
-#### Candidate statement shape
-
-Keep the candidate statement short and structured.
-It should answer only:
-
-1. What path is the candidate?
-2. What is proven for that path?
-3. What is intentionally bounded for that path?
-4. What is still deferred or blocking?
-
-Good pattern:
-
-- candidate path:
-  - `RF=2 sync_all` on the accepted master/heartbeat control path
-- proven:
-  - real control delivery
-  - real catch-up closure
-  - real rebuild closure for accepted coverage
-  - unified replay and failover validation
-- bounded:
-  - only the chosen path / mode
-  - only accepted rebuild/source coverage
-- not yet claimed:
-  - general future path/mode truth
-  - production readiness
-
-#### Candidate statement template
-
-Use this exact structure for the `P4` delivery statement:
-
-1. Candidate path
-   - The first candidate path is:
-     - `<path / topology / durability mode>`
-
-2. Candidate-safe claims
-   - The candidate path is supported for:
-     - `<claim 1>` — evidence: `<P1/P2/P3 reference>`
-     - `<claim 2>` — evidence: `<P1/P2/P3 reference>`
-     - `<claim 3>` — evidence: `<P1/P2/P3 reference>`
-
-3. Explicit bounds
-   - This candidate statement is intentionally bounded to:
-     - `<bound 1>`
-     - `<bound 2>`
-     - `<bound 3>`
-
-4. Deferred or blocking items
-   - Not yet claimed as candidate-safe:
-     - `<deferred item 1>`
-     - `<deferred item 2>`
-   - Still blocking production readiness:
-     - `<blocker 1>`
-     - `<blocker 2>`
-
-5. Committed-truth decision
-   - For this candidate path:
-     - `<committed-truth decision>`
-   - Scope:
-     - `<why this does not automatically generalize>`
-
-6. Overall judgment
-   - Judgment:
-     - `<candidate-safe / candidate-safe-with-bounds / not-yet-candidate>`
-   - Reason:
-     - `<one short paragraph tying evidence to judgment>`
-
-When `sw` fills this template:
-
-- every positive claim must carry an evidence reference
-- every important missing area must appear either under:
-  - explicit bounds
-  - deferred
-  - blockers
-- avoid prose that mixes candidate judgment with production-readiness language
-
-#### Assignment template
-
-Use this template when assigning `P4` work to `sw`:
-
-1. Goal
-   - Build the `P4` candidate package for the chosen path.
-
-2. Required outputs
-   - candidate statement
-   - evidence-to-claim mapping
-   - explicit bounds list
-   - deferred / blocking list
-   - committed-truth decision statement
-
-3. Hard rules
-   - no new protocol redesign
-   - no broad scope growth without candidate impact
-   - every positive claim must map to accepted `P1` / `P2` / `P3` evidence
-   - do not mix candidate readiness with production readiness
-
-4. Delivery order
-   - first hand to architect review
-   - only after architect review passes, hand to tester validation
-   - manager records final acceptance/bookkeeping last
-
-5. Reject before handoff if
-   - evidence-to-claim mapping is incomplete
-   - important limitations are not classified as bounded / deferred / blocking
-   - claims exceed accepted evidence
-
-Use this template when assigning `P4` validation to `tester`:
-
-1. Goal
-   - Validate that the candidate package is fully supported by accepted evidence.
-
-2. Validate
-   - each claim has accepted evidence
-   - each bound/deferred/blocker is explicit
-   - committed-truth decision stays scoped correctly
-   - no candidate-to-production overclaim exists
-
-3. Output
-   - pass/fail on each candidate claim group
-   - findings on unsupported claims, missing bounds, or hidden blockers
-
-#### Tester validation checklist
-
-`tester` should validate:
-
-1. every positive candidate claim has accepted evidence
-2. every important limitation appears in either:
-   - bounded
-   - deferred
-   - blocking
-3. no accepted evidence is stretched into a broader product claim
-4. committed-truth decision stays scoped to the chosen candidate path
-5. candidate readiness is not confused with production readiness
-
-#### Architect review focus
-
-`architect` should review only:
-
-1. semantic correctness of the candidate statement
-2. whether the evidence-to-claim mapping is honest
-3. whether bounds are explicit enough to prevent future drift
-4. whether any hidden overclaim remains
-
-This review should not reopen already accepted `P1` / `P2` / `P3` mechanics unless the candidate statement contradicts them.
-
-#### Efficient test / evidence plan
-
-`P4` should mostly reuse accepted evidence rather than add new broad tests.
-
-Preferred work:
-
-- collect accepted evidence references
-- compress them into candidate-safe claims
-- write one explicit residual-gap list
-
-Only add new code/tests if a small missing blocker prevents a coherent candidate statement.
-
-Avoid:
-
-- large new replay matrices
-- new protocol experiments
-- broad implementation growth without candidate impact
-
-### Closeout bookkeeping
-
-Manager follow-up after `P4` acceptance found only a minor bookkeeping concern:
-
-- ensure `phase-08.md` is explicitly closed before treating `Phase 09` as opened
-
-Closeout check:
-
-1. `phase-08.md` is `Status: complete`
-2. `P4` is recorded as accepted
-3. `Phase-close note` points to `Phase 09: Production Execution Closure`
-4. `phase-08-decisions.md` records `Decision 16`
-
-Final bookkeeping judgment:
-
-- `Phase 08` is closed
-- `Phase 09 P0` is the active next planning/engineering package

sw-block/.private/phase/phase-08.md

@@ -1,535 +0,0 @@
-# Phase 08
-
-Date: 2026-03-31
-Status: complete
-Purpose: convert the accepted Phase 07 product path into a pre-production-hardening program without reopening accepted V2 protocol shape
-
-## Why This Phase Exists
-
-`Phase 07` completed:
-
-1. a real service-slice integration around the V2 engine
-2. real storage-truth bridge evidence through `v2bridge`
-3. selected real-system failure replay
-4. the first explicit product-path decision
-
-What still does not exist is a pre-production-ready system path. The remaining work is no longer protocol discovery. It is closing the operational and integration gaps between the accepted product path and a hardened deployment candidate.
-
-## Phase Goal
-
-Harden the first accepted V2 product path until the remaining gap to a production candidate is explicit, bounded, and implementation-driven.
-
-This phase doc is the canonical hardening contract for `sw` and `tester`.
-Use `phase-08-log.md` for deeper engineering process, alternatives, and implementation detail.
-
-Algorithm note:
-
-- the accepted V2 algorithm / protocol shape is treated as fixed for this phase
-- remaining work is engineering closure over real Seaweed/V1 runtime paths under V2 boundaries
-- do not reopen protocol design unless a live contradiction is found
-
-## Scope
-
-### In scope
-
-1. real master/control delivery into the engine service path
-2. integrated engine -> executor -> `v2bridge` execution closure
-3. rebuild execution closure for the accepted product path
-4. operational/debuggability hardening
-5. concurrency/load validation around retention and recovery
-
-### Out of scope
-
-1. new protocol redesign
-2. `RF>2` coordination
-3. Smart WAL optimization work
-4. broad performance tuning beyond validation needed for hardening
-5. full V1 replacement rollout
-
-## Phase 08 Items
-
-### P0: Hardening Plan
-
-1. convert the accepted `Phase 07` product path into a hardening plan
-2. define the minimum pre-production gates
-3. order the remaining integration closures by risk
-4. make an explicit gate decision on committed truth vs checkpoint truth:
-   - either separate `CommittedLSN` from `CheckpointLSN` before a production-candidate phase
-   - or explicitly bound the first candidate path to the currently proven pre-checkpoint replay behavior
-
-Status:
-
-- planning package accepted in this phase doc
-- first hardening priorities are fixed as:
-  - real master/control delivery
-  - integrated engine -> executor -> `v2bridge` catch-up execution chain
-  - first rebuild execution path
-- the committed-truth carry-forward is now a required hardening gate, not just a note:
-  - either separate `CommittedLSN` from `CheckpointLSN` before a production-candidate phase
-  - or explicitly bound the first candidate path to the currently proven pre-checkpoint replay behavior
-- at least one real failover / promotion / reassignment cycle is a required hardening target
-- once `P1` and `P2` land, the accepted failure-class set must be replayed again on the newly unified live path
-- the validation oracle for `Phase 08` is expected to reject overclaiming around:
-  - catch-up semantics
-  - rebuild execution
-  - master/control delivery
-  - candidate-path readiness vs production readiness
-- accepted
-
-Reference:
-
-- `sw-block/docs/archive/design/phase-08-engine-skeleton-map.md` is the implementation-side skeleton map for this phase
-- it is subordinate to `sw-block/design/v2-protocol-truths.md` and this `phase-08.md`; use it for module layout, execution order, interim fields, hard gates, and reuse guidance
-
-### P1: Real Control Delivery
-
-1. connect real master/heartbeat assignment delivery into the bridge
-2. replace direct `AssignmentIntent` construction for the first live path
-3. preserve stable identity and fenced authority through the real control path
-4. include at least one real failover / promotion / reassignment validation target on the chosen `sync_all` path
-
-Technical focus:
-
-- keep the control-path split explicit:
-  - master confirms assignment / epoch / role
-  - bridge translates confirmed control truth into engine intent
-  - engine owns sender/session/recovery policy
-  - `blockvol` does not re-decide recovery policy
-- preserve the identity rule through the live path:
-  - `ReplicaID = <volume>/<server>`
-  - endpoint change updates location but must not recreate logical identity
-- preserve the fencing rule through the live path:
-  - stale epoch must invalidate old authority
-  - stale session must not mutate current lineage
-  - address change must invalidate the old live session before the new path proceeds
-- treat failover / promotion / reassignment as control-truth events first, not storage-side heuristics
-
-Implementation route (`reuse map`):
-
-- reuse directly as the first hardening carrier:
-  - `weed/server/master_grpc_server.go`
-  - `weed/server/volume_grpc_client_to_master.go`
-  - `weed/server/volume_server_block.go`
-  - `weed/server/master_block_registry.go`
-  - `weed/server/master_block_failover.go`
-- reuse as storage/runtime execution reality:
-  - `weed/storage/blockvol/blockvol.go`
-  - `weed/storage/blockvol/replica_apply.go`
-  - `weed/storage/blockvol/replica_barrier.go`
-  - `weed/storage/blockvol/v2bridge/`
-- preserve the V2 boundary while reusing these files:
-  - reuse transport/control/runtime reality
-  - do not inherit old policy semantics as V2 truth
-  - keep engine as the recovery-policy owner
-  - keep `blockvol` as the I/O executor
-
-Validation focus:
-
-- prove live assignment delivery into the bridge/engine path
-- prove stable `ReplicaID` across address refresh on the live path
-- prove stale epoch / stale session invalidation through the live path
-- prove at least one real failover / promotion / reassignment cycle on the chosen `sync_all` path
-- prove the resulting logs explain:
-  - why reassignment happened
-  - why a session was invalidated
-  - which epoch / identity / endpoint drove the transition
-
-Reject if:
-
-- address-shaped identity reappears anywhere in the control path
-- bridge starts re-deriving catch-up vs rebuild policy from convenience inputs
-- old epoch or old session can still mutate after the new control truth arrives
-- failover / reassignment is claimed without a real replay target
-- delivery claims general production readiness rather than control-path closure
-
-Status:
-
-- accepted
-- real assignment delivery into the V2 path is now proven through `ProcessAssignments()`
-- accepted evidence includes:
-  - live assignment -> engine sender/session creation
-  - stable remote `ReplicaID = <volume>/<ServerID>`
-  - address-change identity preservation through the live path
-  - stale epoch/session invalidation through the live path
-  - fail-closed skip on missing `ServerID`
-- accepted with explicit carry-forwards:
-  - `localServerID = listenAddr` remains transport-shaped for local identity
-  - heartbeat -> `ProcessAssignments()` is proven, but not full end-to-end gRPC delivery
-  - integrated catch-up execution is not yet proven through the live path
-  - rebuild execution remains deferred
-  - `CommittedLSN = CheckpointLSN` remains unresolved
-
-### P2: Execution Closure
-
-1. close the live engine -> executor -> `v2bridge` execution chain
-2. make catch-up execution evidence integrated rather than split across layers
-3. close the first rebuild execution path required by the product path
-
-Technical focus:
-
-- keep execution ownership explicit:
-  - engine plans and owns recovery state transitions
-  - engine executor drives stepwise execution
-  - `v2bridge` translates execution requests into real blockvol work
-  - `blockvol` performs I/O only
-- prove catch-up as one real path:
-  - accepted control delivery
-  - real retained-history input
-  - real WAL retention pin
-  - real WAL scan / progress return
-  - real session completion
-- choose the narrowest rebuild closure required by the current product path:
-  - first real `full-base` rebuild path is preferred
-  - `snapshot + tail` can remain later unless needed by the chosen path
-- keep resource ownership fail-closed:
-  - pin acquisition before execution
-  - release on success
-  - release on cancel / invalidation
-  - release on partial failure
-- keep observability causal:
-  - execution start
-  - execution progress
-  - execution cancel / invalidation
-  - execution failure
-  - completion
-
-Implementation route:
-
-- reuse engine-side execution core:
-  - `sw-block/engine/replication/driver.go`
-  - `sw-block/engine/replication/executor.go`
-  - `sw-block/engine/replication/orchestrator.go`
-- reuse storage/runtime execution bridge:
-  - `weed/storage/blockvol/v2bridge/executor.go`
-  - `weed/storage/blockvol/v2bridge/pinner.go`
-  - `weed/storage/blockvol/v2bridge/reader.go`
-- reuse block runtime execution reality:
-  - `weed/storage/blockvol/blockvol.go`
-  - `weed/storage/blockvol/replica_apply.go`
-  - `weed/storage/blockvol/replica_barrier.go`
-  - rebuild-side files under `weed/storage/blockvol/`
-- preserve the boundary:
-  - do not move zero-gap / catch-up / rebuild classification into `blockvol`
-  - do not let executor convenience paths redefine protocol semantics
-
-Validation focus:
-
-- prove one live integrated catch-up chain:
-  - assignment/control arrives through accepted `P1` path
-  - engine plans
-  - executor drives `v2bridge`
-  - `blockvol` executes
-  - progress returns
-  - session completes
-- prove one real rebuild execution path for the chosen product path
-- prove retention pin / release symmetry on the live path
-- prove rebuild resource pin / release symmetry on the live path
-- prove invalidation / cancel cleanup on the live path
-- prove execution logs explain:
-  - why catch-up started
-  - why rebuild started
-  - why execution failed
-  - why execution was cancelled
-  - why completion succeeded
-
-Reject if:
-
-- catch-up is still only proven by split evidence
-- rebuild remains only a detection outcome
-- `blockvol` starts deciding recovery mode or rebuild fallback
-- resources leak on cancel / invalidation / partial failure
-- execution logs are too weak to replay causality offline
-- the slice quietly broadens protocol semantics beyond the current accepted boundary
-
-Recommended first cut:
-
-1. close the live catch-up chain first
-2. close the first real `full-base` rebuild path second
-3. leave unified replay to `P3`
-
-Minimum closure threshold:
-
-- do not accept `P2` on glue code + partial chain tests alone
-- at least one accepted catch-up proof must drive the real engine executor path:
-  - `PlanRecovery(...)`
-  - `NewCatchUpExecutor(...)`
-  - executor-managed progress / completion
-  - real `v2bridge` / `blockvol` execution underneath
-- at least one accepted rebuild proof must drive the real engine executor path:
-  - rebuild assignment
-  - `PlanRebuild(...)`
-  - `NewRebuildExecutor(...)`
-  - executor-managed completion
-  - real `TransferFullBase(...)` underneath
-- resource-cleanup proof must include live-path assertions, not only logs:
-  - active holds released
-  - retention floor no longer pinned after release
-  - no surviving session/plan ownership after cancel / invalidation / failure
-- observability proof should include executor-generated events, not only planner-side events
-- if these thresholds are not met, record `P2` as partial execution progress, not execution closure
-
-Carry-forward note:
-
-- on the chosen `RF=2 sync_all` path, `CommittedLSN` separation is resolved in this slice:
-  - `CommittedLSN = WALHeadLSN`
-  - `CheckpointLSN` remains the durable base-image boundary
-- this is not yet a blanket truth for every future path or durability mode
-- post-checkpoint catch-up remains bounded unless explicitly closed
-- rebuild coverage is limited to the first chosen executable path if that is all that lands
-
-Status:
-
-- accepted
-- real one-chain execution is now proven for:
-  - catch-up
-  - rebuild
-- accepted evidence includes:
-  - `CommittedLSN` separated from `CheckpointLSN` on the chosen `sync_all` path
-  - live engine plan -> executor -> `v2bridge` -> `blockvol` catch-up chain
-  - live engine plan -> executor -> `v2bridge` -> `blockvol` rebuild chain
-  - explicit pin cleanup assertions after execution
-- accepted with explicit residual scope:
-  - `CatchUpStartLSN` is not directly asserted in tests
-  - rebuild source is not yet forced/verified per source variant
-  - broader rebuild-source coverage can remain follow-up work
-
-Review checklist:
-
-- is there one accepted catch-up proof from real `P1` control path to real session completion, using `CatchUpExecutor`
-- is there one accepted first rebuild proof on the chosen path, using `RebuildExecutor`
-- do live-path assertions prove pin/hold release on success, cancel, invalidation, and failure
-- do logs/status explain start, cancel, failure, and completion without hidden transitions
-- does the delivery avoid overclaiming general post-checkpoint catch-up, broad rebuild coverage, or production readiness
-
-### P3: Hardening Validation
-
-1. replay the accepted failure-class set again on the unified live path after `P1` + `P2`
-2. validate at least one real failover / promotion / reassignment cycle through the live control path
-3. validate concurrent retention/pinner behavior under overlapping recovery activity
-4. make the committed-truth gate decision explicit for the chosen candidate path
-
-Slice adjustment note:
-
-- if `P2` lands only partially, `P3` should first close the missing execution outcome:
-  - real catch-up closure if still missing
-  - real first rebuild closure if still missing
-- only after both are real should `P3` spend most of its weight on unified replay, failover / reassignment validation, and concurrent retention / cleanup hardening
-
-Efficiency note:
-
-- `P3` is a hardening-validation slice, not another execution-closure slice
-- reuse the accepted `P1` / `P2` live path as the base; do not re-prove already accepted chain mechanics in isolation
-- prefer one compact replay matrix over many near-duplicate tests
-- prefer one real failover cycle and one true simultaneous-overlap retention case over broad scenario expansion
-- the required new outputs are:
-  - unified replay evidence
-  - one real failover / reassignment replay
-  - one concurrent retention/pinner safety result
-  - one explicit committed-truth gate decision
-
-Validation focus:
-
-- unified replay for:
-  - changed-address restart
-  - stale epoch / stale session
-  - unrecoverable gap / needs-rebuild
-  - post-checkpoint boundary behavior
-- at least one real failover / promotion / reassignment cycle
-- concurrent retention/pinner safety under at least one true simultaneous-overlap hold case
-- logs explain:
-  - why control truth changed
-  - why a session was invalidated
-  - why catch-up vs rebuild was chosen
-  - why execution completed, failed, or was cancelled
-
-Reject if:
-
-- accepted failure classes are still only partially replayed on the unified path
-- failover / reassignment is claimed without a real live-path replay
-- concurrent retention/pinner behavior leaks pins or violates recovery safety
-- logs are too weak to replay causality offline
-- the committed-truth gate is still just a note instead of an explicit decision
-
-Status:
-
-- accepted
-- unified hardening replay is now proven on the accepted live path
-- accepted evidence includes:
-  - replay of the accepted failure-class set on the unified `P1` + `P2` path
-  - at least one real failover / reassignment cycle through the live control path
-  - one true simultaneous-overlap retention/pinner safety proof
-  - stronger causality assertions for invalidation, escalation, catch-up, and completion
-- committed-truth gate decision for the chosen candidate path:
-  - for the chosen `RF=2 sync_all` candidate path, `CommittedLSN = WALHeadLSN` with `CheckpointLSN` kept separate is accepted as sufficient for the candidate-path hardening boundary
-  - this is not yet a blanket truth for every future path or durability mode
-
-### P4: Candidate Package Closure
-
-1. classify what is truly ready for a first candidate path
-2. package the accepted `P1` / `P2` / `P3` evidence into one bounded candidate package
-3. turn carry-forwards into explicit candidate bounds or hard gates
-4. state clearly what still remains before production readiness
-
-Goal:
-
-- finish `Phase 08` with one explicit candidate package, not just a collection of accepted slices
-
-Verification mechanism:
-
-- evidence map:
-  - every candidate claim must point to accepted evidence from `P1` / `P2` / `P3`
-- tester validation:
-  - verify each candidate claim is supported by accepted evidence
-  - reject any claim that exceeds the proven boundary
-- manager validation:
-  - verify the candidate statement is explicit, bounded, and not confused with production readiness
-
-Output artifacts:
-
-1. candidate-path statement in `phase-08.md`
-2. candidate/gate decision record in `phase-08-decisions.md`
-3. concise candidate package summary:
-   - candidate-safe capabilities
-   - explicit bounds
-   - deferred / blocking items
-4. concise residual-gap summary:
-   - candidate-safe
-   - intentionally bounded
-   - still deferred / still blocking
-5. short module/package boundary summary for later phases:
-   - what is already strong enough
-   - what moves to the next heavy engineering phase
-
-Efficiency note:
-
-- `P4` should mostly consume already accepted evidence, not create broad new engineering work
-- only add implementation work if a small remaining blocker must be closed to make the candidate statement coherent
-- if a gap is real but not worth closing in `Phase 08`, classify it explicitly rather than expanding scope implicitly
-- `P4` exists inside `Phase 08` so the next phase can begin with substantial engineering work, not a light packaging-only round
-
-Validation focus:
-
-- make the candidate-path boundary explicit:
-  - what is proven
-  - what is intentionally bounded
-  - what is still deferred
-- make the candidate package explicit:
-  - candidate-safe capability list
-  - evidence-to-claim mapping
-  - short module/package boundary summary
-- make the committed-truth decision explicit:
-  - accepted for the chosen `RF=2 sync_all` candidate path
-  - still unclassified for future paths / durability modes unless separately proven
-- prove the accepted product path can be described as an engineering candidate, not only as a set of slice-local proofs
-- provide one explicit residual-gap list that separates:
-  - candidate-safe bounds
-  - future hardening work
-  - production blockers
-
-Reject if:
-
-- `P4` reopens protocol design instead of closing engineering gaps
-- candidate claims are broader than the proven path
-- carry-forwards remain informal notes rather than bounds or gates
-- production readiness is implied from candidate readiness
-- `P4` produces only prose summary without an evidence-to-claim mapping
-- `P4` is too thin to leave the next phase with substantial engineering closure work
-
-Status:
-
-- accepted
-- the first candidate package is now explicit for the chosen path
-- accepted evidence includes:
-  - candidate-safe claims mapped to accepted `P1` / `P2` / `P3` evidence
-  - explicit bounds for `RF=2 sync_all`
-  - explicit deferred / blocking items before production use
-  - committed-truth decision scoped to the chosen candidate path
-  - short module/package boundary summary for the next heavy engineering phase
-- accepted judgment:
-  - candidate-safe-with-bounds
-  - not production-ready
-
-## Guardrails
-
-### Guardrail 1: Do not reopen accepted V2 protocol truths casually
-
-`Phase 08` is a hardening phase. New work should preserve the accepted protocol truth set unless a real contradiction is demonstrated.
-
-### Guardrail 2: Keep product-path claims evidence-bound
-
-Do not claim more than the hardened path actually proves. Distinguish:
-
-1. live integrated path
-2. hardened product path
-3. production candidate
-
-### Guardrail 3: Identity and policy boundaries remain hard rules
-
-1. `ReplicaID` must remain stable and never collapse to address shape
-2. engine decides recovery policy
-3. bridge translates intent/state
-4. `blockvol` executes I/O only
-
-### Guardrail 4: Carry-forward limitations must remain explicit until closed
-
-Especially:
-
-1. committed truth vs checkpoint truth
-2. rebuild execution coverage
-3. real master/control delivery coverage
-
-### Guardrail 5: The committed-truth carry-forward must become a gate, not a note
-
-For the chosen `RF=2 sync_all` candidate path, this gate is now decided:
-
-1. `CommittedLSN = WALHeadLSN`
-2. `CheckpointLSN` remains the durable base-image boundary
-3. this separation is accepted as sufficient for the candidate-path hardening boundary
-
-For future paths or durability modes, the gate must still be classified explicitly rather than carried forward informally.
-
-## Exit Criteria
-
-Phase 08 is done when:
-
-1. the first product path runs through a real control delivery path
-2. the critical execution chain is integrated and validated
-3. rebuild execution for the chosen path is no longer just detected but executed
-4. at least one real failover / reassignment cycle is replayed through the live control path
-5. the accepted failure-class set is replayed again on the unified live path
-6. operational/debug evidence is sufficient for pre-production use
-7. the remaining gap to a production candidate is small and explicit
-
-Phase-close note:
-
-- `Phase 08` is now closed
-- next phase:
-  - `Phase 09: Production Execution Closure`
-  - start with `P0` planning for real execution completeness:
-    - real `TransferFullBase`
-    - real `TransferSnapshot`
-    - real `TruncateWAL`
-    - stronger live runtime execution ownership
-
-## Assignment For `sw`
-
-Current next tasks:
-
-1. close out `Phase 08` bookkeeping only if any wording drift remains
-2. move to `Phase 09 P0` planning for production execution closure
-3. focus the next heavy engineering package on:
-   - real `TransferFullBase`
-   - real `TransferSnapshot`
-   - real `TruncateWAL`
-   - stronger live runtime execution ownership
-
-## Assignment For `tester`
-
-Current next tasks:
-
-1. treat `Phase 08` as closed after any final wording/bookkeeping sync
-2. prepare the `Phase 09 P0` validation oracle for production execution closure
-3. keep no-overclaim active around:
-   - validation-grade transfer vs production-grade transfer
-   - truncation execution
-   - stronger runtime ownership vs current bounded path

sw-block/.private/phase/phase-09-decisions.md

@@ -1,177 +0,0 @@
-# Phase 09 Decisions
-
-## Decision 1: Phase 09 is production execution closure, not packaging
-
-The candidate-path packaging/judgment work remains inside `Phase 08 P4`.
-
-`Phase 09` starts directly with substantial backend engineering closure.
-
-## Decision 2: The first Phase 09 targets are real transfer, truncation, and stronger runtime ownership
-
-The initial heavy execution blockers are:
-
-1. real `TransferFullBase`
-2. real `TransferSnapshot`
-3. real `TruncateWAL`
-4. stronger live runtime execution ownership
-
-## Decision 3: Phase 09 remains bounded to the chosen candidate path unless evidence forces expansion
-
-Default scope remains:
-
-1. `RF=2`
-2. `sync_all`
-3. existing master / volume-server heartbeat path
-
-Future paths or durability modes should not be absorbed casually into this phase.
-
-## Decision 4: Full-base rebuild completion is defined by an achieved boundary, not exact target equality
-
-For the chosen `RF=2 sync_all` backend path, `full_base` rebuild does not require:
-
-1. extent image exactly equal to the engine's frozen `targetLSN`
-
-It does require:
-
-1. the engine plans a frozen minimum target `targetLSN`
-2. the backend produces an actual rebuilt boundary `achievedLSN`
-3. correctness requires `achievedLSN >= targetLSN`
-4. after install, local runtime state and engine-visible completion must align to the same `achievedLSN`
-5. the system must not keep engine truth at `targetLSN` while local runtime truth has advanced to `achievedLSN`
-
-Reason:
-
-1. the current full-base path copies a mutable extent image from the live backend
-2. this backend does not provide an immutable extent export at an exact requested LSN
-3. forcing exact-target extent equality would require a different protocol, not just a tighter implementation
-4. rollback to an older target after a newer stable base is installed is much harder than accepting the newer stable boundary
-
-Algorithm guarantees required by this decision:
-
-1. minimum-target guarantee:
-   - rebuild completion must never leave the replica behind the engine's frozen minimum target
-2. single-truth guarantee:
-   - `checkpoint`
-   - `nextLSN`
-   - receiver progress
-   - flusher checkpoint
-   - engine-visible rebuild progress/completion
-   must all converge to the same `achievedLSN`
-3. no split-truth guarantee:
-   - do not allow local runtime state to reflect a newer boundary while engine/accounting still records the older one
-4. backend-realism guarantee:
-   - it is acceptable for the achieved boundary to be newer than the frozen minimum target
-   - it is not acceptable for the achieved boundary to remain implicit
-
-## Decision 5: P1 full-base execution closure accepted
-
-P1 delivers real full-base execution closure under the Decision 4 contract.
-
-Accepted properties:
-
-1. `TransferFullBase(committedLSN) → (achievedLSN, error)` — achieved boundary surfaced explicitly
-2. rebuild server pre-flushes before extent copy — no unflushed-entry hole
-3. full state handoff on install — dirty map, WAL, superblock, flusher, receiver progress all aligned
-4. second catch-up bounded to target — no unbounded replay
-5. engine uses `achievedLSN` for progress recording — no split truth
-6. rebuild server fail-closes on pre-copy flush failure
-7. stale-higher local/runtime state is reset to the rebuilt achieved boundary, not preserved by monotonic advance
-
-Evidence closure:
-
-1. live-receiver convergence is now covered directly in `P1`
-2. `P1` accepted state is final for full-base closure on the chosen path
-
-## Decision 6: P2 snapshot execution closure accepted
-
-`P2` delivers real `snapshot_tail` execution closure on the chosen path.
-
-Accepted properties:
-
-1. `TransferSnapshot(snapshotLSN)` now performs real TCP snapshot transfer
-2. snapshot base boundary is exact, not conservative:
-   - requested `snapshotLSN` must match the transferred base
-   - newer checkpoints are rejected instead of silently accepted
-3. snapshot transfer carries explicit boundary metadata through `SnapshotArtifactManifest.BaseLSN`
-4. snapshot install converges local runtime to the exact snapshot boundary before tail replay begins
-5. the `snapshot_tail` path now closes through one executor:
-   - `TransferSnapshot(snapshotLSN)`
-   - `StreamWALEntries(snapshotLSN, targetLSN)`
-6. tail replay remains bounded to `targetLSN`
-7. temporary snapshot ownership is cleaned up on both success and failure paths
-
-Evidence closure:
-
-1. component proof now covers real snapshot transfer and exact-boundary install
-2. one-chain proof now covers `engine -> RebuildExecutor -> v2bridge -> blockvol -> tail replay -> InSync`
-3. boundary-drift rejection is covered directly in `P2`
-
-## Decision 7: P3 truncation execution closure accepted under the narrowed Option A contract
-
-`P3` does not mean "all replica-ahead cases can be corrected by local truncate."
-
-Accepted contract:
-
-1. local truncation is allowed only when the local base boundary exactly matches the kept boundary:
-   - `checkpointLSN == truncateLSN`
-2. if `checkpointLSN > truncateLSN`:
-   - ahead entries already contaminated extent
-   - truncation is unsafe
-   - the path must escalate to rebuild
-3. if `checkpointLSN < truncateLSN`:
-   - part of the kept range may still exist only in WAL
-   - truncation would discard committed kept data
-   - the path must escalate to rebuild
-4. no path may record truncation completion while extent/base truth is known to be unsafe for local truncate
-5. execution-time escalation to `NeedsRebuild` is acceptable for `P3`
-
-Accepted properties:
-
-1. `TruncateWAL(truncateLSN)` now performs real local correction for the truncation-safe case
-2. `TruncateToLSN()` pauses the flusher and drains I/O before mutating local runtime truth
-3. `blockvol.ErrTruncationUnsafe` is bridged to `engine.ErrTruncationUnsafe`
-4. `CatchUpExecutor` escalates unsafe truncation cases to `StateNeedsRebuild`
-5. the mixed case `checkpointLSN < truncateLSN < headLSN` is now covered directly in tests
-
-Evidence closure:
-
-1. component proof covers exact local truncation only for the safe case
-2. one-chain proof covers both:
-   - safe truncation to `InSync`
-   - unsafe truncation escalation to `NeedsRebuild`
-3. `P3` accepted state is final for truncation execution closure on the chosen path
-
-## Decision 8: P4 stronger live runtime ownership accepted
-
-`P4` closes the bounded runtime-ownership gap for the chosen `RF=2 sync_all` live volume-server path.
-
-Accepted properties:
-
-1. `ProcessAssignments()` now drives live recovery ownership through:
-   - assignment conversion
-   - orchestrator session creation/supersede
-   - `RecoveryManager` start/cancel/replace/cleanup
-2. runtime inputs are sourced from the live path rather than test-only injection:
-   - live volume path
-   - live storage adapter / pinner / reader
-   - rebuild address scoped by volume path
-3. replacement is serialized:
-   - stale owner is cancelled and drained before replacement starts
-   - no concurrent live owners remain for the same `replicaID`
-4. shutdown drains live recovery owners before the block service closes volumes
-5. engine policy remains in engine; `P4` does not move policy into the volume-server runtime
-
-Evidence closure:
-
-1. live-path proof now covers:
-   - `ProcessAssignments -> plan_catchup -> exec_catchup_started -> exec_completed -> in_sync`
-2. serialized replacement proof now directly demonstrates:
-   - old owner alive
-   - old owner `done` still open before supersede
-   - `ProcessAssignments(epoch+1)` returns only after old owner `done` closes
-3. shutdown proof now covers a live blocked task, not only an already-finished task
-
-Residual note:
-
-1. repeated primary assignment on the same volume still logs a low-severity rebuild-server double-start warning
-2. broader control-plane closure remains outside `Phase 09`