shell: use tabwriter for aligned output, remove fragile string error checks

- Use text/tabwriter in runS3UserList and runS3UserAccessKeyList for properly aligned column output - Remove fragile strings.Contains "not found" and "already exists" fallbacks in s3ShellIsNotFound and s3ShellIsAlreadyExists; rely on typed errors and gRPC status codes only - Update test assertions to match tabwriter-formatted output
Add workflow-oriented S3 shell commands
2026-10-11 17:15:51 +00:00 · 2026-04-07 11:24:42 -07:00 · 2026-04-06 18:27:22 -07:00
455 changed files with 4996 additions and 27150 deletions
@@ -1 +1 @@
-{"sessionId":"81536282-6277-4e32-9922-37c6e3a01b1f","pid":84648,"acquiredAt":1776208413235}
+{"sessionId":"d6574c47-eafc-4a94-9dce-f9ffea22b53c","pid":10111,"acquiredAt":1775248373916}
@@ -18,7 +18,6 @@ jobs:

      - name: Delete old release assets
        uses: mknejp/delete-release-assets@v1
-        continue-on-error: true
        with:
          token: ${{ github.token }}
          tag: dev
@@ -142,7 +142,7 @@ jobs:
          password: ${{ secrets.GHCR_TOKEN }}

      - name: Build
-        uses: docker/build-push-action@v7.1.0
+        uses: docker/build-push-action@v7
        with:
          context: ./docker
          push: ${{ github.event_name != 'pull_request' }}
@@ -150,7 +150,7 @@ jobs:
          fi

      - name: Build and push image
-        uses: docker/build-push-action@v7.1.0
+        uses: docker/build-push-action@v7
        with:
          context: ./docker
          push: ${{ github.event_name != 'pull_request' }}
@@ -232,7 +232,7 @@ jobs:
          username: ${{ secrets.GHCR_USERNAME }}
          password: ${{ secrets.GHCR_TOKEN }}
      - name: Build ${{ matrix.platform }} ${{ matrix.variant }}
-        uses: docker/build-push-action@v7.1.0
+        uses: docker/build-push-action@v7
        env:
          DOCKER_BUILDKIT: 1
        with:
@@ -322,7 +322,7 @@ jobs:
          buildkitd-config: /tmp/buildkitd.toml
      - name: Build local scan image tarball
        if: needs.setup.outputs.publish != 'true'
-        uses: docker/build-push-action@v7.1.0
+        uses: docker/build-push-action@v7
        env:
          DOCKER_BUILDKIT: 1
        with:
@@ -57,7 +57,7 @@ jobs:
          fi
      -
        name: Build
-        uses: docker/build-push-action@v7.1.0
+        uses: docker/build-push-action@v7
        with:
          context: ./docker
          push: ${{ github.event_name != 'pull_request' }}
@@ -251,7 +251,7 @@ jobs:
          
      - name: Build and push ${{ matrix.variant }}
        if: github.event_name != 'workflow_dispatch' || github.event.inputs.variant == 'all' || github.event.inputs.variant == matrix.variant
-        uses: docker/build-push-action@v7.1.0
+        uses: docker/build-push-action@v7
        env:
          DOCKER_BUILDKIT: 1
        with:
@@ -94,7 +94,7 @@ jobs:
          password: ${{ secrets.DOCKER_PASSWORD }}

      - name: Build and push image
-        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v2
+        uses: docker/build-push-action@d08e5c354a6adb9ed34480a06d141179aa583294 # v2
        with:
          context: ./docker
          push: true
@@ -1,63 +0,0 @@
-name: "FUSE DLM Integration Tests"
-
-on:
-  pull_request:
-    paths:
-      - 'weed/command/mount*.go'
-      - 'weed/mount/**'
-      - 'weed/cluster/**'
-      - 'test/fuse_dlm/**'
-      - '.github/workflows/fuse-dlm-integration.yml'
-  push:
-    branches: [master]
-    paths:
-      - 'weed/command/mount*.go'
-      - 'weed/mount/**'
-      - 'weed/cluster/**'
-      - 'test/fuse_dlm/**'
-
-concurrency:
-  group: ${{ github.head_ref || github.ref }}/fuse-dlm-integration
-  cancel-in-progress: true
-
-permissions:
-  contents: read
-
-jobs:
-  fuse-dlm-integration:
-    name: FUSE DLM Integration Tests
-    runs-on: ubuntu-22.04
-    timeout-minutes: 30
-
-    steps:
-      - name: Check out code
-        uses: actions/checkout@v6
-
-      - name: Set up Go
-        uses: actions/setup-go@v6
-        with:
-          go-version-file: 'go.mod'
-
-      - name: Install FUSE dependencies
-        run: |
-          sudo apt-get update
-          sudo apt-get install -y libfuse3-dev
-          echo 'user_allow_other' | sudo tee -a /etc/fuse.conf
-          sudo chmod 644 /etc/fuse.conf
-
-      - name: Build SeaweedFS
-        run: go build -o weed/weed -buildvcs=false ./weed
-
-      - name: Run DLM integration tests
-        timeout-minutes: 25
-        env:
-          WEED_BINARY: ${{ github.workspace }}/weed/weed
-        run: go test -v -count=1 -timeout=20m ./test/fuse_dlm/...
-
-      - name: Upload logs on failure
-        if: failure()
-        uses: actions/upload-artifact@v7
-        with:
-          name: fuse-dlm-test-logs
-          path: /tmp/seaweedfs-fuse-dlm-logs/
-          retention-days: 3
@@ -1,9 +1,6 @@
-name: "helm: release"
+name: "helm: manual release"

 on:
-  push:
-    tags:
-      - '*'
  workflow_dispatch:

 permissions:
@@ -1,97 +0,0 @@
-name: "NFS Integration Tests"
-
-on:
-  push:
-    branches: [ master, main ]
-    paths:
-      - 'weed/server/nfs/**'
-      - 'weed/command/nfs.go'
-      - 'weed/filer/filer_inode.go'
-      - 'weed/filer/filer_inode_index.go'
-      - 'weed/filer/filerstore_wrapper.go'
-      - 'weed/server/filer_grpc_server_rename.go'
-      - 'test/nfs/**'
-      - '.github/workflows/nfs-tests.yml'
-  pull_request:
-    branches: [ master, main ]
-    paths:
-      - 'weed/server/nfs/**'
-      - 'weed/command/nfs.go'
-      - 'weed/filer/filer_inode.go'
-      - 'weed/filer/filer_inode_index.go'
-      - 'weed/filer/filerstore_wrapper.go'
-      - 'weed/server/filer_grpc_server_rename.go'
-      - 'test/nfs/**'
-      - '.github/workflows/nfs-tests.yml'
-
-concurrency:
-  group: ${{ github.head_ref }}/nfs-tests
-  cancel-in-progress: true
-
-permissions:
-  contents: read
-
-env:
-  TEST_TIMEOUT: '15m'
-
-jobs:
-  nfs-integration:
-    name: NFS Integration Testing
-    runs-on: ubuntu-22.04
-    timeout-minutes: 20
-
-    steps:
-    - name: Checkout code
-      uses: actions/checkout@v6
-
-    - name: Set up Go
-      uses: actions/setup-go@v6
-      with:
-        go-version-file: 'go.mod'
-
-    - name: Build SeaweedFS
-      run: |
-        cd weed
-        go build -o weed .
-        chmod +x weed
-        ./weed version
-
-    - name: Run NFS Integration Tests
-      run: |
-        cd test/nfs
-
-        echo "Running NFS integration tests..."
-        echo "============================================"
-
-        # Install test dependencies
-        go mod download
-
-        # Run all NFS tests
-        go test -v -timeout=${{ env.TEST_TIMEOUT }} ./...
-
-        echo "============================================"
-        echo "NFS integration tests completed"
-
-    - name: Test Summary
-      if: always()
-      run: |
-        echo "## NFS Integration Test Summary" >> $GITHUB_STEP_SUMMARY
-        echo "" >> $GITHUB_STEP_SUMMARY
-        echo "### Test Coverage" >> $GITHUB_STEP_SUMMARY
-        echo "- **Read/Write Round Trip**: Basic file create + read" >> $GITHUB_STEP_SUMMARY
-        echo "- **Directory Operations**: Mkdir, ReadDirPlus, RmDir" >> $GITHUB_STEP_SUMMARY
-        echo "- **Nested Directories**: Deep tree creation and leaf I/O" >> $GITHUB_STEP_SUMMARY
-        echo "- **Rename**: Content preserved across rename" >> $GITHUB_STEP_SUMMARY
-        echo "- **Overwrite + Truncate**: Setattr(size=0) + shorter write" >> $GITHUB_STEP_SUMMARY
-        echo "- **Large Files**: 3 MiB binary round trip" >> $GITHUB_STEP_SUMMARY
-        echo "- **Edge Payloads**: All 256 byte values + empty files" >> $GITHUB_STEP_SUMMARY
-        echo "- **Symlinks**: Symlink + Lookup" >> $GITHUB_STEP_SUMMARY
-        echo "- **Missing Path**: Remove on missing entry errors cleanly" >> $GITHUB_STEP_SUMMARY
-        echo "- **FSINFO**: Non-zero rtpref/wtpref advertised" >> $GITHUB_STEP_SUMMARY
-        echo "- **Sequential Append**: Two-part concatenation" >> $GITHUB_STEP_SUMMARY
-        echo "- **ReadDir After Remove**: Meta cache does not serve stale entries" >> $GITHUB_STEP_SUMMARY
-        echo "" >> $GITHUB_STEP_SUMMARY
-        echo "### Harness" >> $GITHUB_STEP_SUMMARY
-        echo "Each test boots its own master + volume + filer + nfs subprocess" >> $GITHUB_STEP_SUMMARY
-        echo "stack on loopback and drives it via the NFSv3 RPC protocol using" >> $GITHUB_STEP_SUMMARY
-        echo "go-nfs-client. No kernel NFS mount or privileged port is required." >> $GITHUB_STEP_SUMMARY
@@ -1,87 +0,0 @@
-name: "pjdfstest POSIX Compliance"
-
-on:
-  push:
-    branches: [ master, main ]
-    paths:
-      - 'weed/mount/**'
-      - 'weed/filer/**'
-      - 'test/pjdfstest/**'
-      - '.github/workflows/pjdfstest.yml'
-  pull_request:
-    branches: [ master, main ]
-    paths:
-      - 'weed/mount/**'
-      - 'weed/filer/**'
-      - 'test/pjdfstest/**'
-      - '.github/workflows/pjdfstest.yml'
-  workflow_dispatch:
-
-concurrency:
-  group: pjdfstest/${{ github.ref }}
-  cancel-in-progress: true
-
-permissions:
-  contents: read
-
-jobs:
-  pjdfstest:
-    name: pjdfstest
-    runs-on: ubuntu-22.04
-    timeout-minutes: 60
-
-    steps:
-    - name: Checkout code
-      uses: actions/checkout@v6
-
-    - name: Set up Go
-      uses: actions/setup-go@v6
-      with:
-        go-version-file: 'go.mod'
-
-    - name: Build SeaweedFS e2e image
-      run: |
-        cd docker
-        make build_e2e || {
-          echo "Retrying without buildx cache..."
-          make binary_race
-          docker build --no-cache -t chrislusf/seaweedfs:e2e -f Dockerfile.e2e .
-        }
-
-    - name: Build pjdfstest image
-      run: |
-        docker build -t chrislusf/seaweedfs:pjdfstest test/pjdfstest/
-
-    - name: Start SeaweedFS cluster
-      run: |
-        docker compose -f test/pjdfstest/docker-compose.yml up --wait
-
-    - name: Run pjdfstest
-      run: |
-        set -o pipefail
-        docker compose -f test/pjdfstest/docker-compose.yml exec -T mount \
-          /run.sh 2>&1 | tee /tmp/pjdfstest-output.log
-
-    - name: Collect logs
-      if: always()
-      run: |
-        mkdir -p /tmp/pjdfstest-docker-logs
-        for svc in master volume filer mount; do
-          docker compose -f test/pjdfstest/docker-compose.yml logs "$svc" \
-            > "/tmp/pjdfstest-docker-logs/${svc}.log" 2>&1 || true
-        done
-
-    - name: Tear down
-      if: always()
-      run: |
-        docker compose -f test/pjdfstest/docker-compose.yml down -v
-
-    - name: Upload logs
-      if: always()
-      uses: actions/upload-artifact@v7
-      with:
-        name: pjdfstest-results
-        path: |
-          /tmp/pjdfstest-output.log
-          /tmp/pjdfstest-docker-logs/
-        retention-days: 7
@@ -19,7 +19,6 @@ jobs:
    steps:
      - name: Delete old Rust volume dev assets
        uses: mknejp/delete-release-assets@v1
-        continue-on-error: true
        with:
          token: ${{ github.token }}
          tag: dev
@@ -84,7 +83,7 @@ jobs:
          rm weed-volume-normal

      - name: Upload dev release assets
-        uses: softprops/action-gh-release@v3
+        uses: softprops/action-gh-release@v2
        with:
          tag_name: dev
          prerelease: true
@@ -155,7 +154,7 @@ jobs:
          rm weed-volume-normal

      - name: Upload dev release assets
-        uses: softprops/action-gh-release@v3
+        uses: softprops/action-gh-release@v2
        with:
          tag_name: dev
          prerelease: true
@@ -89,7 +89,7 @@ jobs:

      - name: Upload release assets
        if: startsWith(github.ref, 'refs/tags/')
-        uses: softprops/action-gh-release@v3
+        uses: softprops/action-gh-release@v2
        with:
          files: |
            weed-volume_large_disk_${{ matrix.asset_suffix }}.tar.gz
@@ -166,7 +166,7 @@ jobs:

      - name: Upload release assets
        if: startsWith(github.ref, 'refs/tags/')
-        uses: softprops/action-gh-release@v3
+        uses: softprops/action-gh-release@v2
        with:
          files: |
            weed-volume_large_disk_${{ matrix.asset_suffix }}.tar.gz
@@ -235,7 +235,7 @@ jobs:

      - name: Upload release assets
        if: startsWith(github.ref, 'refs/tags/')
-        uses: softprops/action-gh-release@v3
+        uses: softprops/action-gh-release@v2
        with:
          files: |
            weed-volume_large_disk_windows_amd64.zip
@@ -245,61 +245,6 @@ jobs:
          path: test/s3/retention/weed-test*.log
          retention-days: 3

-  s3-checksum-tests:
-    name: S3 Checksum Tests
-    runs-on: ubuntu-22.04
-    timeout-minutes: 20
-
-    steps:
-      - name: Check out code
-        uses: actions/checkout@v6
-
-      - name: Set up Go
-        uses: actions/setup-go@v6
-        with:
-          go-version-file: 'go.mod'
-        id: go
-
-      - name: Install SeaweedFS
-        run: |
-          go install -buildvcs=false
-
-      - name: Run S3 Checksum Tests
-        timeout-minutes: 16
-        working-directory: test/s3/checksum
-        run: |
-          set -x
-          echo "=== System Information ==="
-          uname -a
-          free -h
-          df -h
-          echo "=== Starting Tests ==="
-          make test-with-server
-
-      - name: Show server logs on failure
-        if: failure()
-        working-directory: test/s3/checksum
-        run: |
-          echo "=== Server Logs ==="
-          if [ -f weed-test.log ]; then
-            echo "Last 100 lines of server logs:"
-            tail -100 weed-test.log
-          else
-            echo "No server log file found"
-          fi
-
-          echo "=== Test Environment ==="
-          ps aux | grep -E "(weed|test)" || true
-          netstat -tlnp | grep -E "(8333|9333|8080)" || true
-
-      - name: Upload test logs on failure
-        if: failure()
-        uses: actions/upload-artifact@v7
-        with:
-          name: s3-checksum-test-logs
-          path: test/s3/checksum/weed-test*.log
-          retention-days: 3
-
  s3-cors-tests:
    name: S3 CORS Tests
    runs-on: ubuntu-22.04
@@ -1,56 +0,0 @@
-name: "Vacuum Integration Tests"
-
-on:
-  push:
-    branches: [ master ]
-  pull_request:
-    branches: [ master ]
-
-permissions:
-  contents: read
-
-jobs:
-  vacuum-integration-tests:
-    name: Vacuum Integration Tests
-    runs-on: ubuntu-22.04
-    timeout-minutes: 15
-    steps:
-    - name: Set up Go 1.x
-      uses: actions/setup-go@v6
-      with:
-        go-version: ^1.25
-      id: go
-
-    - name: Check out code into the Go module directory
-      uses: actions/checkout@v6
-
-    - name: Build weed binary
-      run: |
-        cd weed && go build -o weed .
-
-    - name: Run Vacuum Integration Tests
-      working-directory: test/vacuum
-      run: |
-        go test -v -timeout 10m
-
-    - name: Collect server logs on failure
-      if: failure()
-      run: |
-        echo "Collecting server logs from temp directories..."
-        mkdir -p /tmp/vacuum-test-logs
-        find /tmp -maxdepth 1 -type d -name "TestVacuum*" 2>/dev/null | while read dir; do
-          if [ -d "$dir" ]; then
-            echo "Found test directory: $dir"
-            cp -r "$dir" /tmp/vacuum-test-logs/ 2>/dev/null || true
-          fi
-        done
-        echo "Collected logs:"
-        find /tmp/vacuum-test-logs -type f -name "*.log" 2>/dev/null || echo "No logs found"
-
-    - name: Archive logs
-      if: failure()
-      uses: actions/upload-artifact@v7
-      with:
-        name: vacuum-integration-test-logs
-        path: /tmp/vacuum-test-logs/
-        retention-days: 14
@@ -42,7 +42,8 @@ test: admin-generate

 # Admin component targets
 admin-generate:
-	@cd $(ADMIN_DIR) && $(MAKE) generate
+	@echo "Generating admin component templates..."
+	@cd $(ADMIN_DIR) && templ generate ./view

 admin-build: admin-generate
 	@echo "Building admin component..."
@@ -56,8 +56,8 @@ COPY --from=builder /go/src/github.com/seaweedfs/seaweedfs/docker/entrypoint.sh
 # To disable: docker run -e GODEBUG=fips140=off ...

 # Install dependencies and create non-root user
-RUN apk upgrade --no-cache && \
-    apk add --no-cache fuse curl su-exec libgcc libcrypto3 libssl3 && \
+RUN apk upgrade --no-cache zlib && \
+    apk add --no-cache fuse curl su-exec libgcc && \
    addgroup -g 1000 seaweed && \
    adduser -D -u 1000 -G seaweed seaweed

@@ -7,7 +7,7 @@ COPY ./filer.toml /etc/seaweedfs/filer.toml
 COPY ./entrypoint.sh /entrypoint.sh

 # Install dependencies and create non-root user
-RUN apk upgrade --no-cache && \
+RUN apk upgrade --no-cache zlib && \
    apk add --no-cache fuse curl su-exec && \
    addgroup -g 1000 seaweed && \
    adduser -D -u 1000 -G seaweed seaweed
@@ -34,7 +34,7 @@ COPY --from=builder /go/src/github.com/seaweedfs/seaweedfs/docker/filer_rocksdb.
 COPY --from=builder /go/src/github.com/seaweedfs/seaweedfs/docker/entrypoint.sh /entrypoint.sh

 # Install dependencies and create non-root user
-RUN apk upgrade --no-cache && \
+RUN apk upgrade --no-cache zlib && \
    apk add --no-cache fuse snappy gflags curl su-exec && \
    addgroup -g 1000 seaweed && \
    adduser -D -u 1000 -G seaweed seaweed
@@ -17,7 +17,7 @@ COPY --from=builder /go/src/github.com/seaweedfs/seaweedfs/docker/filer_rocksdb.
 COPY --from=builder /go/src/github.com/seaweedfs/seaweedfs/docker/entrypoint.sh /entrypoint.sh

 # Install dependencies and create non-root user
-RUN apk upgrade --no-cache && \
+RUN apk upgrade --no-cache zlib && \
    apk add --no-cache fuse snappy gflags curl tmux su-exec && \
    addgroup -g 1000 seaweed && \
    adduser -D -u 1000 -G seaweed seaweed
@@ -92,14 +92,14 @@ require (
 	gocloud.dev v0.45.0
 	gocloud.dev/pubsub/natspubsub v0.45.0
 	gocloud.dev/pubsub/rabbitpubsub v0.45.0
-	golang.org/x/crypto v0.50.0
+	golang.org/x/crypto v0.49.0
 	golang.org/x/exp v0.0.0-20260218203240-3dfff04db8fa
 	golang.org/x/image v0.38.0
-	golang.org/x/net v0.53.0
+	golang.org/x/net v0.52.0
 	golang.org/x/oauth2 v0.36.0
-	golang.org/x/sys v0.43.0
-	golang.org/x/text v0.36.0 // indirect
-	golang.org/x/tools v0.43.0 // indirect
+	golang.org/x/sys v0.42.0
+	golang.org/x/text v0.35.0 // indirect
+	golang.org/x/tools v0.42.0 // indirect
 	golang.org/x/xerrors v0.0.0-20240903120638-7835f813f4da // indirect
 	google.golang.org/api v0.274.0
 	google.golang.org/genproto v0.0.0-20260316180232-0b37fe3546d5 // indirect
@@ -118,15 +118,15 @@ require (
 	github.com/Jille/raft-grpc-transport v1.6.1
 	github.com/ThreeDotsLabs/watermill v1.5.1
 	github.com/a-h/templ v0.3.977
-	github.com/apache/cassandra-gocql-driver/v2 v2.1.0
+	github.com/apache/cassandra-gocql-driver/v2 v2.0.0
 	github.com/apache/iceberg-go v0.5.0
 	github.com/apple/foundationdb/bindings/go v0.0.0-20250911184653-27f7192f47c3
 	github.com/arangodb/go-driver v1.6.9
 	github.com/armon/go-metrics v0.4.1
 	github.com/aws/aws-sdk-go-v2 v1.41.5
-	github.com/aws/aws-sdk-go-v2/config v1.32.14
+	github.com/aws/aws-sdk-go-v2/config v1.32.13
 	github.com/aws/aws-sdk-go-v2/credentials v1.19.14
-	github.com/aws/aws-sdk-go-v2/service/s3 v1.99.0
+	github.com/aws/aws-sdk-go-v2/service/s3 v1.98.0
 	github.com/cognusion/imaging v1.0.2
 	github.com/fluent/fluent-logger-golang v1.10.1
 	github.com/getsentry/sentry-go v0.44.1
@@ -152,10 +152,9 @@ require (
 	github.com/tarantool/go-tarantool/v2 v2.4.2
 	github.com/testcontainers/testcontainers-go v0.40.0
 	github.com/tikv/client-go/v2 v2.0.7
-	github.com/willscott/go-nfs v0.0.3
 	github.com/xeipuuv/gojsonschema v1.2.0
 	github.com/ydb-platform/ydb-go-sdk-auth-environ v0.5.1
-	github.com/ydb-platform/ydb-go-sdk/v3 v3.134.0
+	github.com/ydb-platform/ydb-go-sdk/v3 v3.125.3
 	go.etcd.io/etcd/client/pkg/v3 v3.6.10
 	go.uber.org/atomic v1.11.0
 	golang.org/x/sync v0.20.0
@@ -257,7 +256,6 @@ require (
 	github.com/pquerna/otp v1.5.0 // indirect
 	github.com/pterm/pterm v0.12.82 // indirect
 	github.com/quic-go/quic-go v0.57.0 // indirect
-	github.com/rasky/go-xdr v0.0.0-20170124162913-1a41d1a06c93 // indirect
 	github.com/rclone/Proton-API-Bridge v1.0.1-0.20260127174007-77f974840d11 // indirect
 	github.com/rclone/go-proton-api v1.0.1-0.20260127173028-eb465cac3b18 // indirect
 	github.com/rogpeppe/go-internal v1.14.1 // indirect
@@ -272,7 +270,6 @@ require (
 	github.com/twpayne/go-kml/v3 v3.2.1 // indirect
 	github.com/tyler-smith/go-bip39 v1.1.0 // indirect
 	github.com/ulikunitz/xz v0.5.15 // indirect
-	github.com/willscott/go-nfs-client v0.0.0-20251022144359-801f10d98886 // indirect
 	github.com/wk8/go-ordered-map/v2 v2.1.8 // indirect
 	github.com/xeipuuv/gojsonpointer v0.0.0-20190905194746-02993c407bfb // indirect
 	github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415 // indirect
@@ -285,8 +282,8 @@ require (
 	go.uber.org/mock v0.5.2 // indirect
 	go.yaml.in/yaml/v2 v2.4.3 // indirect
 	go.yaml.in/yaml/v3 v3.0.4 // indirect
-	golang.org/x/mod v0.34.0 // indirect
-	golang.org/x/telemetry v0.0.0-20260311193753-579e4da9a98c // indirect
+	golang.org/x/mod v0.33.0 // indirect
+	golang.org/x/telemetry v0.0.0-20260209163413-e7419c687ee4 // indirect
 	gonum.org/v1/gonum v0.17.0 // indirect
 )

@@ -479,7 +476,7 @@ require (
 	github.com/vmihailenco/tagparser/v2 v2.0.0 // indirect
 	github.com/xanzy/ssh-agent v0.3.3 // indirect
 	github.com/yandex-cloud/go-genproto v0.0.0-20211115083454-9ca41db5ed9e // indirect
-	github.com/ydb-platform/ydb-go-genproto v0.0.0-20260311095541-ebbf792c1180 // indirect
+	github.com/ydb-platform/ydb-go-genproto v0.0.0-20251125145508-6d7ef87db5cb // indirect
 	github.com/ydb-platform/ydb-go-yc v0.12.1 // indirect
 	github.com/ydb-platform/ydb-go-yc-metadata v0.6.1 // indirect
 	github.com/yunify/qingstor-sdk-go/v3 v3.2.0 // indirect
@@ -492,14 +489,14 @@ require (
 	go.opentelemetry.io/contrib/detectors/gcp v1.39.0 // indirect
 	go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.63.0 // indirect
 	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.63.0 // indirect
-	go.opentelemetry.io/otel v1.43.0 // indirect
-	go.opentelemetry.io/otel/metric v1.43.0 // indirect
-	go.opentelemetry.io/otel/sdk v1.43.0 // indirect
-	go.opentelemetry.io/otel/sdk/metric v1.43.0 // indirect
-	go.opentelemetry.io/otel/trace v1.43.0 // indirect
+	go.opentelemetry.io/otel v1.42.0 // indirect
+	go.opentelemetry.io/otel/metric v1.42.0 // indirect
+	go.opentelemetry.io/otel/sdk v1.42.0 // indirect
+	go.opentelemetry.io/otel/sdk/metric v1.42.0 // indirect
+	go.opentelemetry.io/otel/trace v1.42.0 // indirect
 	go.uber.org/multierr v1.11.0 // indirect
 	go.uber.org/zap v1.27.1 // indirect
-	golang.org/x/term v0.42.0
+	golang.org/x/term v0.41.0 // indirect
 	golang.org/x/time v0.15.0 // indirect
 	google.golang.org/genproto/googleapis/api v0.0.0-20260316180232-0b37fe3546d5 // indirect
 	google.golang.org/genproto/googleapis/rpc v0.0.0-20260319201613-d00831a3d3e7 // indirect
@@ -692,8 +692,8 @@ github.com/antlr4-go/antlr/v4 v4.13.1/go.mod h1:GKmUxMtwp6ZgGwZSva4eWPC5mS6vUAmO
 github.com/apache/arrow-go/v18 v18.5.2-0.20260220015023-a886a5722b87 h1:r/gg2gzUXiXoy72VU3jnODh8l/5rL0aslnTAbtmai/U=
 github.com/apache/arrow-go/v18 v18.5.2-0.20260220015023-a886a5722b87/go.mod h1:IJTMBTlHe7cDOhRh0ioGuEKBl5iTR6xPfl5BN4AgirU=
 github.com/apache/arrow/go/v10 v10.0.1/go.mod h1:YvhnlEePVnBS4+0z3fhPfUy7W1Ikj0Ih0vcRo/gZ1M0=
-github.com/apache/cassandra-gocql-driver/v2 v2.1.0 h1:VEbbeJ2ift4deKMZ6Fs55Vs3fq/RrkjCcxCnqUxhwf8=
-github.com/apache/cassandra-gocql-driver/v2 v2.1.0/go.mod h1:QH/asJjB3mHvY6Dot6ZKMMpTcOrWJ8i9GhsvG1g0PK4=
+github.com/apache/cassandra-gocql-driver/v2 v2.0.0 h1:Omnzb1Z/P90Dr2TbVNu54ICQL7TKVIIsJO231w484HU=
+github.com/apache/cassandra-gocql-driver/v2 v2.0.0/go.mod h1:QH/asJjB3mHvY6Dot6ZKMMpTcOrWJ8i9GhsvG1g0PK4=
 github.com/apache/iceberg-go v0.5.0 h1:wQj4CK5YiXZcB+tj19gWG+Jf1I6MiORQ/StSL/E5gGQ=
 github.com/apache/iceberg-go v0.5.0/go.mod h1:F/rdP1yZmnO4mQ0Qew2HTGdc+ZV57cRfxbbq/uJm1eM=
 github.com/apache/thrift v0.16.0/go.mod h1:PHK3hniurgQaNMZYaCLEqXKsYK8upmhPbmdP2FXSqgU=
@@ -718,8 +718,8 @@ github.com/aws/aws-sdk-go-v2 v1.41.5 h1:dj5kopbwUsVUVFgO4Fi5BIT3t4WyqIDjGKCangnV
 github.com/aws/aws-sdk-go-v2 v1.41.5/go.mod h1:mwsPRE8ceUUpiTgF7QmQIJ7lgsKUPQOUl3o72QBrE1o=
 github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.8 h1:eBMB84YGghSocM7PsjmmPffTa+1FBUeNvGvFou6V/4o=
 github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.8/go.mod h1:lyw7GFp3qENLh7kwzf7iMzAxDn+NzjXEAGjKS2UOKqI=
-github.com/aws/aws-sdk-go-v2/config v1.32.14 h1:opVIRo/ZbbI8OIqSOKmpFaY7IwfFUOCCXBsUpJOwDdI=
-github.com/aws/aws-sdk-go-v2/config v1.32.14/go.mod h1:U4/V0uKxh0Tl5sxmCBZ3AecYny4UNlVmObYjKuuaiOo=
+github.com/aws/aws-sdk-go-v2/config v1.32.13 h1:5KgbxMaS2coSWRrx9TX/QtWbqzgQkOdEa3sZPhBhCSg=
+github.com/aws/aws-sdk-go-v2/config v1.32.13/go.mod h1:8zz7wedqtCbw5e9Mi2doEwDyEgHcEE9YOJp6a8jdSMY=
 github.com/aws/aws-sdk-go-v2/credentials v1.19.14 h1:n+UcGWAIZHkXzYt87uMFBv/l8THYELoX6gVcUvgl6fI=
 github.com/aws/aws-sdk-go-v2/credentials v1.19.14/go.mod h1:cJKuyWB59Mqi0jM3nFYQRmnHVQIcgoxjEMAbLkpr62w=
 github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.21 h1:NUS3K4BTDArQqNu2ih7yeDLaS3bmHD0YndtA6UP884g=
@@ -742,8 +742,8 @@ github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.21 h1:c31//R3x
 github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.21/go.mod h1:r6+pf23ouCB718FUxaqzZdbpYFyDtehyZcmP5KL9FkA=
 github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.19.21 h1:ZlvrNcHSFFWURB8avufQq9gFsheUgjVD9536obIknfM=
 github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.19.21/go.mod h1:cv3TNhVrssKR0O/xxLJVRfd2oazSnZnkUeTf6ctUwfQ=
-github.com/aws/aws-sdk-go-v2/service/s3 v1.99.0 h1:hlSuz394kV0vhv9drL5lhuEFbEOEP1VyQpy15qWh1Pk=
-github.com/aws/aws-sdk-go-v2/service/s3 v1.99.0/go.mod h1:uoA43SdFwacedBfSgfFSjjCvYe8aYBS7EnU5GZ/YKMM=
+github.com/aws/aws-sdk-go-v2/service/s3 v1.98.0 h1:foqo/ocQ7WqKwy3FojGtZQJo0FR4vto9qnz9VaumbCo=
+github.com/aws/aws-sdk-go-v2/service/s3 v1.98.0/go.mod h1:uoA43SdFwacedBfSgfFSjjCvYe8aYBS7EnU5GZ/YKMM=
 github.com/aws/aws-sdk-go-v2/service/signin v1.0.9 h1:QKZH0S178gCmFEgst8hN0mCX1KxLgHBKKY/CLqwP8lg=
 github.com/aws/aws-sdk-go-v2/service/signin v1.0.9/go.mod h1:7yuQJoT+OoH8aqIxw9vwF+8KpvLZ8AWmvmUWHsGQZvI=
 github.com/aws/aws-sdk-go-v2/service/sns v1.39.7 h1:fovS7qGMT+BBSuifkySdVaMWxXTyaYT6qaBx/1y6Ij4=
@@ -1783,8 +1783,6 @@ github.com/quic-go/quic-go v0.57.0 h1:AsSSrrMs4qI/hLrKlTH/TGQeTMY0ib1pAOX7vA3Adq
 github.com/quic-go/quic-go v0.57.0/go.mod h1:ly4QBAjHA2VhdnxhojRsCUOeJwKYg+taDlos92xb1+s=
 github.com/rabbitmq/amqp091-go v1.10.0 h1:STpn5XsHlHGcecLmMFCtg7mqq0RnD+zFr4uzukfVhBw=
 github.com/rabbitmq/amqp091-go v1.10.0/go.mod h1:Hy4jKW5kQART1u+JkDTF9YYOQUHXqMuhrgxOEeS7G4o=
-github.com/rasky/go-xdr v0.0.0-20170124162913-1a41d1a06c93 h1:UVArwN/wkKjMVhh2EQGC0tEc1+FqiLlvYXY5mQ2f8Wg=
-github.com/rasky/go-xdr v0.0.0-20170124162913-1a41d1a06c93/go.mod h1:Nfe4efndBz4TibWycNE+lqyJZiMX4ycx+QKV8Ta0f/o=
 github.com/rclone/Proton-API-Bridge v1.0.1-0.20260127174007-77f974840d11 h1:4MI2alxM/Ye2gIRBlYf28JGWTipZ4Zz7yAziPKrttjs=
 github.com/rclone/Proton-API-Bridge v1.0.1-0.20260127174007-77f974840d11/go.mod h1:3HLX7dwZgvB7nt+Yl/xdzVPcargQ1yBmJEUg3n+jMKM=
 github.com/rclone/go-proton-api v1.0.1-0.20260127173028-eb465cac3b18 h1:Lc+d3ISfQaMJKWZOE7z4ZSY4RVmdzbn1B0IM8xN18qM=
@@ -2028,10 +2026,6 @@ github.com/vmihailenco/msgpack/v5 v5.4.1 h1:cQriyiUvjTwOHg8QZaPihLWeRAAVoCpE00IU
 github.com/vmihailenco/msgpack/v5 v5.4.1/go.mod h1:GaZTsDaehaPpQVyxrf5mtQlH+pc21PIudVV/E3rRQok=
 github.com/vmihailenco/tagparser/v2 v2.0.0 h1:y09buUbR+b5aycVFQs/g70pqKVZNBmxwAhO7/IwNM9g=
 github.com/vmihailenco/tagparser/v2 v2.0.0/go.mod h1:Wri+At7QHww0WTrCBeu4J6bNtoV6mEfg5OIWRZA9qds=
-github.com/willscott/go-nfs v0.0.3 h1:Z5fHVxMsppgEucdkKBN26Vou19MtEM875NmRwj156RE=
-github.com/willscott/go-nfs v0.0.3/go.mod h1:VhNccO67Oug787VNXcyx9JDI3ZoSpqoKMT/lWMhUIDg=
-github.com/willscott/go-nfs-client v0.0.0-20251022144359-801f10d98886 h1:DtrBtkgTJk2XGt4T7eKdKVkd9A5NCevN2e4inLXtsqA=
-github.com/willscott/go-nfs-client v0.0.0-20251022144359-801f10d98886/go.mod h1:Tq++Lr/FgiS3X48q5FETemXiSLGuYMQT2sPjYNPJSwA=
 github.com/wk8/go-ordered-map/v2 v2.1.8 h1:5h/BUHu93oj4gIdvHHHGsScSTMijfx5PeYkE/fJgbpc=
 github.com/wk8/go-ordered-map/v2 v2.1.8/go.mod h1:5nJHM5DyteebpVlHnWMV0rPz6Zp7+xBAnxjb1X5vnTw=
 github.com/wsxiaoys/terminal v0.0.0-20160513160801-0940f3fc43a0 h1:3UeQBvD0TFrlVjOeLOBz+CPAI8dnbqNSVwUwRrkp7vQ=
@@ -2064,14 +2058,14 @@ github.com/yandex-cloud/go-genproto v0.0.0-20211115083454-9ca41db5ed9e h1:9LPdmD
 github.com/yandex-cloud/go-genproto v0.0.0-20211115083454-9ca41db5ed9e/go.mod h1:HEUYX/p8966tMUHHT+TsS0hF/Ca/NYwqprC5WXSDMfE=
 github.com/ydb-platform/ydb-go-genproto v0.0.0-20221215182650-986f9d10542f/go.mod h1:Er+FePu1dNUieD+XTMDduGpQuCPssK5Q4BjF+IIXJ3I=
 github.com/ydb-platform/ydb-go-genproto v0.0.0-20230528143953-42c825ace222/go.mod h1:Er+FePu1dNUieD+XTMDduGpQuCPssK5Q4BjF+IIXJ3I=
-github.com/ydb-platform/ydb-go-genproto v0.0.0-20260311095541-ebbf792c1180 h1:avIdi8eGXjKbn1WLokNR1Ofnz1k8t7tJ88YQLD/iCi8=
-github.com/ydb-platform/ydb-go-genproto v0.0.0-20260311095541-ebbf792c1180/go.mod h1:Er+FePu1dNUieD+XTMDduGpQuCPssK5Q4BjF+IIXJ3I=
+github.com/ydb-platform/ydb-go-genproto v0.0.0-20251125145508-6d7ef87db5cb h1:LZ6dhVfWzhicf/P5Xh7fA0Jd7rfGduxmB2QZpD+Lz9Q=
+github.com/ydb-platform/ydb-go-genproto v0.0.0-20251125145508-6d7ef87db5cb/go.mod h1:Er+FePu1dNUieD+XTMDduGpQuCPssK5Q4BjF+IIXJ3I=
 github.com/ydb-platform/ydb-go-sdk-auth-environ v0.5.1 h1:XaRxeVrOyl3y6v9CiYMWaFdZ6zevvYe+TRxOR8ifa2s=
 github.com/ydb-platform/ydb-go-sdk-auth-environ v0.5.1/go.mod h1:9YzkhlIymWaJGX6KMU3vh5sOf3UKbCXkG/ZdjaI3zNM=
 github.com/ydb-platform/ydb-go-sdk/v3 v3.44.0/go.mod h1:oSLwnuilwIpaF5bJJMAofnGgzPJusoI3zWMNb8I+GnM=
 github.com/ydb-platform/ydb-go-sdk/v3 v3.47.3/go.mod h1:bWnOIcUHd7+Sl7DN+yhyY1H/I61z53GczvwJgXMgvj0=
-github.com/ydb-platform/ydb-go-sdk/v3 v3.134.0 h1:Voog4d56wPNT8JQvbgN6QPdZ1gKG36YM5615PJB/XpM=
-github.com/ydb-platform/ydb-go-sdk/v3 v3.134.0/go.mod h1:VYUUkRJkKuQPkIpgtZJj6+58Fa2g8ccAqdmaaK6HP5k=
+github.com/ydb-platform/ydb-go-sdk/v3 v3.125.3 h1:hTwpF+PdbuR7vcixN+4AC6yu4asaUIAljQCxL51eDII=
+github.com/ydb-platform/ydb-go-sdk/v3 v3.125.3/go.mod h1:stS1mQYjbJvwwYaYzKyFY9eMiuVXWWXQA6T+SpOLg9c=
 github.com/ydb-platform/ydb-go-yc v0.12.1 h1:qw3Fa+T81+Kpu5Io2vYHJOwcrYrVjgJlT6t/0dOXJrA=
 github.com/ydb-platform/ydb-go-yc v0.12.1/go.mod h1:t/ZA4ECdgPWjAb4jyDe8AzQZB5dhpGbi3iCahFaNwBY=
 github.com/ydb-platform/ydb-go-yc-metadata v0.6.1 h1:9E5q8Nsy2RiJMZDNVy0A3KUrIMBPakJ2VgloeWbcI84=
@@ -2134,8 +2128,8 @@ go.opentelemetry.io/contrib/instrumentation/net/http/httptrace/otelhttptrace v0.
 go.opentelemetry.io/contrib/instrumentation/net/http/httptrace/otelhttptrace v0.60.0/go.mod h1:CosX/aS4eHnG9D7nESYpV753l4j9q5j3SL/PUYd2lR8=
 go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.63.0 h1:RbKq8BG0FI8OiXhBfcRtqqHcZcka+gU3cskNuf05R18=
 go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.63.0/go.mod h1:h06DGIukJOevXaj/xrNjhi/2098RZzcLTbc0jDAUbsg=
-go.opentelemetry.io/otel v1.43.0 h1:mYIM03dnh5zfN7HautFE4ieIig9amkNANT+xcVxAj9I=
-go.opentelemetry.io/otel v1.43.0/go.mod h1:JuG+u74mvjvcm8vj8pI5XiHy1zDeoCS2LB1spIq7Ay0=
+go.opentelemetry.io/otel v1.42.0 h1:lSQGzTgVR3+sgJDAU/7/ZMjN9Z+vUip7leaqBKy4sho=
+go.opentelemetry.io/otel v1.42.0/go.mod h1:lJNsdRMxCUIWuMlVJWzecSMuNjE7dOYyWlqOXWkdqCc=
 go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v1.38.0 h1:vl9obrcoWVKp/lwl8tRE33853I8Xru9HFbw/skNeLs8=
 go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v1.38.0/go.mod h1:GAXRxmLJcVM3u22IjTg74zWBrRCKq8BnOqUVLodpcpw=
 go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp v1.35.0 h1:0NIXxOCFx+SKbhCVxwl3ETG8ClLPAa0KuKV6p3yhxP8=
@@ -2150,14 +2144,14 @@ go.opentelemetry.io/otel/exporters/stdout/stdoutmetric v1.39.0 h1:5gn2urDL/FBnK8
 go.opentelemetry.io/otel/exporters/stdout/stdoutmetric v1.39.0/go.mod h1:0fBG6ZJxhqByfFZDwSwpZGzJU671HkwpWaNe2t4VUPI=
 go.opentelemetry.io/otel/exporters/zipkin v1.36.0 h1:s0n95ya5tOG03exJ5JySOdJFtwGo4ZQ+KeY7Zro4CLI=
 go.opentelemetry.io/otel/exporters/zipkin v1.36.0/go.mod h1:m9wRxtKA2MZ1HcnNC4BKI+9aYe434qRZTCvI7QGUN7Y=
-go.opentelemetry.io/otel/metric v1.43.0 h1:d7638QeInOnuwOONPp4JAOGfbCEpYb+K6DVWvdxGzgM=
-go.opentelemetry.io/otel/metric v1.43.0/go.mod h1:RDnPtIxvqlgO8GRW18W6Z/4P462ldprJtfxHxyKd2PY=
-go.opentelemetry.io/otel/sdk v1.43.0 h1:pi5mE86i5rTeLXqoF/hhiBtUNcrAGHLKQdhg4h4V9Dg=
-go.opentelemetry.io/otel/sdk v1.43.0/go.mod h1:P+IkVU3iWukmiit/Yf9AWvpyRDlUeBaRg6Y+C58QHzg=
-go.opentelemetry.io/otel/sdk/metric v1.43.0 h1:S88dyqXjJkuBNLeMcVPRFXpRw2fuwdvfCGLEo89fDkw=
-go.opentelemetry.io/otel/sdk/metric v1.43.0/go.mod h1:C/RJtwSEJ5hzTiUz5pXF1kILHStzb9zFlIEe85bhj6A=
-go.opentelemetry.io/otel/trace v1.43.0 h1:BkNrHpup+4k4w+ZZ86CZoHHEkohws8AY+WTX09nk+3A=
-go.opentelemetry.io/otel/trace v1.43.0/go.mod h1:/QJhyVBUUswCphDVxq+8mld+AvhXZLhe+8WVFxiFff0=
+go.opentelemetry.io/otel/metric v1.42.0 h1:2jXG+3oZLNXEPfNmnpxKDeZsFI5o4J+nz6xUlaFdF/4=
+go.opentelemetry.io/otel/metric v1.42.0/go.mod h1:RlUN/7vTU7Ao/diDkEpQpnz3/92J9ko05BIwxYa2SSI=
+go.opentelemetry.io/otel/sdk v1.42.0 h1:LyC8+jqk6UJwdrI/8VydAq/hvkFKNHZVIWuslJXYsDo=
+go.opentelemetry.io/otel/sdk v1.42.0/go.mod h1:rGHCAxd9DAph0joO4W6OPwxjNTYWghRWmkHuGbayMts=
+go.opentelemetry.io/otel/sdk/metric v1.42.0 h1:D/1QR46Clz6ajyZ3G8SgNlTJKBdGp84q9RKCAZ3YGuA=
+go.opentelemetry.io/otel/sdk/metric v1.42.0/go.mod h1:Ua6AAlDKdZ7tdvaQKfSmnFTdHx37+J4ba8MwVCYM5hc=
+go.opentelemetry.io/otel/trace v1.42.0 h1:OUCgIPt+mzOnaUTpOQcBiM/PLQ/Op7oq6g4LenLmOYY=
+go.opentelemetry.io/otel/trace v1.42.0/go.mod h1:f3K9S+IFqnumBkKhRJMeaZeNk9epyhnCmQh/EysQCdc=
 go.opentelemetry.io/proto/otlp v0.7.0/go.mod h1:PqfVotwruBrMGOCsRd/89rSnXhoiJIqeYNgFYFoEGnI=
 go.opentelemetry.io/proto/otlp v0.15.0/go.mod h1:H7XAot3MsfNsj7EXtrA2q5xSNQ10UqI405h3+duxN4U=
 go.opentelemetry.io/proto/otlp v0.19.0/go.mod h1:H7XAot3MsfNsj7EXtrA2q5xSNQ10UqI405h3+duxN4U=
@@ -2214,8 +2208,8 @@ golang.org/x/crypto v0.14.0/go.mod h1:MVFd36DqK4CsrnJYDkBA3VC4m2GkXAM0PvzMCn4JQf
 golang.org/x/crypto v0.19.0/go.mod h1:Iy9bg/ha4yyC70EfRS8jz+B6ybOBKMaSxLj6P6oBDfU=
 golang.org/x/crypto v0.23.0/go.mod h1:CKFgDieR+mRhux2Lsu27y0fO304Db0wZe70UKqHu0v8=
 golang.org/x/crypto v0.31.0/go.mod h1:kDsLvtWBEx7MV9tJOj9bnXsPbxwJQ6csT/x4KIN4Ssk=
-golang.org/x/crypto v0.50.0 h1:zO47/JPrL6vsNkINmLoo/PH1gcxpls50DNogFvB5ZGI=
-golang.org/x/crypto v0.50.0/go.mod h1:3muZ7vA7PBCE6xgPX7nkzzjiUq87kRItoJQM1Yo8S+Q=
+golang.org/x/crypto v0.49.0 h1:+Ng2ULVvLHnJ/ZFEq4KdcDd/cfjrrjjNSXNzxg0Y4U4=
+golang.org/x/crypto v0.49.0/go.mod h1:ErX4dUh2UM+CFYiXZRTcMpEcN8b/1gxEuv3nODoYtCA=
 golang.org/x/exp v0.0.0-20180321215751-8460e604b9de/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20180807140117-3d87b88a115f/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
@@ -2281,8 +2275,8 @@ golang.org/x/mod v0.12.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
 golang.org/x/mod v0.13.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
 golang.org/x/mod v0.15.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
 golang.org/x/mod v0.17.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
-golang.org/x/mod v0.34.0 h1:xIHgNUUnW6sYkcM5Jleh05DvLOtwc6RitGHbDk4akRI=
-golang.org/x/mod v0.34.0/go.mod h1:ykgH52iCZe79kzLLMhyCUzhMci+nQj+0XkbXpNYtVjY=
+golang.org/x/mod v0.33.0 h1:tHFzIWbBifEmbwtGz65eaWyGiGZatSrT9prnU8DbVL8=
+golang.org/x/mod v0.33.0/go.mod h1:swjeQEj+6r7fODbD2cqrnje9PnziFuw4bmLbBZFrQ5w=
 golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20180826012351-8a410e7b638d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20180906233101-161cd47e91fd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
@@ -2350,8 +2344,8 @@ golang.org/x/net v0.16.0/go.mod h1:NxSsAGuq816PNPmqtQdLE42eU2Fs7NoRIZrHJAlaCOE=
 golang.org/x/net v0.21.0/go.mod h1:bIjVDfnllIU7BJ2DNgfnXvpSvtn8VRwhlsaeUTyUS44=
 golang.org/x/net v0.25.0/go.mod h1:JkAGAh7GEvH74S6FOH42FLoXpXbE/aqXSrIQjXgsiwM=
 golang.org/x/net v0.33.0/go.mod h1:HXLR5J+9DxmrqMwG9qjGCxZ+zKXxBru04zlTvWlWuN4=
-golang.org/x/net v0.53.0 h1:d+qAbo5L0orcWAr0a9JweQpjXF19LMXJE8Ey7hwOdUA=
-golang.org/x/net v0.53.0/go.mod h1:JvMuJH7rrdiCfbeHoo3fCQU24Lf5JJwT9W3sJFulfgs=
+golang.org/x/net v0.52.0 h1:He/TN1l0e4mmR3QqHMT2Xab3Aj3L9qjbhRm78/6jrW0=
+golang.org/x/net v0.52.0/go.mod h1:R1MAz7uMZxVMualyPXb+VaqGSa3LIaUqk0eEt3w36Sw=
 golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
 golang.org/x/oauth2 v0.0.0-20190226205417-e64efc72b421/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
 golang.org/x/oauth2 v0.0.0-20190604053449-0f29369cfe45/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
@@ -2509,11 +2503,11 @@ golang.org/x/sys v0.13.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.17.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/sys v0.20.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/sys v0.28.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
-golang.org/x/sys v0.43.0 h1:Rlag2XtaFTxp19wS8MXlJwTvoh8ArU6ezoyFsMyCTNI=
-golang.org/x/sys v0.43.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
+golang.org/x/sys v0.42.0 h1:omrd2nAlyT5ESRdCLYdm3+fMfNFE/+Rf4bDIQImRJeo=
+golang.org/x/sys v0.42.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
 golang.org/x/telemetry v0.0.0-20240228155512-f48c80bd79b2/go.mod h1:TeRTkGYfJXctD9OcfyVLyj2J3IxLnKwHJR8f4D8a3YE=
-golang.org/x/telemetry v0.0.0-20260311193753-579e4da9a98c h1:6a8FdnNk6bTXBjR4AGKFgUKuo+7GnR3FX5L7CbveeZc=
-golang.org/x/telemetry v0.0.0-20260311193753-579e4da9a98c/go.mod h1:TpUTTEp9frx7rTdLpC9gFG9kdI7zVLFTFFlqaH2Cncw=
+golang.org/x/telemetry v0.0.0-20260209163413-e7419c687ee4 h1:bTLqdHv7xrGlFbvf5/TXNxy/iUwwdkjhqQTJDjW7aj0=
+golang.org/x/telemetry v0.0.0-20260209163413-e7419c687ee4/go.mod h1:g5NllXBEermZrmR51cJDQxmJUHUOfRAaNyWBM+R+548=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/term v0.0.0-20210220032956-6a3ed077a48d/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/term v0.0.0-20210615171337-6886f2dfbf5b/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
@@ -2529,8 +2523,8 @@ golang.org/x/term v0.13.0/go.mod h1:LTmsnFJwVN6bCy1rVCoS+qHT1HhALEFxKncY3WNNh4U=
 golang.org/x/term v0.17.0/go.mod h1:lLRBjIVuehSbZlaOtGMbcMncT+aqLLLmKrsjNrUguwk=
 golang.org/x/term v0.20.0/go.mod h1:8UkIAJTvZgivsXaD6/pH6U9ecQzZ45awqEOzuCvwpFY=
 golang.org/x/term v0.27.0/go.mod h1:iMsnZpn0cago0GOrHO2+Y7u7JPn5AylBrcoWkElMTSM=
-golang.org/x/term v0.42.0 h1:UiKe+zDFmJobeJ5ggPwOshJIVt6/Ft0rcfrXZDLWAWY=
-golang.org/x/term v0.42.0/go.mod h1:Dq/D+snpsbazcBG5+F9Q1n2rXV8Ma+71xEjTRufARgY=
+golang.org/x/term v0.41.0 h1:QCgPso/Q3RTJx2Th4bDLqML4W6iJiaXFq2/ftQF13YU=
+golang.org/x/term v0.41.0/go.mod h1:3pfBgksrReYfZ5lvYM0kSO0LIkAl4Yl2bXOkKP7Ec2A=
 golang.org/x/text v0.0.0-20170915032832-14c0d48ead0c/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.1-0.20180807135948-17ff2d5776d2/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
@@ -2551,8 +2545,8 @@ golang.org/x/text v0.13.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE=
 golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
 golang.org/x/text v0.15.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
 golang.org/x/text v0.21.0/go.mod h1:4IBbMaMmOPCJ8SecivzSH54+73PCFmPWxNTLm+vZkEQ=
-golang.org/x/text v0.36.0 h1:JfKh3XmcRPqZPKevfXVpI1wXPTqbkE5f7JA92a55Yxg=
-golang.org/x/text v0.36.0/go.mod h1:NIdBknypM8iqVmPiuco0Dh6P5Jcdk8lJL0CUebqK164=
+golang.org/x/text v0.35.0 h1:JOVx6vVDFokkpaq1AEptVzLTpDe9KGpj5tR4/X+ybL8=
+golang.org/x/text v0.35.0/go.mod h1:khi/HExzZJ2pGnjenulevKNX1W67CUy0AsXcNubPGCA=
 golang.org/x/time v0.0.0-20181108054448-85acf8d2951c/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20190308202827-9d24e82272b4/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20191024005414-555d28b269f0/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
@@ -2630,8 +2624,8 @@ golang.org/x/tools v0.7.0/go.mod h1:4pg6aUX35JBAogB10C9AtvVL+qowtN4pT3CGSQex14s=
 golang.org/x/tools v0.13.0/go.mod h1:HvlwmtVNQAhOuCjW7xxvovg8wbNq7LwfXh/k7wXUl58=
 golang.org/x/tools v0.14.0/go.mod h1:uYBEerGOWcJyEORxN+Ek8+TT266gXkNlHdJBwexUsBg=
 golang.org/x/tools v0.21.1-0.20240508182429-e35e4ccd0d2d/go.mod h1:aiJjzUbINMkxbQROHiO6hDPo2LHcIPhhQsa9DLh0yGk=
-golang.org/x/tools v0.43.0 h1:12BdW9CeB3Z+J/I/wj34VMl8X+fEXBxVR90JeMX5E7s=
-golang.org/x/tools v0.43.0/go.mod h1:uHkMso649BX2cZK6+RpuIPXS3ho2hZo4FVwfoy1vIk0=
+golang.org/x/tools v0.42.0 h1:uNgphsn75Tdz5Ji2q36v/nsFSfR/9BRFvqhGBaJGd5k=
+golang.org/x/tools v0.42.0/go.mod h1:Ma6lCIwGZvHK6XtgbswSoWroEkhugApmsXyrUmBhfr0=
 golang.org/x/tools/godoc v0.1.0-deprecated h1:o+aZ1BOj6Hsx/GBdJO/s815sqftjSnrZZwyYTHODvtk=
 golang.org/x/tools/godoc v0.1.0-deprecated/go.mod h1:qM63CriJ961IHWmnWa9CjZnBndniPt4a3CK0PVB9bIg=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
@@ -1,6 +1,6 @@
 apiVersion: v1
 description: SeaweedFS
 name: seaweedfs
-appVersion: "4.20"
+appVersion: "4.18"
 # Dev note: Trigger a helm chart release by `git tag -a helm-<version>`
-version: 4.20.0
+version: 4.18.0
@@ -49,35 +49,6 @@ CREATE TABLE IF NOT EXISTS `filemeta` (

 Alternative database can also be configured (e.g. leveldb, postgres) following the instructions at `filer.extraEnvironmentVars`.

-#### RocksDB variant
-
-The `_large_disk_rocksdb` image tag ships with RocksDB pre-configured as the filer backend.
-To use this image with the Helm chart, override the image on all three components and disable
-the chart's default `WEED_LEVELDB2_ENABLED`, which would otherwise re-enable LevelDB2 and
-override the image's built-in RocksDB configuration:
-
-```yaml
-# Replace <VERSION> with the desired seaweedfs version, e.g. 3.80_large_disk_rocksdb.
-master:
-  imageOverride: chrislusf/seaweedfs:<VERSION>_large_disk_rocksdb
-
-volume:
-  imageOverride: chrislusf/seaweedfs:<VERSION>_large_disk_rocksdb
-
-filer:
-  enablePVC: true
-  imageOverride: chrislusf/seaweedfs:<VERSION>_large_disk_rocksdb
-  extraEnvironmentVars:
-    WEED_LEVELDB2_ENABLED: "false"
-```
-
-Notes:
-
-* `master` and `volume` use the same image tag so that all components share a consistent
-  SeaweedFS build; RocksDB itself is only used by the filer.
-* `filer.enablePVC: true` (or another form of persistent storage for the filer) is required
-  so that the RocksDB metadata store survives pod restarts — otherwise metadata will be lost.
-
 ### Node Labels
 Kubernetes nodes can have labels which help to define which node(Host) will run which pod:

@@ -82,7 +82,7 @@ spec:
      {{- end }}
      containers:
        - name: seaweedfs
-          image: {{ template "seaweedfs.admin.image" . }}
+          image: {{ template "admin.image" . }}
          imagePullPolicy: {{ default "IfNotPresent" .Values.global.seaweedfs.imagePullPolicy }}
          {{- $adminAuthEnabled := or .Values.admin.secret.existingSecret .Values.admin.secret.adminPassword }}
          {{- $urlPrefix := .Values.admin.urlPrefix }}
@@ -242,7 +242,7 @@ spec:
          securityContext: {{- omit .Values.admin.containerSecurityContext "enabled" | toYaml | nindent 12 }}
          {{- end }}
      {{- if .Values.admin.sidecars }}
-      {{- include "seaweedfs.tplvalues.render" (dict "value" .Values.admin.sidecars "context" $) | nindent 8 }}
+      {{- include "common.tplvalues.render" (dict "value" .Values.admin.sidecars "context" $) | nindent 8 }}
      {{- end }}
      volumes:
        {{- if eq .Values.admin.data.type "hostPath" }}
@@ -303,7 +303,7 @@ spec:
      nodeSelector:
        {{ tpl .Values.admin.nodeSelector . | indent 8 | trim }}
      {{- end }}
-  {{- $pvc_exists := include "seaweedfs.admin.pvc_exists" . -}}
+  {{- $pvc_exists := include "admin.pvc_exists" . -}}
  {{- if $pvc_exists }}
  volumeClaimTemplates:
    {{- if eq .Values.admin.data.type "persistentVolumeClaim" }}
@@ -77,7 +77,7 @@ spec:
      {{- end }}
      containers:
        - name: seaweedfs
-          image: {{ template "seaweedfs.master.image" . }}
+          image: {{ template "master.image" . }}
          imagePullPolicy: {{ default "IfNotPresent" .Values.global.seaweedfs.imagePullPolicy }}
          env:
            {{- /* Determine default cluster alias and the corresponding env var keys to avoid conflicts */}}
@@ -418,7 +418,7 @@ spec:
            {{- omit .Values.allInOne.containerSecurityContext "enabled" | toYaml | nindent 12 }}
          {{- end }}
      {{- if .Values.allInOne.sidecars }}
-      {{- include "seaweedfs.tplvalues.render" (dict "value" .Values.allInOne.sidecars "context" $) | nindent 8 }}
+      {{- include "common.tplvalues.render" (dict "value" .Values.allInOne.sidecars "context" $) | nindent 8 }}
      {{- end }}
      volumes:
        - name: data
@@ -164,7 +164,7 @@ spec:
          securityContext: {{- omit .Values.cosi.containerSecurityContext "enabled" | toYaml | nindent 12 }}
          {{- end }}
      {{- if .Values.cosi.sidecars }}
-      {{- include "seaweedfs.tplvalues.render" (dict "value" .Values.cosi.sidecars "context" $) | nindent 8 }}
+      {{- include "common.tplvalues.render" (dict "value" .Values.cosi.sidecars "context" $) | nindent 8 }}
      {{- end }}
      volumes:
        - name: socket
@@ -86,7 +86,7 @@ spec:
      {{- end }}
      containers:
        - name: seaweedfs
-          image: {{ template "seaweedfs.filer.image" . }}
+          image: {{ template "filer.image" . }}
          imagePullPolicy: {{ default "IfNotPresent" .Values.global.seaweedfs.imagePullPolicy }}
          env:
            - name: POD_IP
@@ -317,7 +317,7 @@ spec:
          securityContext: {{- omit .Values.filer.containerSecurityContext "enabled" | toYaml | nindent 12 }}
          {{- end }}
        {{- if .Values.filer.sidecars }}
-        {{- include "seaweedfs.tplvalues.render" (dict "value" .Values.filer.sidecars "context" $) | nindent 8 }}
+        {{- include "common.tplvalues.render" (dict "value" .Values.filer.sidecars "context" $) | nindent 8 }}
        {{- end }}
      volumes:
        {{- if eq .Values.filer.logs.type "hostPath" }}
@@ -413,7 +413,7 @@ spec:
      storageClassName: {{ .Values.filer.storageClass }}
      {{- end }}
  {{- end }}
-  {{- $pvc_exists := include "seaweedfs.filer.pvc_exists" . -}}
+  {{- $pvc_exists := include "filer.pvc_exists" . -}}
  {{- if $pvc_exists }}
  volumeClaimTemplates:
    {{- if eq .Values.filer.data.type "persistentVolumeClaim" }}
@@ -80,7 +80,7 @@ spec:
      {{- end }}
      containers:
        - name: seaweedfs
-          image: {{ template "seaweedfs.master.image" . }}
+          image: {{ template "master.image" . }}
          imagePullPolicy: {{ default "IfNotPresent" .Values.global.seaweedfs.imagePullPolicy }}
          env:
            - name: POD_IP
@@ -251,7 +251,7 @@ spec:
          securityContext: {{- omit .Values.master.containerSecurityContext "enabled" | toYaml | nindent 12 }}
          {{- end }}
        {{- if .Values.master.sidecars }}
-        {{- include "seaweedfs.tplvalues.render" (dict "value" .Values.master.sidecars "context" $) | nindent 8 }}
+        {{- include "common.tplvalues.render" (dict "value" .Values.master.sidecars "context" $) | nindent 8 }}
        {{- end }}
      volumes:
        {{- if eq .Values.master.logs.type "hostPath" }}
@@ -312,7 +312,7 @@ spec:
      nodeSelector:
        {{ tpl .Values.master.nodeSelector . | indent 8 | trim }}
      {{- end }}
-  {{- $pvc_exists := include "seaweedfs.master.pvc_exists" . -}}
+  {{- $pvc_exists := include "master.pvc_exists" . -}}
  {{- if $pvc_exists }}
  volumeClaimTemplates:
    {{- if eq .Values.master.data.type "persistentVolumeClaim"}}
@@ -74,7 +74,7 @@ spec:
      {{- end }}
      containers:
        - name: seaweedfs
-          image: {{ template "seaweedfs.s3.image" . }}
+          image: {{ template "s3.image" . }}
          imagePullPolicy: {{ default "IfNotPresent" .Values.global.seaweedfs.imagePullPolicy }}
          env:
            - name: POD_IP
@@ -226,7 +226,7 @@ spec:
          securityContext: {{- omit .Values.s3.containerSecurityContext "enabled" | toYaml | nindent 12 }}
          {{- end }}
      {{- if .Values.s3.sidecars }}
-      {{- include "seaweedfs.tplvalues.render" (dict "value" .Values.s3.sidecars "context" $) | nindent 8 }}
+      {{- include "common.tplvalues.render" (dict "value" .Values.s3.sidecars "context" $) | nindent 8 }}
      {{- end }}
      volumes:
        {{- if .Values.s3.enableAuth }}
@@ -15,15 +15,15 @@
 {{- $access_key_admin := $adminCreds.accessKey -}}
 {{- $secret_key_admin := $adminCreds.secretKey -}}
 {{- if not (and $access_key_admin $secret_key_admin) -}}
-  {{- $access_key_admin = include "seaweedfs.getOrGeneratePassword" (dict "namespace" .Release.Namespace "secretName" $secretName "key" "admin_access_key_id" "length" 20 "existingSecret" (ternary $existingSecret nil $reuse)) -}}
-  {{- $secret_key_admin = include "seaweedfs.getOrGeneratePassword" (dict "namespace" .Release.Namespace "secretName" $secretName "key" "admin_secret_access_key" "length" 40 "existingSecret" (ternary $existingSecret nil $reuse)) -}}
+  {{- $access_key_admin = include "getOrGeneratePassword" (dict "namespace" .Release.Namespace "secretName" $secretName "key" "admin_access_key_id" "length" 20 "existingSecret" (ternary $existingSecret nil $reuse)) -}}
+  {{- $secret_key_admin = include "getOrGeneratePassword" (dict "namespace" .Release.Namespace "secretName" $secretName "key" "admin_secret_access_key" "length" 40 "existingSecret" (ternary $existingSecret nil $reuse)) -}}
 {{- end -}}
 {{- $readCreds := $creds.read | default dict -}}
 {{- $access_key_read := $readCreds.accessKey -}}
 {{- $secret_key_read := $readCreds.secretKey -}}
 {{- if not (and $access_key_read $secret_key_read) -}}
-  {{- $access_key_read = include "seaweedfs.getOrGeneratePassword" (dict "namespace" .Release.Namespace "secretName" $secretName "key" "read_access_key_id" "length" 20 "existingSecret" (ternary $existingSecret nil $reuse)) -}}
-  {{- $secret_key_read = include "seaweedfs.getOrGeneratePassword" (dict "namespace" .Release.Namespace "secretName" $secretName "key" "read_secret_access_key" "length" 40 "existingSecret" (ternary $existingSecret nil $reuse)) -}}
+  {{- $access_key_read = include "getOrGeneratePassword" (dict "namespace" .Release.Namespace "secretName" $secretName "key" "read_access_key_id" "length" 20 "existingSecret" (ternary $existingSecret nil $reuse)) -}}
+  {{- $secret_key_read = include "getOrGeneratePassword" (dict "namespace" .Release.Namespace "secretName" $secretName "key" "read_secret_access_key" "length" 40 "existingSecret" (ternary $existingSecret nil $reuse)) -}}
 {{- end -}}
 apiVersion: v1
 kind: Secret
@@ -1,10 +1,7 @@
 {{- include "seaweedfs.compat" . -}}
-{{- /*
-  The seaweedfs-s3 Service only gains a "metrics" port when the standalone S3
-  gateway is enabled. With only the embedded filer S3 gateway, metrics live on
-  the filer process and are already scraped by the filer ServiceMonitor.
-*/ -}}
-{{- if and .Values.s3.enabled .Values.s3.metricsPort .Values.global.seaweedfs.monitoring.enabled }}
+{{- if or .Values.s3.enabled .Values.filer.s3.enabled }}
+{{- if .Values.s3.metricsPort }}
+{{- if .Values.global.seaweedfs.monitoring.enabled }}
 apiVersion: monitoring.coreos.com/v1
 kind: ServiceMonitor
 metadata:
@@ -34,3 +31,5 @@ spec:
      app.kubernetes.io/instance: {{ .Release.Name }}
      app.kubernetes.io/component: s3
 {{- end }}
+{{- end }}
+{{- end }}
@@ -74,7 +74,7 @@ spec:
      {{- end }}
      containers:
        - name: seaweedfs
-          image: {{ template "seaweedfs.sftp.image" . }}
+          image: {{ template "sftp.image" . }}
          imagePullPolicy: {{ default "IfNotPresent" .Values.global.seaweedfs.imagePullPolicy }}
          env:
            - name: POD_IP
@@ -233,7 +233,7 @@ spec:
          securityContext: {{- omit .Values.sftp.containerSecurityContext "enabled" | toYaml | nindent 12 }}
          {{- end }}
      {{- if .Values.sftp.sidecars }}
-      {{- include "seaweedfs.tplvalues.render" (dict "value" .Values.sftp.sidecars "context" $) | nindent 8 }}
+      {{- include "common.tplvalues.render" (dict "value" .Values.sftp.sidecars "context" $) | nindent 8 }}
      {{- end }}
      volumes:
        {{- if .Values.sftp.enableAuth }}
@@ -1,8 +1,8 @@
 {{- if or .Values.sftp.enabled .Values.allInOne.enabled }}
 {{- $secretName := printf "%s-sftp-secret" (include "seaweedfs.fullname" .) }}
-{{- $admin_pwd := include "seaweedfs.getOrGeneratePassword" (dict "namespace" .Release.Namespace "secretName" $secretName "key" "admin_password" "length" 20) -}}
-{{- $read_user_pwd := include "seaweedfs.getOrGeneratePassword" (dict "namespace" .Release.Namespace "secretName" $secretName "key" "readonly_password" "length" 20) -}}
-{{- $public_user_pwd := include "seaweedfs.getOrGeneratePassword" (dict "namespace" .Release.Namespace "secretName" $secretName "key" "public_user_password" "length" 20) -}}
+{{- $admin_pwd := include "getOrGeneratePassword" (dict "namespace" .Release.Namespace "secretName" $secretName "key" "admin_password" 20) -}}
+{{- $read_user_pwd := include "getOrGeneratePassword" (dict "namespace" .Release.Namespace "secretName" $secretName "key" "readonly_password" 20) -}}
+{{- $public_user_pwd := include "getOrGeneratePassword" (dict "namespace" .Release.Namespace "secretName" $secretName "key" "public_user_password" 20) -}}
 apiVersion: v1
 kind: Secret
 type: Opaque
@@ -72,77 +72,77 @@ Inject extra environment vars in the format key:value, if populated
 {{- end -}}

 {{/* Return the proper filer image */}}
-{{- define "seaweedfs.filer.image" -}}
+{{- define "filer.image" -}}
 {{- if .Values.filer.imageOverride -}}
 {{- $imageOverride := .Values.filer.imageOverride -}}
 {{- printf "%s" $imageOverride -}}
 {{- else -}}
-{{- include "seaweedfs.image" . }}
+{{- include "common.image" . }}
 {{- end -}}
 {{- end -}}

 {{/* Return the proper master image */}}
-{{- define "seaweedfs.master.image" -}}
+{{- define "master.image" -}}
 {{- if .Values.master.imageOverride -}}
 {{- $imageOverride := .Values.master.imageOverride -}}
 {{- printf "%s" $imageOverride -}}
 {{- else -}}
-{{- include "seaweedfs.image" . }}
+{{- include "common.image" . }}
 {{- end -}}
 {{- end -}}

 {{/* Return the proper s3 image */}}
-{{- define "seaweedfs.s3.image" -}}
+{{- define "s3.image" -}}
 {{- if .Values.s3.imageOverride -}}
 {{- $imageOverride := .Values.s3.imageOverride -}}
 {{- printf "%s" $imageOverride -}}
 {{- else -}}
-{{- include "seaweedfs.image" . }}
+{{- include "common.image" . }}
 {{- end -}}
 {{- end -}}

 {{/* Return the proper sftp image */}}
-{{- define "seaweedfs.sftp.image" -}}
+{{- define "sftp.image" -}}
 {{- if .Values.sftp.imageOverride -}}
 {{- $imageOverride := .Values.sftp.imageOverride -}}
 {{- printf "%s" $imageOverride -}}
 {{- else -}}
-{{- include "seaweedfs.image" . }}
+{{- include "common.image" . }}
 {{- end -}}
 {{- end -}}

 {{/* Return the proper admin image */}}
-{{- define "seaweedfs.admin.image" -}}
+{{- define "admin.image" -}}
 {{- if .Values.admin.imageOverride -}}
 {{- $imageOverride := .Values.admin.imageOverride -}}
 {{- printf "%s" $imageOverride -}}
 {{- else -}}
-{{- include "seaweedfs.image" . }}
+{{- include "common.image" . }}
 {{- end -}}
 {{- end -}}

 {{/* Return the proper worker image */}}
-{{- define "seaweedfs.worker.image" -}}
+{{- define "worker.image" -}}
 {{- if .Values.worker.imageOverride -}}
 {{- $imageOverride := .Values.worker.imageOverride -}}
 {{- printf "%s" $imageOverride -}}
 {{- else -}}
-{{- include "seaweedfs.image" . }}
+{{- include "common.image" . }}
 {{- end -}}
 {{- end -}}

 {{/* Return the proper volume image */}}
-{{- define "seaweedfs.volume.image" -}}
+{{- define "volume.image" -}}
 {{- if .Values.volume.imageOverride -}}
 {{- $imageOverride := .Values.volume.imageOverride -}}
 {{- printf "%s" $imageOverride -}}
 {{- else -}}
-{{- include "seaweedfs.image" . }}
+{{- include "common.image" . }}
 {{- end -}}
 {{- end -}}

 {{/* Computes the container image name for all components (if they are not overridden) */}}
-{{- define "seaweedfs.image" -}}
+{{- define "common.image" -}}
 {{- $registryName := default .Values.image.registry .Values.global.imageRegistry | toString -}}
 {{- $repositoryName := default .Values.image.repository .Values.global.seaweedfs.image.repository | toString -}}
 {{- $name := .Values.global.seaweedfs.image.name | toString -}}
@@ -160,7 +160,7 @@ Inject extra environment vars in the format key:value, if populated
 {{- end -}}

 {{/* check if any Volume PVC exists */}}
-{{- define "seaweedfs.volume.pvc_exists" -}}
+{{- define "volume.pvc_exists" -}}
 {{- if or (or (eq .Values.volume.data.type "persistentVolumeClaim") (and (eq .Values.volume.idx.type "persistentVolumeClaim") .Values.volume.dir_idx )) (eq .Values.volume.logs.type "persistentVolumeClaim") -}}
 {{- printf "true" -}}
 {{- else -}}
@@ -169,7 +169,7 @@ Inject extra environment vars in the format key:value, if populated
 {{- end -}}

 {{/* check if any Filer PVC exists */}}
-{{- define "seaweedfs.filer.pvc_exists" -}}
+{{- define "filer.pvc_exists" -}}
 {{- if or (eq .Values.filer.data.type "persistentVolumeClaim") (eq .Values.filer.logs.type "persistentVolumeClaim") -}}
 {{- printf "true" -}}
 {{- else -}}
@@ -178,7 +178,7 @@ Inject extra environment vars in the format key:value, if populated
 {{- end -}}

 {{/* check if any Master PVC exists */}}
-{{- define "seaweedfs.master.pvc_exists" -}}
+{{- define "master.pvc_exists" -}}
 {{- if or (eq .Values.master.data.type "persistentVolumeClaim") (eq .Values.master.logs.type "persistentVolumeClaim") -}}
 {{- printf "true" -}}
 {{- else -}}
@@ -187,7 +187,7 @@ Inject extra environment vars in the format key:value, if populated
 {{- end -}}

 {{/* check if any Admin PVC exists */}}
-{{- define "seaweedfs.admin.pvc_exists" -}}
+{{- define "admin.pvc_exists" -}}
 {{- if or (eq .Values.admin.data.type "persistentVolumeClaim") (eq .Values.admin.logs.type "persistentVolumeClaim") -}}
 {{- printf "true" -}}
 {{- else -}}
@@ -196,7 +196,7 @@ Inject extra environment vars in the format key:value, if populated
 {{- end -}}

 {{/* check if any InitContainers exist for Volumes */}}
-{{- define "seaweedfs.volume.initContainers_exists" -}}
+{{- define "volume.initContainers_exists" -}}
 {{- if or (not (empty .Values.volume.idx )) (not (empty .Values.volume.initContainers )) -}}
 {{- printf "true" -}}
 {{- else -}}
@@ -225,10 +225,10 @@ imagePullSecrets:
 {{/*
 Renders a value that contains template perhaps with scope if the scope is present.
 Usage:
-{{ include "seaweedfs.tplvalues.render" ( dict "value" .Values.path.to.the.Value "context" $ ) }}
-{{ include "seaweedfs.tplvalues.render" ( dict "value" .Values.path.to.the.Value "context" $ "scope" $app ) }}
+{{ include "common.tplvalues.render" ( dict "value" .Values.path.to.the.Value "context" $ ) }}
+{{ include "common.tplvalues.render" ( dict "value" .Values.path.to.the.Value "context" $ "scope" $app ) }}
 */}}
-{{- define "seaweedfs.tplvalues.render" -}}
+{{- define "common.tplvalues.render" -}}
 {{- $value := typeIs "string" .value | ternary .value (.value | toYaml) }}
 {{- if contains "{{" (toJson .value) }}
  {{- if .scope }}
@@ -245,9 +245,9 @@ Usage:
 Converts a Kubernetes quantity like "256Mi" or "2G" to a float64 in base units,
 handling both binary (Ki, Mi, Gi) and decimal (m, k, M) suffixes; numeric inputs
 Usage:
-{{ include "seaweedfs.resource-quantity" "10Gi" }}
+{{ include "common.resource-quantity" "10Gi" }}
 */}}
-{{- define "seaweedfs.resource-quantity" -}}
+{{- define "common.resource-quantity" -}}
    {{- $value := . -}}
    {{- $unit := 1.0 -}}
    {{- if typeIs "string" . -}}
@@ -267,7 +267,7 @@ Usage:
 getOrGeneratePassword will check if a password exists in a secret and return it,
 or generate a new random password if it doesn't exist.
 */}}
-{{- define "seaweedfs.getOrGeneratePassword" -}}
+{{- define "getOrGeneratePassword" -}}
 {{- $params := . -}}
 {{- $namespace := $params.namespace -}}
 {{- $secretName := $params.secretName -}}
@@ -68,7 +68,7 @@ spec:
      {{- include "seaweedfs.imagePullSecrets" $ | nindent 6 }}
      containers:
      - name: post-install-job
-        image: {{ template "seaweedfs.master.image" . }}
+        image: {{ template "master.image" . }}
        imagePullPolicy: {{ $.Values.global.seaweedfs.imagePullPolicy | default "IfNotPresent" }}
        env:
          - name: WEED_CLUSTER_DEFAULT
@@ -35,8 +35,8 @@
 {{-             $pvcName := printf "%s-%s-%s-%d" $dir.name $seaweedfsName $volumeName $e }}
 {{-             $currentPVC := (lookup "v1" "PersistentVolumeClaim" $.Release.Namespace $pvcName) }}
 {{-             if and $currentPVC }}
-{{-             $oldSize := include "seaweedfs.resource-quantity" $currentPVC.spec.resources.requests.storage }}
-{{-             $newSize := include "seaweedfs.resource-quantity" $desiredSize }}
+{{-             $oldSize := include "common.resource-quantity" $currentPVC.spec.resources.requests.storage }}
+{{-             $newSize := include "common.resource-quantity" $desiredSize }}
 {{-               if gt $newSize $oldSize }}
 {{-               $commands = append $commands (printf "kubectl patch pvc %s-%s-%s-%d -p '{\"spec\":{\"resources\":{\"requests\":{\"storage\":\"%s\"}}}}'" $dir.name $seaweedfsName $volumeName $e $desiredSize) }}
 {{-               end }}
@@ -71,12 +71,12 @@ spec:
      {{- end }}
      enableServiceLinks: false
      serviceAccountName: {{ $volume.serviceAccountName | default (include "seaweedfs.serviceAccountName" $) | quote }} # for deleting statefulset pods after migration
-      {{- $initContainers_exists := include "seaweedfs.volume.initContainers_exists" $ -}}
+      {{- $initContainers_exists := include "volume.initContainers_exists" $ -}}
      {{- if $initContainers_exists }}
      initContainers:
        {{- if $volume.idx }}
        - name: seaweedfs-vol-move-idx
-          image: {{ template "seaweedfs.volume.image" $ }}
+          image: {{ template "volume.image" $ }}
          imagePullPolicy: {{ $.Values.global.seaweedfs.imagePullPolicy | default "IfNotPresent" }}
          command: [ '/bin/sh', '-c' ]
          args: [ '{{range $dir :=  $volume.dataDirs }}if ls /{{$dir.name}}/*.idx  >/dev/null 2>&1; then mv /{{$dir.name}}/*.idx /idx/ ; fi; {{end}}' ]
@@ -104,7 +104,7 @@ spec:
      {{- end }}
      containers:
        - name: seaweedfs
-          image: {{ template "seaweedfs.volume.image" $ }}
+          image: {{ template "volume.image" $ }}
          imagePullPolicy: {{ default "IfNotPresent" $.Values.global.seaweedfs.imagePullPolicy }}
          env:
            - name: POD_NAME
@@ -274,7 +274,7 @@ spec:
          securityContext: {{- omit $volume.containerSecurityContext "enabled" | toYaml | nindent 12 }}
          {{- end }}
      {{- if $volume.sidecars }}
-      {{- include "seaweedfs.tplvalues.render" (dict "value" (printf "{{ $volumeName := \"%s\" }}%s" $volumeName $volume.sidecars) "context" $) | nindent 8 }}
+      {{- include "common.tplvalues.render" (dict "value" (printf "{{ $volumeName := \"%s\" }}%s" $volumeName $volume.sidecars) "context" $) | nindent 8 }}
      {{- end }}
      volumes:

@@ -77,7 +77,7 @@ spec:
      {{- end }}
      containers:
        - name: seaweedfs
-          image: {{ template "seaweedfs.worker.image" . }}
+          image: {{ template "worker.image" . }}
          imagePullPolicy: {{ default "IfNotPresent" .Values.global.seaweedfs.imagePullPolicy }}
          env:
            - name: POD_IP
@@ -219,7 +219,7 @@ spec:
          securityContext: {{- omit .Values.worker.containerSecurityContext "enabled" | toYaml | nindent 12 }}
          {{- end }}
      {{- if .Values.worker.sidecars }}
-      {{- include "seaweedfs.tplvalues.render" (dict "value" .Values.worker.sidecars "context" $) | nindent 8 }}
+      {{- include "common.tplvalues.render" (dict "value" .Values.worker.sidecars "context" $) | nindent 8 }}
      {{- end }}
      volumes:
        {{- if eq .Values.worker.data.type "hostPath" }}
@@ -1339,14 +1339,9 @@ worker:
  # Admin server to connect to
  adminServer: ""

-  # Worker job types - categories or comma-separated list of names/aliases
-  # Categories: all, default, heavy
-  #   default: vacuum, volume_balance, ec_balance, admin_script
-  #   heavy: erasure_coding, iceberg_maintenance
-  #   all: every registered job type
-  # Examples: "all", "default", "heavy", "default,iceberg" (default+iceberg), "vacuum,volume_balance"
-  # Refer: https://github.com/seaweedfs/seaweedfs/wiki/Worker
-  jobType: "all"
+  # Worker job types - comma-separated list
+  # Available: vacuum, volume_balance, erasure_coding
+  jobType: "vacuum,volume_balance,erasure_coding"

  # Maximum number of concurrent detection requests
  maxDetect: 1
@@ -294,7 +294,6 @@ message AssignVolumeRequest {
    string rack = 7;
    string data_node = 9;
    string disk_type = 8;
-    uint64 expected_data_size = 10; // hint for size-aware volume selection
 }

 message AssignVolumeResponse {
@@ -145,11 +145,6 @@ message VolumeEcShardInformationMessage {
  uint64 expire_at_sec = 5; // used to record the destruction time of ec volume
  uint32 disk_id = 6;
  repeated int64 shard_sizes = 7; // optimized: sizes for shards in order of set bits in ec_index_bits
-  uint64 file_count = 8;   // total needles in the .ecx index (live + tombstoned)
-  uint64 delete_count = 9; // node-local tombstones in the .ecj deletion journal
-  // fields 10-19 reserved for future upstream open-source additions.
-  // fields 20+ are owned by the enterprise fork (e.g. data_shards/parity_shards)
-  // and must not be used here without coordination.
 }

 message StorageBackend {
@@ -236,7 +231,6 @@ message AssignRequest {
  uint32 memory_map_max_size_mb = 8;
  uint32 writable_volume_count = 9;
  string disk_type = 10;
-  uint64 expected_data_size = 11; // hint for size-aware volume selection
 }

 message VolumeGrowRequest {
@@ -486,11 +486,6 @@ impl S3TierRegistry {
        self.backends.keys().cloned().collect()
    }

-    /// Remove a backend by name.
-    pub fn remove(&mut self, name: &str) {
-        self.backends.remove(name);
-    }
-
    pub fn clear(&mut self) {
        self.backends.clear();
    }
@@ -4192,7 +4192,6 @@ mod tests {
        let addr = listener.local_addr().unwrap();
        listener.set_nonblocking(true).unwrap();
        let (shutdown_tx, shutdown_rx) = tokio::sync::oneshot::channel::<()>();
-        let (ready_tx, ready_rx) = std::sync::mpsc::channel::<()>();

        std::thread::spawn(move || {
            let runtime = tokio::runtime::Builder::new_current_thread()
@@ -4254,7 +4253,6 @@ mod tests {
                }));

                let listener = tokio::net::TcpListener::from_std(listener).unwrap();
-                let _ = ready_tx.send(());
                axum::serve(listener, app)
                    .with_graceful_shutdown(async move {
                        let _ = shutdown_rx.await;
@@ -4264,8 +4262,6 @@ mod tests {
            });
        });

-        // Wait for the server thread to be ready before returning.
-        ready_rx.recv().unwrap();
        (format!("http://{}", addr), shutdown_tx)
    }

@@ -4311,9 +4307,7 @@ mod tests {
        std::fs::remove_file(&dat_path).unwrap();

        let (endpoint, shutdown_tx) = spawn_fake_s3_server(dat_bytes.clone());
-        // Use a test-specific backend_id to avoid racing with other tests
-        // that share the global registry.  Never call clear() — only
-        // register/remove our own entries.
+        global_s3_tier_registry().write().unwrap().clear();
        let tier_config = S3TierConfig {
            access_key: "access".to_string(),
            secret_key: "secret".to_string(),
@@ -4325,16 +4319,14 @@ mod tests {
        };
        {
            let mut registry = global_s3_tier_registry().write().unwrap();
-            registry.register(
-                "s3.incr_copy_test".to_string(),
-                S3TierBackend::new(&tier_config),
-            );
+            registry.register("s3.default".to_string(), S3TierBackend::new(&tier_config));
+            registry.register("s3".to_string(), S3TierBackend::new(&tier_config));
        }

        let vif = crate::storage::volume::VifVolumeInfo {
            files: vec![crate::storage::volume::VifRemoteFile {
                backend_type: "s3".to_string(),
-                backend_id: "incr_copy_test".to_string(),
+                backend_id: "default".to_string(),
                key: "remote-key".to_string(),
                offset: 0,
                file_size: dat_bytes.len() as u64,
@@ -4543,10 +4535,7 @@ mod tests {
        assert_eq!(copied, dat_bytes[super_block_size as usize..]);

        let _ = shutdown_tx.send(());
-        global_s3_tier_registry()
-            .write()
-            .unwrap()
-            .remove("s3.incr_copy_test");
+        global_s3_tier_registry().write().unwrap().clear();
    }

    #[tokio::test]
@@ -1408,8 +1408,10 @@ mod tests {
    #[test]
    fn test_apply_storage_backends_registers_s3_default_aliases() {
        let state = test_state_with_store(Store::new(NeedleMapKind::InMemory));
-        // Do not call clear() on the global registry — other tests may be
-        // running concurrently.  Just register our entries and verify them.
+        crate::remote_storage::s3_tier::global_s3_tier_registry()
+            .write()
+            .unwrap()
+            .clear();

        apply_storage_backends(
            &state,
@@ -1441,8 +1443,10 @@ mod tests {
    #[test]
    fn test_apply_storage_backends_ignores_unsupported_types() {
        let state = test_state_with_store(Store::new(NeedleMapKind::InMemory));
-        // Do not call clear() on the global registry — other tests may be
-        // running concurrently.
+        crate::remote_storage::s3_tier::global_s3_tier_registry()
+            .write()
+            .unwrap()
+            .clear();

        apply_storage_backends(
            &state,
@@ -1453,17 +1457,12 @@ mod tests {
            }],
        );

-        // The per-state registry is freshly created and should have no entries
-        // since "rclone" is unsupported.
        let registry = state.s3_tier_registry.read().unwrap();
        assert!(registry.names().is_empty());
-        // Only check that the unsupported type was not added to the global
-        // registry.  Other tests may have their own entries present.
        let global_registry = crate::remote_storage::s3_tier::global_s3_tier_registry()
            .read()
            .unwrap();
-        assert!(global_registry.get("rclone.default").is_none());
-        assert!(global_registry.get("rclone").is_none());
+        assert!(global_registry.names().is_empty());
    }

    #[test]
@@ -3,10 +3,9 @@
 //! Each EcVolume has a sorted index (.ecx) and a deletion journal (.ecj).
 //! Shards (.ec00-.ec13) may be distributed across multiple servers.

-use std::collections::{HashMap, HashSet};
+use std::collections::HashMap;
 use std::fs::{self, File, OpenOptions};
 use std::io::{self, Write};
-use std::sync::RwLock;
 use std::time::{SystemTime, UNIX_EPOCH};

 use crate::pb::master_pb;
@@ -29,17 +28,6 @@ pub struct EcVolume {
    ecx_file: Option<File>,
    ecx_file_size: i64,
    ecj_file: Option<File>,
-    /// On-disk size of the .ecj deletion journal. Used only by IO helpers
-    /// (seek / set_len on partial writes) — the authoritative runtime
-    /// delete count comes from `deleted_needles.len()`.
-    ecj_file_size: i64,
-    /// In-memory set of needle ids that have been deleted since the volume
-    /// was encoded. .ecx is immutable at runtime — it only stores the
-    /// sorted (id, offset, size) index written at encode time — and runtime
-    /// deletes are journaled to .ecj + tracked here. Reads consult this
-    /// set to mask out deleted needles on top of the sealed .ecx lookup.
-    /// Seeded from .ecj in `new()` and updated by `journal_delete`.
-    deleted_needles: RwLock<HashSet<NeedleId>>,
    pub disk_type: DiskType,
    /// Directory where .ecx/.ecj were actually found (may differ from dir_idx after fallback).
    ecx_actual_dir: String,
@@ -124,8 +112,6 @@ impl EcVolume {
            ecx_file: None,
            ecx_file_size: 0,
            ecj_file: None,
-            ecj_file_size: 0,
-            deleted_needles: RwLock::new(HashSet::new()),
            disk_type: DiskType::default(),
            ecx_actual_dir: dir_idx.to_string(),
            shard_locations: HashMap::new(),
@@ -155,12 +141,10 @@ impl EcVolume {
            }
        }

-        // Open .ecj file (deletion journal) — use ecx_actual_dir for consistency.
-        // Note: Go does NOT replay .ecj into .ecx at volume load (RebuildEcxFile
-        // is only invoked from specific decode/rebuild gRPC handlers), so we
-        // don't either. Tombstones from prior sessions were already written
-        // in-place in .ecx, and the journal grows monotonically until a
-        // decode/rebuild operation folds it in.
+        // Replay .ecj journal into .ecx on startup (matches Go's RebuildEcxFile).
+        vol.rebuild_ecx_from_journal()?;
+
+        // Open .ecj file (deletion journal) — use ecx_actual_dir for consistency
        let ecj_base =
            crate::storage::volume::volume_file_name(&vol.ecx_actual_dir, collection, volume_id);
        let ecj_path = format!("{}.ecj", ecj_base);
@@ -170,75 +154,11 @@ impl EcVolume {
            .create(true)
            .append(true)
            .open(&ecj_path)?;
-        vol.ecj_file_size = ecj_file.metadata()?.len() as i64;
        vol.ecj_file = Some(ecj_file);

-        // Seed the in-memory deleted set from the journal.
-        vol.load_deleted_needles_from_ecj()?;
-
        Ok(vol)
    }

-    /// Walk the .ecj journal and populate `deleted_needles`. Called once
-    /// from `new()` under exclusive ownership of the just-constructed
-    /// EcVolume, so locking is not strictly required — but we take the
-    /// write lock anyway for symmetry with later mutations.
-    fn load_deleted_needles_from_ecj(&mut self) -> io::Result<()> {
-        let ecj_file = match self.ecj_file.as_ref() {
-            Some(f) => f,
-            None => return Ok(()),
-        };
-        if self.ecj_file_size < NEEDLE_ID_SIZE as i64 {
-            return Ok(());
-        }
-        let mut buf = [0u8; NEEDLE_ID_SIZE];
-        let mut set = self
-            .deleted_needles
-            .write()
-            .map_err(|_| io::Error::new(io::ErrorKind::Other, "deleted_needles lock poisoned"))?;
-        let mut off: i64 = 0;
-        while off + NEEDLE_ID_SIZE as i64 <= self.ecj_file_size {
-            #[cfg(unix)]
-            {
-                use std::os::unix::fs::FileExt;
-                ecj_file.read_exact_at(&mut buf, off as u64)?;
-            }
-            set.insert(NeedleId::from_bytes(&buf));
-            off += NEEDLE_ID_SIZE as i64;
-        }
-        Ok(())
-    }
-
-    /// Returns (file_count, delete_count) for this EC volume. Mirrors Go's
-    /// `EcVolume.FileAndDeleteCount`:
-    ///
-    ///   file_count   = ecx_file_size / NEEDLE_MAP_ENTRY_SIZE  — total
-    ///                  entries in the sealed sorted .ecx index.
-    ///   delete_count = deleted_needles.len()                  — unique
-    ///                  runtime deletes tracked in memory (seeded from
-    ///                  .ecj on load and updated by `journal_delete`).
-    ///
-    /// Because each needle delete is applied on exactly one shard holder,
-    /// the admin aggregation sums delete_count across nodes while taking
-    /// file_count from a single holder (they are identical per volume).
-    pub fn file_and_delete_count(&self) -> (u64, u64) {
-        let file_count = (self.ecx_file_size as u64) / (NEEDLE_MAP_ENTRY_SIZE as u64);
-        let delete_count = self
-            .deleted_needles
-            .read()
-            .map(|s| s.len() as u64)
-            .unwrap_or(0);
-        (file_count, delete_count)
-    }
-
-    /// Reports whether the given needle id is in the in-memory deleted set.
-    pub fn is_needle_deleted(&self, needle_id: NeedleId) -> bool {
-        self.deleted_needles
-            .read()
-            .map(|s| s.contains(&needle_id))
-            .unwrap_or(false)
-    }
-
    // ---- File names ----

    #[allow(dead_code)]
@@ -246,16 +166,8 @@ impl EcVolume {
        crate::storage::volume::volume_file_name(&self.dir, &self.collection, self.volume_id)
    }

-    /// Base path for the .ecx / .ecj index pair. Resolved from
-    /// `ecx_actual_dir` (initialized to `dir_idx` and only updated after a
-    /// successful idx-dir → data-dir fallback in `new()`), so every call site
-    /// agrees on the same file regardless of whether the fallback fired.
    fn idx_base_name(&self) -> String {
-        crate::storage::volume::volume_file_name(
-            &self.ecx_actual_dir,
-            &self.collection,
-            self.volume_id,
-        )
+        crate::storage::volume::volume_file_name(&self.dir_idx, &self.collection, self.volume_id)
    }

    pub fn ecx_file_name(&self) -> String {
@@ -343,8 +255,6 @@ impl EcVolume {
            return Vec::new();
        }

-        let (file_count, delete_count) = self.file_and_delete_count();
-
        vec![master_pb::VolumeEcShardInformationMessage {
            id: self.volume_id.0,
            collection: self.collection.clone(),
@@ -353,8 +263,6 @@ impl EcVolume {
            disk_type: self.disk_type.to_string(),
            expire_at_sec: self.expire_at_sec,
            disk_id,
-            file_count,
-            delete_count,
            ..Default::default()
        }]
    }
@@ -405,13 +313,6 @@ impl EcVolume {

            let (key, offset, size) = idx_entry_from_bytes(&entry_buf);
            if key == needle_id {
-                // Apply runtime deletion state on top of the sealed .ecx
-                // lookup: a needle in the in-memory deleted set is
-                // reported with TOMBSTONE_FILE_SIZE even though the .ecx
-                // record itself is untouched.
-                if self.is_needle_deleted(needle_id) {
-                    return Ok(Some((offset, TOMBSTONE_FILE_SIZE)));
-                }
                return Ok(Some((offset, size)));
            } else if key < needle_id {
                lo = mid + 1;
@@ -669,41 +570,38 @@ impl EcVolume {

    // ---- Deletion ----

-    /// Write `TOMBSTONE_FILE_SIZE` over the Size field of an existing .ecx
-    /// entry, matching Go's `MarkNeedleDeleted`. Only used by the offline
-    /// `rebuild_ecx_from_journal` path — the runtime delete path does not
-    /// touch .ecx because the index is treated as an immutable sorted
-    /// (id, offset, size) table. Returns `false` if the needle is not in
-    /// the index (ignored by callers) and an error on IO failure.
-    fn tombstone_ecx_entry(&self, needle_id: NeedleId) -> io::Result<bool> {
-        let ecx_file = self.ecx_file.as_ref().ok_or_else(|| {
-            io::Error::new(
-                io::ErrorKind::Other,
-                format!(
-                    "ec volume {} has no open .ecx file (closed or corrupt)",
-                    self.volume_id.0
-                ),
-            )
-        })?;
+    /// Mark a needle as deleted in the .ecx file in-place.
+    /// Matches Go's MarkNeedleDeleted: binary search the .ecx, then overwrite
+    /// the size field with TOMBSTONE_FILE_SIZE.
+    fn mark_needle_deleted_in_ecx(&self, needle_id: NeedleId) -> io::Result<bool> {
+        let ecx_file = match self.ecx_file.as_ref() {
+            Some(f) => f,
+            None => return Ok(false),
+        };

        let entry_count = self.ecx_file_size as usize / NEEDLE_MAP_ENTRY_SIZE;
        if entry_count == 0 {
            return Ok(false);
        }

+        // Binary search for the needle
        let mut lo: usize = 0;
        let mut hi: usize = entry_count;
        let mut entry_buf = [0u8; NEEDLE_MAP_ENTRY_SIZE];
+
        while lo < hi {
            let mid = lo + (hi - lo) / 2;
            let file_offset = (mid * NEEDLE_MAP_ENTRY_SIZE) as u64;
+
            #[cfg(unix)]
            {
                use std::os::unix::fs::FileExt;
                ecx_file.read_exact_at(&mut entry_buf, file_offset)?;
            }
-            let (key, _offset, _old_size) = idx_entry_from_bytes(&entry_buf);
+
+            let (key, _offset, _size) = idx_entry_from_bytes(&entry_buf);
            if key == needle_id {
+                // Found — overwrite the size field with TOMBSTONE_FILE_SIZE
                let size_offset = file_offset + NEEDLE_ID_SIZE as u64 + OFFSET_SIZE as u64;
                let mut size_buf = [0u8; SIZE_SIZE];
                TOMBSTONE_FILE_SIZE.to_bytes(&mut size_buf);
@@ -719,18 +617,13 @@ impl EcVolume {
                hi = mid;
            }
        }
-        Ok(false)
+
+        Ok(false) // not found
    }

-    /// Replay .ecj journal entries into .ecx: for each needle id in .ecj,
-    /// overwrite its .ecx size field with a tombstone, then remove the
-    /// journal file. Mirrors Go's `RebuildEcxFile`, which is invoked from
-    /// specific decode / rebuild gRPC handlers — it is intentionally
-    /// **not** called on volume load (runtime reads consult
-    /// `deleted_needles` instead). The rebuild is atomic with respect to
-    /// the journal: if any individual write fails the .ecj file is left
-    /// in place and the error is propagated so tombstones are not lost.
-    #[allow(dead_code)]
+    /// Replay .ecj journal entries into .ecx on startup.
+    /// Matches Go's RebuildEcxFile: for each needle ID in .ecj, marks it
+    /// deleted in .ecx, then removes the .ecj file.
    fn rebuild_ecx_from_journal(&mut self) -> io::Result<()> {
        let ecj_path = self.ecj_file_name();
        if !std::path::Path::new(&ecj_path).exists() {
@@ -749,23 +642,14 @@ impl EcVolume {
                break;
            }
            let needle_id = NeedleId::from_bytes(&data[start..start + NEEDLE_ID_SIZE]);
-            // A needle that never made it into .ecx is fine (e.g. the
-            // delete raced against encode). Any other IO error aborts the
-            // rebuild so the journal survives to be retried later.
-            self.tombstone_ecx_entry(needle_id)?;
+            // Errors for individual entries are non-fatal (needle may not exist in .ecx)
+            let _ = self.mark_needle_deleted_in_ecx(needle_id);
        }

-        // Durably flush the newly-written .ecx tombstones before dropping
-        // the journal: the writes went through write_all_at and may still
-        // be in page cache.
-        if let Some(ref ecx_file) = self.ecx_file {
-            ecx_file.sync_all()?;
-        }
+        // Remove the .ecj file after replay (matches Go)
+        let _ = fs::remove_file(&ecj_path);

-        // Fold successful — drop and recreate the journal, clear the
-        // in-memory deleted set (all of its contents are now materialized
-        // in .ecx), and reset the cached size.
-        fs::remove_file(&ecj_path)?;
+        // Re-create .ecj for future deletions
        let ecj_file = OpenOptions::new()
            .read(true)
            .write(true)
@@ -773,126 +657,27 @@ impl EcVolume {
            .append(true)
            .open(&ecj_path)?;
        self.ecj_file = Some(ecj_file);
-        self.ecj_file_size = 0;
-        if let Ok(mut set) = self.deleted_needles.write() {
-            set.clear();
-        }

        Ok(())
    }

    // ---- Deletion journal ----

-    /// Record a needle delete: append the id to the .ecj deletion journal
-    /// and insert it into the in-memory deleted set. `.ecx` is not touched
-    /// at runtime — it is a sealed sorted (id, offset, size) index and
-    /// runtime deletion state lives exclusively in .ecj + `deleted_needles`.
-    /// A lookup via `find_needle_from_ecx` masks the id out by returning
-    /// `TOMBSTONE_FILE_SIZE` on a subsequent read.
-    ///
-    /// The .ecj append is the durable commit point. On any failure the
-    /// file is truncated back to the pre-append length so the on-disk
-    /// journal and in-memory state cannot drift. Only after the sync
-    /// succeeds is the id published into the set, so a failure leaves
-    /// the delete invisible to readers.
+    /// Append a deleted needle ID to the .ecj journal and mark in .ecx.
+    /// Matches Go's DeleteNeedleFromEcx: marks in .ecx first, then journals.
    pub fn journal_delete(&mut self, needle_id: NeedleId) -> io::Result<()> {
-        // Look the needle up read-only. Missing is a silent no-op; a
-        // pre-existing .ecx tombstone (from a prior decode/rebuild) is
-        // mirrored into the in-memory set so delete_count stays accurate
-        // without needing to walk .ecx on every heartbeat.
-        match self.find_needle_from_ecx_raw(needle_id)? {
-            None => return Ok(()),
-            Some((_, size)) if size.is_deleted() => {
-                if let Ok(mut set) = self.deleted_needles.write() {
-                    set.insert(needle_id);
-                }
-                return Ok(());
-            }
-            Some(_) => {}
-        }
+        // Mark deleted in .ecx in-place (matches Go's MarkNeedleDeleted)
+        let _ = self.mark_needle_deleted_in_ecx(needle_id);
+        let ecj_file = self
+            .ecj_file
+            .as_mut()
+            .ok_or_else(|| io::Error::new(io::ErrorKind::Other, "ecj file not open"))?;

-        // Idempotent fast path for repeat deletes — avoids the journal
-        // append entirely so the derived delete_count stays stable.
-        if self.is_needle_deleted(needle_id) {
-            return Ok(());
-        }
-
-        let prev_ecj_size = self.ecj_file_size;
-        let append_result: io::Result<()> = {
-            let ecj_file = self
-                .ecj_file
-                .as_mut()
-                .ok_or_else(|| io::Error::new(io::ErrorKind::Other, "ecj file not open"))?;
-            let mut buf = [0u8; NEEDLE_ID_SIZE];
-            needle_id.to_bytes(&mut buf);
-            ecj_file
-                .write_all(&buf)
-                .and_then(|_| ecj_file.sync_all())
-        };
-
-        match append_result {
-            Ok(()) => {
-                self.ecj_file_size += NEEDLE_ID_SIZE as i64;
-                if let Ok(mut set) = self.deleted_needles.write() {
-                    set.insert(needle_id);
-                }
-                Ok(())
-            }
-            Err(e) => {
-                // write_all may have extended the file on disk before
-                // sync_all failed; truncate back to the known-good size so
-                // the on-disk journal never drifts past `deleted_needles`.
-                if let Some(ecj) = self.ecj_file.as_mut() {
-                    if let Err(trunc_err) = ecj.set_len(prev_ecj_size as u64) {
-                        tracing::error!(
-                            volume_id = self.volume_id.0,
-                            needle_id = needle_id.0,
-                            truncate_error = %trunc_err,
-                            "failed to truncate ecj after append failure"
-                        );
-                    }
-                }
-                Err(e)
-            }
-        }
-    }
-
-    /// Internal: binary search .ecx without masking by `deleted_needles`.
-    /// Used by `journal_delete` so a repeat delete can still see the raw
-    /// pre-existing .ecx tombstone from a prior rebuild.
-    fn find_needle_from_ecx_raw(
-        &self,
-        needle_id: NeedleId,
-    ) -> io::Result<Option<(Offset, Size)>> {
-        let ecx_file = self
-            .ecx_file
-            .as_ref()
-            .ok_or_else(|| io::Error::new(io::ErrorKind::Other, "ecx file not open"))?;
-        let entry_count = self.ecx_file_size as usize / NEEDLE_MAP_ENTRY_SIZE;
-        if entry_count == 0 {
-            return Ok(None);
-        }
-        let mut lo: usize = 0;
-        let mut hi: usize = entry_count;
-        let mut entry_buf = [0u8; NEEDLE_MAP_ENTRY_SIZE];
-        while lo < hi {
-            let mid = lo + (hi - lo) / 2;
-            let file_offset = (mid * NEEDLE_MAP_ENTRY_SIZE) as u64;
-            #[cfg(unix)]
-            {
-                use std::os::unix::fs::FileExt;
-                ecx_file.read_exact_at(&mut entry_buf, file_offset)?;
-            }
-            let (key, offset, size) = idx_entry_from_bytes(&entry_buf);
-            if key == needle_id {
-                return Ok(Some((offset, size)));
-            } else if key < needle_id {
-                lo = mid + 1;
-            } else {
-                hi = mid;
-            }
-        }
-        Ok(None)
+        let mut buf = [0u8; NEEDLE_ID_SIZE];
+        needle_id.to_bytes(&mut buf);
+        ecj_file.write_all(&buf)?;
+        ecj_file.sync_all()?;
+        Ok(())
    }

    /// Append a deleted needle ID to the .ecj journal, validating the cookie first.
@@ -993,17 +778,15 @@ impl EcVolume {
        let _ = fs::remove_file(format!("{}.ecx", actual_base));
        let _ = fs::remove_file(format!("{}.ecj", actual_base));
        let _ = fs::remove_file(format!("{}.vif", actual_base));
-        // Also sweep the originally-configured idx dir in case stale files
-        // exist there (ecx_file_name() / ecj_file_name() now resolve from
-        // ecx_actual_dir, so we have to build the idx-dir paths explicitly).
+        // Also try the configured idx dir and data dir in case files exist in either
        if self.ecx_actual_dir != self.dir_idx {
+            let _ = fs::remove_file(self.ecx_file_name());
+            let _ = fs::remove_file(self.ecj_file_name());
            let idx_base = crate::storage::volume::volume_file_name(
                &self.dir_idx,
                &self.collection,
                self.volume_id,
            );
-            let _ = fs::remove_file(format!("{}.ecx", idx_base));
-            let _ = fs::remove_file(format!("{}.ecj", idx_base));
            let _ = fs::remove_file(format!("{}.vif", idx_base));
        }
        if self.ecx_actual_dir != self.dir && self.dir_idx != self.dir {
@@ -1076,33 +859,16 @@ mod tests {
        let tmp = TempDir::new().unwrap();
        let dir = tmp.path().to_str().unwrap();

-        // .ecj append is gated on a live->tombstone transition in .ecx, so
-        // the fixture must contain the needles we are about to delete.
-        let entries = vec![
-            (NeedleId(10), Offset::from_actual_offset(8), Size(100)),
-            (NeedleId(20), Offset::from_actual_offset(200), Size(200)),
-        ];
-        write_ecx_file(dir, "", VolumeId(1), &entries);
+        // Need ecx file for EcVolume::new to succeed
+        write_ecx_file(dir, "", VolumeId(1), &[]);

        let mut vol = EcVolume::new(dir, dir, "", VolumeId(1)).unwrap();
-        let (fc0, dc0) = vol.file_and_delete_count();
-        assert_eq!((fc0, dc0), (2, 0));

        vol.journal_delete(NeedleId(10)).unwrap();
        vol.journal_delete(NeedleId(20)).unwrap();

        let deleted = vol.read_deleted_needles().unwrap();
        assert_eq!(deleted, vec![NeedleId(10), NeedleId(20)]);
-
-        let (fc, dc) = vol.file_and_delete_count();
-        assert_eq!((fc, dc), (2, 2));
-
-        // Idempotent re-delete must not bump delete_count.
-        vol.journal_delete(NeedleId(10)).unwrap();
-        // Deleting a missing needle must not bump delete_count either.
-        vol.journal_delete(NeedleId(999)).unwrap();
-        let (fc, dc) = vol.file_and_delete_count();
-        assert_eq!((fc, dc), (2, 2));
    }

    #[test]
@@ -1158,13 +1158,7 @@ mod tests {
                Vec::new(),
            )
            .unwrap();
-        // Use a large volume_size_limit so the unused-space difference between
-        // preallocate=true (0) and preallocate=false (~2 × limit) is big enough
-        // that integer-division rounding and disk-free fluctuations between the
-        // two get_disk_stats calls cannot make the quotients equal.
-        store
-            .volume_size_limit
-            .store(100 * 1024 * 1024, Ordering::Relaxed);
+        store.volume_size_limit.store(1024, Ordering::Relaxed);
        store
            .add_volume(
                VolumeId(61),
@@ -3225,7 +3225,6 @@ mod tests {
        let addr = listener.local_addr().unwrap();
        listener.set_nonblocking(true).unwrap();
        let (shutdown_tx, shutdown_rx) = tokio::sync::oneshot::channel::<()>();
-        let (ready_tx, ready_rx) = std::sync::mpsc::channel::<()>();

        std::thread::spawn(move || {
            let runtime = tokio::runtime::Builder::new_current_thread()
@@ -3280,7 +3279,6 @@ mod tests {
                }));

                let listener = tokio::net::TcpListener::from_std(listener).unwrap();
-                let _ = ready_tx.send(());
                axum::serve(listener, app)
                    .with_graceful_shutdown(async move {
                        let _ = shutdown_rx.await;
@@ -3290,8 +3288,6 @@ mod tests {
            });
        });

-        // Wait for the server thread to be ready before returning.
-        ready_rx.recv().unwrap();
        (format!("http://{}", addr), shutdown_tx)
    }

@@ -3837,7 +3833,7 @@ mod tests {
            let vif = VifVolumeInfo {
                files: vec![VifRemoteFile {
                    backend_type: "s3".to_string(),
-                    backend_id: "vif_rw_test".to_string(),
+                    backend_id: "default".to_string(),
                    key: "remote-key".to_string(),
                    offset: 0,
                    file_size: v.dat_file_size().unwrap(),
@@ -3853,27 +3849,6 @@ mod tests {
            )
            .unwrap();

-            // Register a dummy S3 backend so load_remote_dat_file can look it
-            // up.  This test never reads remote data, so a dead endpoint is fine.
-            // Use a test-specific backend_id to avoid racing with other tests
-            // that share the global registry.
-            let tier_config = crate::remote_storage::s3_tier::S3TierConfig {
-                access_key: "access".to_string(),
-                secret_key: "secret".to_string(),
-                region: "us-east-1".to_string(),
-                bucket: "bucket-a".to_string(),
-                endpoint: "http://127.0.0.1:1".to_string(),
-                storage_class: "STANDARD".to_string(),
-                force_path_style: true,
-            };
-            crate::remote_storage::s3_tier::global_s3_tier_registry()
-                .write()
-                .unwrap()
-                .register(
-                    "s3.vif_rw_test".to_string(),
-                    crate::remote_storage::s3_tier::S3TierBackend::new(&tier_config),
-                );
-
            v.dat_file_size().unwrap()
        };

@@ -3917,11 +3892,6 @@ mod tests {
            .unwrap();
        assert!(deleted_size.0 > 0);
        assert_eq!(v.dat_file_size().unwrap(), dat_size_before_reload);
-
-        crate::remote_storage::s3_tier::global_s3_tier_registry()
-            .write()
-            .unwrap()
-            .remove("s3.vif_rw_test");
    }

    #[test]
@@ -4084,9 +4054,10 @@ mod tests {
        std::fs::remove_file(&dat_path).unwrap();

        let (endpoint, shutdown_tx) = spawn_fake_s3_server(dat_bytes.clone());
-        // Use a test-specific backend_id to avoid racing with other tests
-        // that share the global registry.  Never call clear() — only
-        // register/remove our own entries.
+        crate::remote_storage::s3_tier::global_s3_tier_registry()
+            .write()
+            .unwrap()
+            .clear();
        let tier_config = crate::remote_storage::s3_tier::S3TierConfig {
            access_key: "access".to_string(),
            secret_key: "secret".to_string(),
@@ -4101,7 +4072,11 @@ mod tests {
                .write()
                .unwrap();
            registry.register(
-                "s3.remote_only_rw".to_string(),
+                "s3.default".to_string(),
+                crate::remote_storage::s3_tier::S3TierBackend::new(&tier_config),
+            );
+            registry.register(
+                "s3".to_string(),
                crate::remote_storage::s3_tier::S3TierBackend::new(&tier_config),
            );
        }
@@ -4109,7 +4084,7 @@ mod tests {
        let vif = VifVolumeInfo {
            files: vec![VifRemoteFile {
                backend_type: "s3".to_string(),
-                backend_id: "remote_only_rw".to_string(),
+                backend_id: "default".to_string(),
                key: "remote-key".to_string(),
                offset: 0,
                file_size: dat_bytes.len() as u64,
@@ -4166,10 +4141,6 @@ mod tests {
        assert_eq!(meta.data_size, 11);

        let _ = shutdown_tx.send(());
-        crate::remote_storage::s3_tier::global_s3_tier_registry()
-            .write()
-            .unwrap()
-            .remove("s3.remote_only_rw");
    }

    /// Volume destroy removes .vif alongside the primary data files.
@@ -33,11 +33,11 @@ require (
 	github.com/vmihailenco/tagparser/v2 v2.0.0 // indirect
 	go.yaml.in/yaml/v2 v2.4.3 // indirect
 	go.yaml.in/yaml/v3 v3.0.4 // indirect
-	golang.org/x/image v0.38.0 // indirect
-	golang.org/x/net v0.52.0 // indirect
+	golang.org/x/image v0.36.0 // indirect
+	golang.org/x/net v0.50.0 // indirect
 	golang.org/x/sys v0.42.0 // indirect
-	golang.org/x/text v0.35.0 // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20260319201613-d00831a3d3e7 // indirect
+	golang.org/x/text v0.34.0 // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20260203192932-546029d2fa20 // indirect
 	google.golang.org/grpc v1.79.3 // indirect
 	google.golang.org/protobuf v1.36.11 // indirect
 )
@@ -27,8 +27,8 @@ github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
 github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
 github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2s0bqwp9tc8=
 github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw=
-github.com/klauspost/compress v1.18.5 h1:/h1gH5Ce+VWNLSWqPzOVn6XBO+vJbCNGvjoaGBFW2IE=
-github.com/klauspost/compress v1.18.5/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ=
+github.com/klauspost/compress v1.18.4 h1:RPhnKRAQ4Fh8zU2FY/6ZFDwTVTxgJ/EMydqSTzE9a2c=
+github.com/klauspost/compress v1.18.4/go.mod h1:R0h/fSBs8DE4ENlcrlib3PsXS61voFxhIs2DeRhCvJ4=
 github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
 github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk=
 github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
@@ -84,35 +84,35 @@ github.com/vmihailenco/tagparser/v2 v2.0.0 h1:y09buUbR+b5aycVFQs/g70pqKVZNBmxwAh
 github.com/vmihailenco/tagparser/v2 v2.0.0/go.mod h1:Wri+At7QHww0WTrCBeu4J6bNtoV6mEfg5OIWRZA9qds=
 go.opentelemetry.io/auto/sdk v1.2.1 h1:jXsnJ4Lmnqd11kwkBV2LgLoFMZKizbCi5fNZ/ipaZ64=
 go.opentelemetry.io/auto/sdk v1.2.1/go.mod h1:KRTj+aOaElaLi+wW1kO/DZRXwkF4C5xPbEe3ZiIhN7Y=
-go.opentelemetry.io/otel v1.42.0 h1:lSQGzTgVR3+sgJDAU/7/ZMjN9Z+vUip7leaqBKy4sho=
-go.opentelemetry.io/otel v1.42.0/go.mod h1:lJNsdRMxCUIWuMlVJWzecSMuNjE7dOYyWlqOXWkdqCc=
-go.opentelemetry.io/otel/metric v1.42.0 h1:2jXG+3oZLNXEPfNmnpxKDeZsFI5o4J+nz6xUlaFdF/4=
-go.opentelemetry.io/otel/metric v1.42.0/go.mod h1:RlUN/7vTU7Ao/diDkEpQpnz3/92J9ko05BIwxYa2SSI=
-go.opentelemetry.io/otel/sdk v1.42.0 h1:LyC8+jqk6UJwdrI/8VydAq/hvkFKNHZVIWuslJXYsDo=
-go.opentelemetry.io/otel/sdk v1.42.0/go.mod h1:rGHCAxd9DAph0joO4W6OPwxjNTYWghRWmkHuGbayMts=
-go.opentelemetry.io/otel/sdk/metric v1.42.0 h1:D/1QR46Clz6ajyZ3G8SgNlTJKBdGp84q9RKCAZ3YGuA=
-go.opentelemetry.io/otel/sdk/metric v1.42.0/go.mod h1:Ua6AAlDKdZ7tdvaQKfSmnFTdHx37+J4ba8MwVCYM5hc=
-go.opentelemetry.io/otel/trace v1.42.0 h1:OUCgIPt+mzOnaUTpOQcBiM/PLQ/Op7oq6g4LenLmOYY=
-go.opentelemetry.io/otel/trace v1.42.0/go.mod h1:f3K9S+IFqnumBkKhRJMeaZeNk9epyhnCmQh/EysQCdc=
+go.opentelemetry.io/otel v1.40.0 h1:oA5YeOcpRTXq6NN7frwmwFR0Cn3RhTVZvXsP4duvCms=
+go.opentelemetry.io/otel v1.40.0/go.mod h1:IMb+uXZUKkMXdPddhwAHm6UfOwJyh4ct1ybIlV14J0g=
+go.opentelemetry.io/otel/metric v1.40.0 h1:rcZe317KPftE2rstWIBitCdVp89A2HqjkxR3c11+p9g=
+go.opentelemetry.io/otel/metric v1.40.0/go.mod h1:ib/crwQH7N3r5kfiBZQbwrTge743UDc7DTFVZrrXnqc=
+go.opentelemetry.io/otel/sdk v1.40.0 h1:KHW/jUzgo6wsPh9At46+h4upjtccTmuZCFAc9OJ71f8=
+go.opentelemetry.io/otel/sdk v1.40.0/go.mod h1:Ph7EFdYvxq72Y8Li9q8KebuYUr2KoeyHx0DRMKrYBUE=
+go.opentelemetry.io/otel/sdk/metric v1.40.0 h1:mtmdVqgQkeRxHgRv4qhyJduP3fYJRMX4AtAlbuWdCYw=
+go.opentelemetry.io/otel/sdk/metric v1.40.0/go.mod h1:4Z2bGMf0KSK3uRjlczMOeMhKU2rhUqdWNoKcYrtcBPg=
+go.opentelemetry.io/otel/trace v1.40.0 h1:WA4etStDttCSYuhwvEa8OP8I5EWu24lkOzp+ZYblVjw=
+go.opentelemetry.io/otel/trace v1.40.0/go.mod h1:zeAhriXecNGP/s2SEG3+Y8X9ujcJOTqQ5RgdEJcawiA=
 go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto=
 go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE=
 go.yaml.in/yaml/v2 v2.4.3 h1:6gvOSjQoTB3vt1l+CU+tSyi/HOjfOjRLJ4YwYZGwRO0=
 go.yaml.in/yaml/v2 v2.4.3/go.mod h1:zSxWcmIDjOzPXpjlTTbAsKokqkDNAVtZO0WOMiT90s8=
 go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc=
 go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
-golang.org/x/image v0.38.0 h1:5l+q+Y9JDC7mBOMjo4/aPhMDcxEptsX+Tt3GgRQRPuE=
-golang.org/x/image v0.38.0/go.mod h1:/3f6vaXC+6CEanU4KJxbcUZyEePbyKbaLoDOe4ehFYY=
-golang.org/x/net v0.52.0 h1:He/TN1l0e4mmR3QqHMT2Xab3Aj3L9qjbhRm78/6jrW0=
-golang.org/x/net v0.52.0/go.mod h1:R1MAz7uMZxVMualyPXb+VaqGSa3LIaUqk0eEt3w36Sw=
+golang.org/x/image v0.36.0 h1:Iknbfm1afbgtwPTmHnS2gTM/6PPZfH+z2EFuOkSbqwc=
+golang.org/x/image v0.36.0/go.mod h1:YsWD2TyyGKiIX1kZlu9QfKIsQ4nAAK9bdgdrIsE7xy4=
+golang.org/x/net v0.50.0 h1:ucWh9eiCGyDR3vtzso0WMQinm2Dnt8cFMuQa9K33J60=
+golang.org/x/net v0.50.0/go.mod h1:UgoSli3F/pBgdJBHCTc+tp3gmrU4XswgGRgtnwWTfyM=
 golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.42.0 h1:omrd2nAlyT5ESRdCLYdm3+fMfNFE/+Rf4bDIQImRJeo=
 golang.org/x/sys v0.42.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
-golang.org/x/text v0.35.0 h1:JOVx6vVDFokkpaq1AEptVzLTpDe9KGpj5tR4/X+ybL8=
-golang.org/x/text v0.35.0/go.mod h1:khi/HExzZJ2pGnjenulevKNX1W67CUy0AsXcNubPGCA=
+golang.org/x/text v0.34.0 h1:oL/Qq0Kdaqxa1KbNeMKwQq0reLCCaFtqu2eNuSeNHbk=
+golang.org/x/text v0.34.0/go.mod h1:homfLqTYRFyVYemLBFl5GgL/DWEiH5wcsQ5gSh1yziA=
 gonum.org/v1/gonum v0.17.0 h1:VbpOemQlsSMrYmn7T2OUvQ4dqxQXU+ouZFQsZOx50z4=
 gonum.org/v1/gonum v0.17.0/go.mod h1:El3tOrEuMpv2UdMrbNlKEh9vd86bmQ6vqIcDwxEOc1E=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20260319201613-d00831a3d3e7 h1:ndE4FoJqsIceKP2oYSnUZqhTdYufCYYkqwtFzfrhI7w=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20260319201613-d00831a3d3e7/go.mod h1:4Hqkh8ycfw05ld/3BWL7rJOSfebL2Q+DVDeRgYgxUU8=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20260203192932-546029d2fa20 h1:Jr5R2J6F6qWyzINc+4AM8t5pfUz6beZpHp678GNrMbE=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20260203192932-546029d2fa20/go.mod h1:j9x/tPzZkyxcgEFkiKEEGxfvyumM01BEtsW8xzOahRQ=
 google.golang.org/grpc v1.79.3 h1:sybAEdRIEtvcD68Gx7dmnwjZKlyfuc61Dyo9pGXXkKE=
 google.golang.org/grpc v1.79.3/go.mod h1:KmT0Kjez+0dde/v2j9vzwoAScgEPx/Bw1CYChhHLrHQ=
 google.golang.org/protobuf v1.36.11 h1:fV6ZwhNocDyBLK0dj+fg8ektcVegBBuEolpbTQyBNVE=
@@ -999,9 +999,9 @@ checksum = "69cdb34c158ceb288df11e18b4bd39de994f6657d83847bdffdbd7f346754b0f"

 [[package]]
 name = "rand"
-version = "0.9.4"
+version = "0.9.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "44c5af06bb1b7d3216d91932aed5265164bf384dc89cd6ba05cf59a35f5f76ea"
+checksum = "6db2770f06117d490610c7488547d543617b21bfa07796d7a12f6f1bd53850d1"
 dependencies = [
 "rand_chacha",
 "rand_core",
@@ -12,7 +12,6 @@ import (
 	"path/filepath"
 	"regexp"
 	"strings"
-	"sync"
 	"testing"
 	"time"
 )
@@ -23,16 +22,10 @@ const (
 	FilerUrl  = "http://localhost:8888"
 )

-// Helper to run commands in background and track PIDs for cleanup. Guarded
-// by runningCmdsLock so parallel subprocess startup can append safely.
-var (
-	runningCmds     []*exec.Cmd
-	runningCmdsLock sync.Mutex
-)
+// Helper to run commands in background and track PIDs for cleanup
+var runningCmds []*exec.Cmd

 func cleanup() {
-	runningCmdsLock.Lock()
-	defer runningCmdsLock.Unlock()
 	for _, cmd := range runningCmds {
 		if cmd.Process != nil {
 			cmd.Process.Kill()
@@ -66,9 +59,7 @@ func startWeed(t *testing.T, name string, args ...string) *exec.Cmd {
 	if err != nil {
 		t.Fatalf("Failed to start weed %v: %v", args, err)
 	}
-	runningCmdsLock.Lock()
 	runningCmds = append(runningCmds, cmd)
-	runningCmdsLock.Unlock()
 	return cmd
 }

@@ -116,23 +107,14 @@ func ensureEnvironment(t *testing.T) {
 	waitForUrl(t, MasterUrl+"/cluster/status", 10)

 	// 3. Start Volume Server (Worker)
-	// Start 14 volume servers to verify RS(10,4) default EC. Fork/exec in
-	// parallel because startWeed is non-blocking and the per-process fork +
-	// mkdir + log-file-open overhead stacks up sequentially on cold CI
-	// disks, eating most of the admin /health wait budget further down.
-	var volWg sync.WaitGroup
+	// Start 14 volume servers to verify RS(10,4) default EC
 	for i := 1; i <= 14; i++ {
-		volWg.Add(1)
-		go func(i int) {
-			defer volWg.Done()
-			volName := fmt.Sprintf("volume%d", i)
-			port := 8080 + i - 1
-			dir := filepath.Join("tmp", volName)
-			os.MkdirAll(dir, 0755)
-			startWeed(t, volName, "volume", "-dir="+dir, "-mserver=localhost:9333", fmt.Sprintf("-port=%d", port), "-ip=localhost")
-		}(i)
+		volName := fmt.Sprintf("volume%d", i)
+		port := 8080 + i - 1
+		dir := filepath.Join("tmp", volName)
+		os.MkdirAll(dir, 0755)
+		startWeed(t, volName, "volume", "-dir="+dir, "-mserver=localhost:9333", fmt.Sprintf("-port=%d", port), "-ip=localhost")
 	}
-	volWg.Wait()

 	// 4. Start Filer
 	os.MkdirAll(filepath.Join("tmp", "filer"), 0755)
@@ -154,12 +136,7 @@ func ensureEnvironment(t *testing.T) {
 	os.RemoveAll(filepath.Join("tmp", "admin"))
 	os.MkdirAll(filepath.Join("tmp", "admin"), 0755)
 	startWeed(t, "admin", "admin", "-master=localhost:9333", "-port=23646", "-dataDir=./tmp/admin")
-	// Admin is started after master, 14 volume servers, filer and 2 workers,
-	// so under cold CI conditions the wait here has to absorb the tail of
-	// every earlier subprocess coming up. 60s is too tight and has flaked;
-	// 180s gives comfortable headroom without meaningfully extending the
-	// fast path (the first successful /health usually hits well under 30s).
-	waitForUrl(t, AdminUrl+"/health", 180)
+	waitForUrl(t, AdminUrl+"/health", 60)

 	t.Log("Environment started successfully")
 }
@@ -1,277 +0,0 @@
-package fuse_dlm
-
-import (
-	"fmt"
-	"os"
-	"path/filepath"
-	"sync"
-	"sync/atomic"
-	"testing"
-	"time"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-// TestDLMConcurrentWritersSameFile verifies that two mounts writing to the same
-// file concurrently produce valid (non-corrupted) data. With DLM enabled, the
-// writes are serialized — one blocks until the other completes.
-//
-// Note: cross-mount read consistency depends on FUSE kernel cache invalidation
-// and filer metadata subscription, which are asynchronous. This test verifies
-// write integrity, not instant read convergence.
-func TestDLMConcurrentWritersSameFile(t *testing.T) {
-	if testing.Short() {
-		t.Skip("skipping DLM integration test in short mode")
-	}
-
-	cluster := startDLMTestCluster(t)
-	t.Cleanup(cluster.Stop)
-
-	const iterations = 5
-	for iter := 0; iter < iterations; iter++ {
-		fileName := fmt.Sprintf("concurrent_write_%d.txt", iter)
-		payloadA := []byte(fmt.Sprintf("mount0-iteration-%d-payload-AAAA", iter))
-		payloadB := []byte(fmt.Sprintf("mount1-iteration-%d-payload-BBBB", iter))
-
-		var wg sync.WaitGroup
-		wg.Add(2)
-
-		go func() {
-			defer wg.Done()
-			err := os.WriteFile(filepath.Join(cluster.mountPoints[0], fileName), payloadA, 0644)
-			assert.NoError(t, err, "mount0 write iteration %d", iter)
-		}()
-
-		go func() {
-			defer wg.Done()
-			err := os.WriteFile(filepath.Join(cluster.mountPoints[1], fileName), payloadB, 0644)
-			assert.NoError(t, err, "mount1 write iteration %d", iter)
-		}()
-
-		wg.Wait()
-
-		// Verify file is readable and contains one of the expected payloads
-		// (read from mount0 — its own view is authoritative for write success).
-		content, err := os.ReadFile(filepath.Join(cluster.mountPoints[0], fileName))
-		require.NoError(t, err, "read from mount0 iteration %d", iter)
-		validPayload := string(content) == string(payloadA) || string(content) == string(payloadB)
-		assert.True(t, validPayload,
-			"iteration %d: content must be one of the expected payloads, got: %q", iter, content)
-	}
-}
-
-// TestDLMRepeatedOpenWriteClose verifies that repeated open/write/close cycles
-// from both mounts all succeed without errors.
-func TestDLMRepeatedOpenWriteClose(t *testing.T) {
-	if testing.Short() {
-		t.Skip("skipping DLM integration test in short mode")
-	}
-
-	cluster := startDLMTestCluster(t)
-	t.Cleanup(cluster.Stop)
-
-	const cycles = 20
-	fileName := "repeated_write.txt"
-
-	var wg sync.WaitGroup
-	wg.Add(2)
-
-	go func() {
-		defer wg.Done()
-		for i := 0; i < cycles; i++ {
-			data := []byte(fmt.Sprintf("mount0-cycle-%d", i))
-			err := os.WriteFile(filepath.Join(cluster.mountPoints[0], fileName), data, 0644)
-			assert.NoError(t, err, "mount0 cycle %d", i)
-		}
-	}()
-
-	go func() {
-		defer wg.Done()
-		for i := 0; i < cycles; i++ {
-			data := []byte(fmt.Sprintf("mount1-cycle-%d", i))
-			err := os.WriteFile(filepath.Join(cluster.mountPoints[1], fileName), data, 0644)
-			assert.NoError(t, err, "mount1 cycle %d", i)
-		}
-	}()
-
-	wg.Wait()
-
-	// File must be readable from at least one mount
-	content, err := os.ReadFile(filepath.Join(cluster.mountPoints[0], fileName))
-	require.NoError(t, err)
-	assert.NotEmpty(t, content, "file must not be empty")
-}
-
-// TestDLMWriteBlocksSecondWriter verifies the core DLM guarantee: while one
-// mount has a file open for writing, another mount's write-open blocks until
-// the first mount closes the file.
-func TestDLMWriteBlocksSecondWriter(t *testing.T) {
-	if testing.Short() {
-		t.Skip("skipping DLM integration test in short mode")
-	}
-
-	cluster := startDLMTestCluster(t)
-	t.Cleanup(cluster.Stop)
-
-	fileName := "blocking_test.txt"
-	path0 := filepath.Join(cluster.mountPoints[0], fileName)
-	path1 := filepath.Join(cluster.mountPoints[1], fileName)
-
-	// Mount 0 opens the file for writing and holds it open
-	f, err := os.OpenFile(path0, os.O_CREATE|os.O_WRONLY|os.O_TRUNC, 0644)
-	require.NoError(t, err, "mount0 open")
-	_, err = f.Write([]byte("mount0-holds-lock"))
-	require.NoError(t, err, "mount0 write")
-
-	// Mount 1 tries to write — should block (we use a goroutine with atomic flag)
-	var mount1Completed atomic.Bool
-	mount1Done := make(chan error, 1)
-	go func() {
-		err := os.WriteFile(path1, []byte("mount1-waited"), 0644)
-		mount1Completed.Store(true)
-		mount1Done <- err
-	}()
-
-	// Give mount 1 a moment — it should NOT complete while mount 0 holds the file open
-	time.Sleep(3 * time.Second)
-	require.False(t, mount1Completed.Load(),
-		"mount1 write must not complete while mount0 holds the file open")
-	t.Log("mount1 write is blocked as expected while mount0 holds the file")
-
-	// Mount 0 closes the file — this releases the DLM lock
-	require.NoError(t, f.Close(), "mount0 close")
-
-	// Mount 1 should now complete
-	select {
-	case err := <-mount1Done:
-		assert.NoError(t, err, "mount1 write after mount0 close")
-	case <-time.After(30 * time.Second):
-		t.Fatal("mount1 write did not complete within 30s after mount0 closed")
-	}
-}
-
-// TestDLMRenameWhileWriteOpen verifies that a rename is coordinated with DLM:
-// while mount0 has a file open for writing (re-opened after creation),
-// mount1 cannot rename it until mount0 closes the file.
-func TestDLMRenameWhileWriteOpen(t *testing.T) {
-	if testing.Short() {
-		t.Skip("skipping DLM integration test in short mode")
-	}
-
-	cluster := startDLMTestCluster(t)
-	t.Cleanup(cluster.Stop)
-
-	origName := "rename_source.txt"
-	newName := "rename_dest.txt"
-
-	// Create and close the file first so it's flushed to the filer and
-	// visible on both mounts.
-	require.NoError(t, os.WriteFile(
-		filepath.Join(cluster.mountPoints[0], origName),
-		[]byte("initial-content"), 0644))
-	time.Sleep(2 * time.Second) // metadata propagation
-
-	// Verify mount1 can see the file
-	_, err := os.Stat(filepath.Join(cluster.mountPoints[1], origName))
-	require.NoError(t, err, "mount1 should see the file")
-
-	// Mount 0 re-opens the file for writing and holds it open
-	f, err := os.OpenFile(
-		filepath.Join(cluster.mountPoints[0], origName),
-		os.O_WRONLY|os.O_TRUNC, 0644)
-	require.NoError(t, err, "mount0 reopen")
-	_, err = f.Write([]byte("data-while-holding-lock"))
-	require.NoError(t, err, "mount0 write")
-
-	// Mount 1 tries to rename — should block because mount0 holds the
-	// DLM lock on the old path
-	var renameCompleted atomic.Bool
-	renameDone := make(chan error, 1)
-	go func() {
-		err := os.Rename(
-			filepath.Join(cluster.mountPoints[1], origName),
-			filepath.Join(cluster.mountPoints[1], newName))
-		renameCompleted.Store(true)
-		renameDone <- err
-	}()
-
-	// Rename must NOT complete while mount0 holds the file open
-	time.Sleep(3 * time.Second)
-	require.False(t, renameCompleted.Load(),
-		"rename must not complete while mount0 holds the file open")
-	t.Log("rename is blocked as expected while mount0 holds the file")
-
-	// Mount 0 closes → releases DLM lock → rename should proceed
-	require.NoError(t, f.Close(), "mount0 close")
-
-	select {
-	case err := <-renameDone:
-		assert.NoError(t, err, "rename after mount0 close")
-	case <-time.After(30 * time.Second):
-		t.Fatal("rename did not complete within 30s after mount0 closed")
-	}
-}
-
-// Note: Same-mount rename while a file is open for writing is not tested here
-// because macOS FUSE serializes operations on the same inode, causing a
-// kernel-level deadlock between the Rename handler's internal flush and the
-// pending Close. Same-mount coordination is already handled by the per-mount
-// fhLockTable and FUSE kernel serialization, so DLM is not needed for it.
-
-// TestDLMConcurrentRenames verifies that two concurrent renames of the same
-// file from different mounts don't corrupt metadata. DLM locks on both old
-// and new paths ensure renames are serialized.
-func TestDLMConcurrentRenames(t *testing.T) {
-	if testing.Short() {
-		t.Skip("skipping DLM integration test in short mode")
-	}
-
-	cluster := startDLMTestCluster(t)
-	t.Cleanup(cluster.Stop)
-
-	// Create a file first
-	origPath := filepath.Join(cluster.mountPoints[0], "rename_race.txt")
-	require.NoError(t, os.WriteFile(origPath, []byte("original-content"), 0644))
-	time.Sleep(1 * time.Second) // propagation
-
-	// Both mounts try to rename the same file concurrently
-	var wg sync.WaitGroup
-	var errA, errB error
-	wg.Add(2)
-
-	go func() {
-		defer wg.Done()
-		errA = os.Rename(
-			filepath.Join(cluster.mountPoints[0], "rename_race.txt"),
-			filepath.Join(cluster.mountPoints[0], "renamed_by_mount0.txt"),
-		)
-	}()
-
-	go func() {
-		defer wg.Done()
-		errB = os.Rename(
-			filepath.Join(cluster.mountPoints[1], "rename_race.txt"),
-			filepath.Join(cluster.mountPoints[1], "renamed_by_mount1.txt"),
-		)
-	}()
-
-	wg.Wait()
-
-	// At least one rename should succeed; the other may fail with ENOENT
-	// since the source was already moved.
-	succeeded := 0
-	if errA == nil {
-		succeeded++
-		t.Logf("mount0 rename succeeded")
-	} else {
-		t.Logf("mount0 rename failed: %v", errA)
-	}
-	if errB == nil {
-		succeeded++
-		t.Logf("mount1 rename succeeded")
-	} else {
-		t.Logf("mount1 rename failed: %v", errB)
-	}
-	assert.GreaterOrEqual(t, succeeded, 1, "at least one rename must succeed")
-}
@@ -1,516 +0,0 @@
-package fuse_dlm
-
-import (
-	"context"
-	"fmt"
-	"net"
-	"os"
-	"os/exec"
-	"path/filepath"
-	"strconv"
-	"sync"
-	"syscall"
-	"testing"
-	"time"
-
-	"github.com/seaweedfs/seaweedfs/weed/cluster/lock_manager"
-	"github.com/seaweedfs/seaweedfs/weed/pb"
-	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
-	"github.com/seaweedfs/seaweedfs/weed/pb/master_pb"
-	"github.com/stretchr/testify/require"
-	"google.golang.org/grpc"
-	"google.golang.org/grpc/credentials/insecure"
-)
-
-const filerGroup = "fuse-dlm-test"
-
-// dlmTestCluster manages a full SeaweedFS cluster with 2 filers and 2 FUSE
-// mounts for testing DLM-based cross-mount write coordination.
-type dlmTestCluster struct {
-	t          testing.TB
-	baseDir    string
-	weedBinary string
-
-	masterPort     int
-	masterGrpcPort int
-	volumePort     int
-	volumeGrpcPort int
-	filerPorts     [2]int
-	filerGrpcPorts [2]int
-	mountPoints    [2]string
-
-	masterCmd *exec.Cmd
-	volumeCmd *exec.Cmd
-	filerCmds [2]*exec.Cmd
-	mountCmds [2]*exec.Cmd
-	logFiles  []*os.File
-
-	cleanupOnce sync.Once
-}
-
-func startDLMTestCluster(t testing.TB) *dlmTestCluster {
-	binary := findWeedBinary()
-	if binary == "" {
-		t.Skip("weed binary not found; set WEED_BINARY or ensure it is on PATH")
-	}
-
-	baseDir, err := os.MkdirTemp("", "seaweedfs_fuse_dlm_test_")
-	require.NoError(t, err)
-
-	c := &dlmTestCluster{
-		t:          t,
-		baseDir:    baseDir,
-		weedBinary: binary,
-	}
-	// Register cleanup early so processes are stopped even if a require fails below.
-	t.Cleanup(c.Stop)
-
-	// Allocate ports: master(2) + volume(2) + filer0(2) + filer1(2) = 8
-	ports := allocatePorts(t, 8)
-	c.masterPort = ports[0]
-	c.masterGrpcPort = ports[1]
-	c.volumePort = ports[2]
-	c.volumeGrpcPort = ports[3]
-	c.filerPorts[0] = ports[4]
-	c.filerGrpcPorts[0] = ports[5]
-	c.filerPorts[1] = ports[6]
-	c.filerGrpcPorts[1] = ports[7]
-
-	// Write empty security.toml
-	configDir := filepath.Join(baseDir, "config")
-	require.NoError(t, os.MkdirAll(configDir, 0755))
-	require.NoError(t, os.WriteFile(filepath.Join(configDir, "security.toml"), []byte(""), 0644))
-
-	// Start master
-	require.NoError(t, c.startMaster(configDir))
-	require.NoError(t, c.waitForTCP(fmt.Sprintf("127.0.0.1:%d", c.masterPort), 30*time.Second),
-		"master not ready\n%s", c.tailLog("master"))
-
-	// Start volume
-	require.NoError(t, c.startVolume(configDir))
-	require.NoError(t, c.waitForTCP(fmt.Sprintf("127.0.0.1:%d", c.volumePort), 30*time.Second),
-		"volume not ready\n%s", c.tailLog("volume"))
-
-	// Start 2 filers
-	for i := 0; i < 2; i++ {
-		require.NoError(t, c.startFiler(i, configDir))
-		require.NoError(t, c.waitForTCP(fmt.Sprintf("127.0.0.1:%d", c.filerGrpcPorts[i]), 30*time.Second),
-			"filer %d not ready\n%s", i, c.tailLog(fmt.Sprintf("filer%d", i)))
-	}
-	require.NoError(t, c.waitForFilerCount(2, 30*time.Second), "filer group registration")
-	require.NoError(t, c.waitForLockRingConverged(30*time.Second), "lock ring convergence")
-
-	// Start 2 mounts, both pointing at filer0 for metadata consistency.
-	// (filer1 exists for the DLM lock ring but both mounts share filer0's
-	// metadata store since leveldb is per-filer.)
-	for i := 0; i < 2; i++ {
-		mp := filepath.Join(baseDir, fmt.Sprintf("mount%d", i))
-		require.NoError(t, os.MkdirAll(mp, 0755))
-		c.mountPoints[i] = mp
-		require.NoError(t, c.startMount(i, configDir))
-		require.NoError(t, c.waitForMount(mp, 30*time.Second),
-			"mount %d not ready\n%s", i, c.tailLog(fmt.Sprintf("mount%d", i)))
-	}
-
-	return c
-}
-
-func (c *dlmTestCluster) Stop() {
-	if c == nil {
-		return
-	}
-	c.cleanupOnce.Do(func() {
-		// Stop mounts first (triggers flush + DLM unlock).
-		// Use stopCmd for bounded wait to avoid hanging on wedged FUSE processes.
-		for i := 1; i >= 0; i-- {
-			stopCmd(c.mountCmds[i])
-			// Backup unmount in case FUSE teardown didn't clean up
-			exec.Command("fusermount3", "-u", c.mountPoints[i]).Run()
-			exec.Command("fusermount", "-u", c.mountPoints[i]).Run()
-		}
-		// Stop filers, volume, master
-		for i := 1; i >= 0; i-- {
-			stopCmd(c.filerCmds[i])
-		}
-		stopCmd(c.volumeCmd)
-		stopCmd(c.masterCmd)
-
-		for _, f := range c.logFiles {
-			f.Close()
-		}
-
-		// Copy logs for CI
-		c.copyLogsForCI()
-
-		if !c.t.Failed() {
-			os.RemoveAll(c.baseDir)
-		}
-
-		// Wait for ports to be fully released before the next test
-		// allocates new ports (avoids TIME_WAIT collisions).
-		time.Sleep(2 * time.Second)
-	})
-}
-
-// masterAddress returns the master address in the format that encodes both
-// HTTP and gRPC ports: "host:httpPort.grpcPort". This is the format that
-// SeaweedFS uses to communicate non-default gRPC ports between components.
-func (c *dlmTestCluster) masterAddress() string {
-	return string(pb.NewServerAddress("127.0.0.1", c.masterPort, c.masterGrpcPort))
-}
-
-func (c *dlmTestCluster) startMaster(configDir string) error {
-	c.masterCmd = exec.Command(c.weedBinary,
-		"-logdir="+filepath.Join(c.baseDir, "logs"),
-		"master",
-		"-ip=127.0.0.1",
-		"-ip.bind=127.0.0.1",
-		"-port="+strconv.Itoa(c.masterPort),
-		"-port.grpc="+strconv.Itoa(c.masterGrpcPort),
-		"-mdir="+filepath.Join(c.baseDir, "master"),
-	)
-	return c.startCmd(c.masterCmd, "master")
-}
-
-func (c *dlmTestCluster) startVolume(configDir string) error {
-	volDir := filepath.Join(c.baseDir, "volume")
-	if err := os.MkdirAll(volDir, 0755); err != nil {
-		return fmt.Errorf("create volume dir: %w", err)
-	}
-	c.volumeCmd = exec.Command(c.weedBinary,
-		"-logdir="+filepath.Join(c.baseDir, "logs"),
-		"volume",
-		"-ip=127.0.0.1",
-		"-ip.bind=127.0.0.1",
-		"-port="+strconv.Itoa(c.volumePort),
-		"-port.grpc="+strconv.Itoa(c.volumeGrpcPort),
-		"-master="+c.masterAddress(),
-		"-dir="+volDir,
-		"-max=10",
-	)
-	return c.startCmd(c.volumeCmd, "volume")
-}
-
-func (c *dlmTestCluster) startFiler(idx int, configDir string) error {
-	filerDir := filepath.Join(c.baseDir, fmt.Sprintf("filer%d", idx))
-	if err := os.MkdirAll(filerDir, 0755); err != nil {
-		return fmt.Errorf("create filer dir: %w", err)
-	}
-	c.filerCmds[idx] = exec.Command(c.weedBinary,
-		"-logdir="+filepath.Join(c.baseDir, "logs"),
-		"filer",
-		"-ip=127.0.0.1",
-		"-ip.bind=127.0.0.1",
-		"-port="+strconv.Itoa(c.filerPorts[idx]),
-		"-port.grpc="+strconv.Itoa(c.filerGrpcPorts[idx]),
-		"-master="+c.masterAddress(),
-		"-filerGroup="+filerGroup,
-		"-defaultStoreDir="+filerDir,
-	)
-	return c.startCmd(c.filerCmds[idx], fmt.Sprintf("filer%d", idx))
-}
-
-func (c *dlmTestCluster) filerAddress(idx int) string {
-	return string(pb.NewServerAddress("127.0.0.1", c.filerPorts[idx], c.filerGrpcPorts[idx]))
-}
-
-func (c *dlmTestCluster) startMount(idx int, configDir string) error {
-	cacheDir := filepath.Join(c.baseDir, fmt.Sprintf("cache%d", idx))
-	if err := os.MkdirAll(cacheDir, 0755); err != nil {
-		return fmt.Errorf("create cache dir: %w", err)
-	}
-	c.mountCmds[idx] = exec.Command(c.weedBinary,
-		"-logdir="+filepath.Join(c.baseDir, "logs"),
-		"mount",
-		"-filer="+c.filerAddress(0), // both mounts use filer0 for shared metadata
-		"-dir="+c.mountPoints[idx],
-		"-filer.path=/",
-		"-dirAutoCreate",
-		"-allowOthers=false",
-		"-cacheDir="+cacheDir,
-		"-dlm",
-	)
-	return c.startCmd(c.mountCmds[idx], fmt.Sprintf("mount%d", idx))
-}
-
-func (c *dlmTestCluster) startCmd(cmd *exec.Cmd, name string) error {
-	logPath := filepath.Join(c.baseDir, "logs")
-	if err := os.MkdirAll(logPath, 0755); err != nil {
-		return fmt.Errorf("create log dir: %w", err)
-	}
-	logFile, err := os.Create(filepath.Join(logPath, name+".log"))
-	if err != nil {
-		return err
-	}
-	c.logFiles = append(c.logFiles, logFile)
-	cmd.Stdout = logFile
-	cmd.Stderr = logFile
-	return cmd.Start()
-}
-
-func (c *dlmTestCluster) tailLog(name string) string {
-	data, err := os.ReadFile(filepath.Join(c.baseDir, "logs", name+".log"))
-	if err != nil {
-		return fmt.Sprintf("(log %s not available: %v)", name, err)
-	}
-	const maxTail = 8192
-	if len(data) > maxTail {
-		data = data[len(data)-maxTail:]
-	}
-	return string(data)
-}
-
-func (c *dlmTestCluster) copyLogsForCI() {
-	ciLogDir := "/tmp/seaweedfs-fuse-dlm-logs"
-	os.MkdirAll(ciLogDir, 0755)
-	logsDir := filepath.Join(c.baseDir, "logs")
-	entries, err := os.ReadDir(logsDir)
-	if err != nil {
-		return
-	}
-	for _, e := range entries {
-		data, err := os.ReadFile(filepath.Join(logsDir, e.Name()))
-		if err != nil {
-			continue
-		}
-		os.WriteFile(filepath.Join(ciLogDir, e.Name()), data, 0644)
-	}
-}
-
-func (c *dlmTestCluster) waitForTCP(addr string, timeout time.Duration) error {
-	deadline := time.Now().Add(timeout)
-	for time.Now().Before(deadline) {
-		conn, err := net.DialTimeout("tcp", addr, time.Second)
-		if err == nil {
-			conn.Close()
-			return nil
-		}
-		time.Sleep(200 * time.Millisecond)
-	}
-	return fmt.Errorf("service at %s not ready within timeout", addr)
-}
-
-// waitForMount waits for a FUSE filesystem to actually be mounted at
-// mountPoint by comparing the device ID of the mount point against its parent.
-// A plain directory (pre-created before mount) has the same device as its
-// parent; a mounted FUSE filesystem has a different device.
-func (c *dlmTestCluster) waitForMount(mountPoint string, timeout time.Duration) error {
-	parentDir := filepath.Dir(mountPoint)
-	deadline := time.Now().Add(timeout)
-	for time.Now().Before(deadline) {
-		parentStat, err := os.Stat(parentDir)
-		if err != nil {
-			time.Sleep(200 * time.Millisecond)
-			continue
-		}
-		mountStat, err := os.Stat(mountPoint)
-		if err != nil {
-			time.Sleep(200 * time.Millisecond)
-			continue
-		}
-		parentSys := parentStat.Sys().(*syscall.Stat_t)
-		mountSys := mountStat.Sys().(*syscall.Stat_t)
-		if parentSys.Dev != mountSys.Dev {
-			// Different device = FUSE mounted
-			return nil
-		}
-		time.Sleep(200 * time.Millisecond)
-	}
-	return fmt.Errorf("mount point %s not ready within timeout (FUSE not detected)", mountPoint)
-}
-
-func (c *dlmTestCluster) filerGRPCAddress(idx int) string {
-	return fmt.Sprintf("127.0.0.1:%d", c.filerGrpcPorts[idx])
-}
-
-func (c *dlmTestCluster) waitForFilerCount(expected int, timeout time.Duration) error {
-	addr := fmt.Sprintf("127.0.0.1:%d", c.masterGrpcPort)
-	conn, err := grpc.NewClient(addr, grpc.WithTransportCredentials(insecure.NewCredentials()))
-	if err != nil {
-		return err
-	}
-	defer conn.Close()
-
-	client := master_pb.NewSeaweedClient(conn)
-	deadline := time.Now().Add(timeout)
-	for time.Now().Before(deadline) {
-		ctx, cancel := context.WithTimeout(context.Background(), time.Second)
-		resp, err := client.ListClusterNodes(ctx, &master_pb.ListClusterNodesRequest{
-			ClientType: "filer",
-			FilerGroup: filerGroup,
-		})
-		cancel()
-		if err == nil && len(resp.ClusterNodes) >= expected {
-			return nil
-		}
-		time.Sleep(200 * time.Millisecond)
-	}
-	return fmt.Errorf("timed out waiting for %d filers in group %q", expected, filerGroup)
-}
-
-// waitForLockRingConverged verifies that both filers have a consistent view of
-// the lock ring by acquiring the same lock through each filer and checking
-// mutual exclusion. Adapted from test/s3/distributed_lock/.
-func (c *dlmTestCluster) waitForLockRingConverged(timeout time.Duration) error {
-	deadline := time.Now().Add(timeout)
-
-	owners := []pb.ServerAddress{
-		pb.ServerAddress(c.filerGRPCAddress(0)),
-		pb.ServerAddress(c.filerGRPCAddress(1)),
-	}
-	ring := lock_manager.NewHashRing(lock_manager.DefaultVnodeCount)
-	ring.SetServers(owners)
-
-	attempt := 0
-	for time.Now().Before(deadline) {
-		testKeys := convergenceKeysPerPrimary(ring, owners, attempt)
-		attempt++
-
-		allConverged := true
-		for _, key := range testKeys {
-			converged, _ := c.checkLockMutualExclusion(key)
-			if !converged {
-				allConverged = false
-				break
-			}
-		}
-		if allConverged {
-			return nil
-		}
-		time.Sleep(500 * time.Millisecond)
-	}
-	return fmt.Errorf("lock ring did not converge")
-}
-
-// convergenceKeysPerPrimary generates one test key per primary filer.
-func convergenceKeysPerPrimary(ring *lock_manager.HashRing, owners []pb.ServerAddress, attempt int) []string {
-	found := make(map[pb.ServerAddress]bool)
-	var keys []string
-	for i := 0; len(found) < len(owners) && i < 10000; i++ {
-		key := fmt.Sprintf("convergence-test-%d-%d", attempt, i)
-		primary, _ := ring.GetPrimaryAndBackup(key)
-		if !found[primary] {
-			found[primary] = true
-			keys = append(keys, key)
-		}
-	}
-	return keys
-}
-
-func (c *dlmTestCluster) checkLockMutualExclusion(key string) (bool, error) {
-	// Try to lock via filer0
-	conn0, err := grpc.NewClient(c.filerGRPCAddress(0), grpc.WithTransportCredentials(insecure.NewCredentials()))
-	if err != nil {
-		return false, err
-	}
-	defer conn0.Close()
-
-	client0 := filer_pb.NewSeaweedFilerClient(conn0)
-	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
-	defer cancel()
-	resp0, err := client0.DistributedLock(ctx, &filer_pb.LockRequest{
-		Name:          key,
-		SecondsToLock: 5,
-		Owner:         "convergence-test-0",
-	})
-	if err != nil {
-		return false, err
-	}
-	if resp0.Error != "" {
-		return false, fmt.Errorf("lock0: %s", resp0.Error)
-	}
-
-	// Try to lock via filer1 — should fail (already locked)
-	conn1, err := grpc.NewClient(c.filerGRPCAddress(1), grpc.WithTransportCredentials(insecure.NewCredentials()))
-	if err != nil {
-		return false, err
-	}
-	defer conn1.Close()
-
-	client1 := filer_pb.NewSeaweedFilerClient(conn1)
-	resp1, err := client1.DistributedLock(ctx, &filer_pb.LockRequest{
-		Name:          key,
-		SecondsToLock: 5,
-		Owner:         "convergence-test-1",
-	})
-
-	// Unlock via filer0
-	client0.DistributedUnlock(ctx, &filer_pb.UnlockRequest{
-		Name:       key,
-		RenewToken: resp0.RenewToken,
-	})
-
-	if err != nil {
-		return false, err
-	}
-	// If filer1 also got the lock, the ring hasn't converged
-	if resp1.Error == "" {
-		// Unlock the second one too
-		client1.DistributedUnlock(ctx, &filer_pb.UnlockRequest{
-			Name:       key,
-			RenewToken: resp1.RenewToken,
-		})
-		return false, nil
-	}
-
-	return true, nil
-}
-
-func stopCmd(cmd *exec.Cmd) {
-	if cmd == nil || cmd.Process == nil {
-		return
-	}
-	cmd.Process.Signal(syscall.SIGTERM)
-	done := make(chan struct{})
-	go func() {
-		cmd.Wait()
-		close(done)
-	}()
-	select {
-	case <-done:
-	case <-time.After(10 * time.Second):
-		cmd.Process.Kill()
-		<-done
-	}
-}
-
-func allocatePorts(t testing.TB, n int) []int {
-	t.Helper()
-	// Hold all listeners open until all ports are collected, then close
-	// them together. This prevents the OS from reassigning a just-freed
-	// port to the next Listen call within the same allocation batch.
-	listeners := make([]net.Listener, 0, n)
-	ports := make([]int, 0, n)
-	defer func() {
-		for _, l := range listeners {
-			l.Close()
-		}
-	}()
-	for i := 0; i < n; i++ {
-		l, err := net.Listen("tcp", "127.0.0.1:0")
-		require.NoError(t, err)
-		listeners = append(listeners, l)
-		ports = append(ports, l.Addr().(*net.TCPAddr).Port)
-	}
-	return ports
-}
-
-func findWeedBinary() string {
-	if p := os.Getenv("WEED_BINARY"); p != "" {
-		return p
-	}
-	if p, err := exec.LookPath("weed"); err == nil {
-		return p
-	}
-	candidates := []string{
-		"../../weed/weed",
-		"./weed",
-	}
-	for _, c := range candidates {
-		if info, err := os.Stat(c); err == nil && !info.IsDir() {
-			abs, _ := filepath.Abs(c)
-			return abs
-		}
-	}
-	return ""
-}
@@ -82,13 +82,12 @@ func NewFuseTestFramework(t *testing.T, config *TestConfig) *FuseTestFramework {
 	}
 }

-// freePort asks the OS for a free TCP port in a range where the gRPC
-// offset (port + 10000) won't collide with well-known ports.
+// freePort asks the OS for a free TCP port.
 func freePort(t *testing.T) int {
 	t.Helper()
 	const (
 		minServicePort = 20000
-		maxServicePort = 55535
+		maxServicePort = 55535 // SeaweedFS gRPC service uses httpPort + 10000.
 	)

 	portCount := maxServicePort - minServicePort + 1
@@ -1,314 +0,0 @@
-package fuse_test
-
-import (
-	"bytes"
-	"crypto/rand"
-	"fmt"
-	"io"
-	"net/http"
-	"os"
-	"path/filepath"
-	"runtime"
-	"sync"
-	"testing"
-	"time"
-
-	"github.com/stretchr/testify/require"
-)
-
-// mountDebugPort holds the debug/pprof port the test passed to the
-// mount process via -debug.port. It is set once at TestWriteBufferCap
-// entry and consulted from the write-timeout paths to fetch the mount
-// process's goroutine dump (the test's own dumpAllGoroutines only
-// covers the test process).
-var mountDebugPort int
-
-// fetchMountGoroutines pulls a full goroutine dump from the mount
-// process's pprof endpoint. If the mount debug port isn't configured
-// or the HTTP call fails, a short explanation is returned instead of
-// an error — this is diagnostic best-effort, not a test assertion.
-func fetchMountGoroutines() string {
-	if mountDebugPort == 0 {
-		return "(mount debug port not configured)"
-	}
-	url := fmt.Sprintf("http://127.0.0.1:%d/debug/pprof/goroutine?debug=2", mountDebugPort)
-	client := &http.Client{Timeout: 10 * time.Second}
-	resp, err := client.Get(url)
-	if err != nil {
-		return fmt.Sprintf("(failed to reach mount pprof at %s: %v)", url, err)
-	}
-	defer resp.Body.Close()
-	body, err := io.ReadAll(resp.Body)
-	if err != nil {
-		return fmt.Sprintf("(failed to read mount pprof body: %v)", err)
-	}
-	return string(body)
-}
-
-// dumpAllGoroutines returns a full stack trace of every live goroutine.
-// Used on write-timeout to give CI actionable diagnosis if the write
-// buffer cap ever re-regresses into a hang.
-func dumpAllGoroutines() string {
-	buf := make([]byte, 1<<20)
-	for {
-		n := runtime.Stack(buf, true)
-		if n < len(buf) {
-			return string(buf[:n])
-		}
-		buf = make([]byte, 2*len(buf))
-	}
-}
-
-// writeBufferCapConfig returns a TestConfig that exercises the new
-// -writeBufferSizeMB flag. The cap is set below the aggregate in-flight
-// write demand of the subtests below, so every new chunk has to pass
-// through the Reserve/Release backpressure path at least some of the
-// time. The cap is intentionally NOT minimal — over-tight settings
-// interact with the per-file writable-chunk limit and the FUSE MaxWrite
-// batching in ways that starve single-handle writers on slow CI.
-//
-// Also enables the mount's pprof debug endpoint so the test can fetch
-// mount-process goroutine dumps on write-timeout, which is the only
-// way to actually diagnose a backpressure deadlock (the test process
-// itself is just blocked in syscall.Write waiting on FUSE).
-func writeBufferCapConfig(debugPort int) *TestConfig {
-	return &TestConfig{
-		Collection:  "",
-		Replication: "000",
-		ChunkSizeMB: 2,   // 2 MiB chunks
-		CacheSizeMB: 100, // read cache (unrelated)
-		NumVolumes:  3,
-		EnableDebug: false,
-		MountOptions: []string{
-			// 16 MiB total write buffer ⇒ up to 8 chunks in flight
-			// across every open file handle on this mount. Large
-			// enough to avoid starving a single handle on a slow
-			// CI runner, small enough that the concurrent test
-			// below still has to drain through it.
-			"-writeBufferSizeMB=16",
-			"-debug=true",
-			fmt.Sprintf("-debug.port=%d", debugPort),
-			// Route glog to stderr so the framework's process log
-			// capture actually contains something — by default weed
-			// sends glog to /tmp/weed.* files which the CI artifact
-			// upload step never sees. Critical for diagnosing
-			// upload/saveToStorage errors on Linux runs.
-			"-logtostderr=true",
-			"-v=2",
-		},
-		SkipCleanup: false,
-	}
-}
-
-// writeWithTimeout wraps os.WriteFile with a hard deadline so a stuck
-// write fails the test fast instead of consuming the full job budget.
-// This is belt-and-braces around the 45-minute workflow timeout and
-// makes write-buffer regressions surface as an actionable failure.
-func writeWithTimeout(t *testing.T, path string, data []byte, timeout time.Duration) {
-	t.Helper()
-	done := make(chan error, 1)
-	go func() { done <- os.WriteFile(path, data, 0644) }()
-	select {
-	case err := <-done:
-		if err != nil {
-			// Dump mount goroutines on any write error, not just
-			// timeout — upload failures that surface via close()
-			// as EIO leave the mount process running but in an
-			// informative state (pending sealed chunks, error
-			// counters, etc).
-			t.Logf("write %s failed (%v) — dumping MOUNT goroutines:\n%s", path, err, fetchMountGoroutines())
-		}
-		require.NoError(t, err, "write %s", path)
-	case <-time.After(timeout):
-		t.Logf("write %s did not finish within %v — dumping TEST goroutines:\n%s", path, timeout, dumpAllGoroutines())
-		t.Logf("dumping MOUNT goroutines:\n%s", fetchMountGoroutines())
-		t.Fatalf("write %s timed out — write buffer cap is likely leaking or deadlocking", path)
-	}
-}
-
-// runSubtestWithWatchdog runs body on the current (subtest main)
-// goroutine and starts a watcher goroutine that logs diagnostics and
-// fails the test if body doesn't return within timeout.
-//
-// body must run on the main goroutine because test helpers inside it
-// (require.NoError, writeWithTimeout's own t.Fatalf on its internal
-// timeout) need t.Fatal / t.FailNow, which Go's testing docs restrict
-// to the goroutine running the test function. The watcher goroutine
-// only calls goroutine-safe t methods (t.Log, t.Logf, t.Errorf) so it
-// can mark the test failed and dump diagnostics without violating
-// that contract. If body is stuck past timeout the watcher still
-// surfaces the wedge (test + mount goroutine dumps + a FAIL mark);
-// body itself gets unblocked either by its own inner writeWithTimeout
-// firing t.Fatalf or by Go test's global -timeout.
-func runSubtestWithWatchdog(t *testing.T, timeout time.Duration, body func(t *testing.T)) {
-	t.Helper()
-	stop := make(chan struct{})
-	defer close(stop)
-	go func() {
-		select {
-		case <-stop:
-			return
-		case <-time.After(timeout):
-			t.Logf("subtest exceeded %v watchdog — dumping TEST goroutines:\n%s", timeout, dumpAllGoroutines())
-			t.Logf("dumping MOUNT goroutines:\n%s", fetchMountGoroutines())
-			t.Errorf("subtest exceeded %v watchdog — see goroutine dumps above", timeout)
-		}
-	}()
-	body(t)
-}
-
-// TestWriteBufferCap exercises the end-to-end write-buffer cap on a
-// real FUSE mount. Without the cap, a volume-server stall would let
-// the swap file grow without bound (issue #8777). With the cap, writers
-// must serialize through a bounded budget while still producing correct
-// output — that correctness (and the absence of deadlocks) is what
-// this test verifies.
-//
-// Note: this test deliberately does not assert that Reserve *blocked*
-// at some observed used-byte peak. The mount runs as a subprocess so
-// its in-process WriteBufferAccountant state is not reachable from the
-// test without adding a metrics/RPC surface to the mount binary. The
-// deterministic peak-vs-cap assertion instead lives in the in-package
-// unit test TestWriteBufferCap_SharedAcrossPipelines, which drives a
-// controlled gated uploader and samples Used() throughout the run.
-func TestWriteBufferCap(t *testing.T) {
-	mountDebugPort = freePort(t)
-	config := writeBufferCapConfig(mountDebugPort)
-	framework := NewFuseTestFramework(t, config)
-	defer framework.Cleanup()
-
-	require.NoError(t, framework.Setup(config))
-
-	const subtestTimeout = 3 * time.Minute
-
-	t.Run("ConcurrentWritesUnderCap", func(t *testing.T) {
-		runSubtestWithWatchdog(t, subtestTimeout, func(t *testing.T) {
-			testConcurrentWritesUnderCap(t, framework)
-		})
-	})
-
-	t.Run("LargeFileUnderCap", func(t *testing.T) {
-		runSubtestWithWatchdog(t, subtestTimeout, func(t *testing.T) {
-			testLargeFileUnderCap(t, framework)
-		})
-	})
-
-	t.Run("DoesNotDeadlockAfterPressure", func(t *testing.T) {
-		runSubtestWithWatchdog(t, subtestTimeout, func(t *testing.T) {
-			testWriteBufferNoDeadlockAfterPressure(t, framework)
-		})
-	})
-}
-
-// testConcurrentWritesUnderCap opens several files in parallel with
-// aggregate demand that exceeds the 16 MiB write buffer cap, then
-// verifies every byte survived the round trip.
-func testConcurrentWritesUnderCap(t *testing.T, framework *FuseTestFramework) {
-	const (
-		numFiles = 4
-		fileSize = 8 * 1024 * 1024 // 8 MiB per file ⇒ 32 MiB total vs 16 MiB cap
-	)
-
-	dir := "write_buffer_cap_concurrent"
-	framework.CreateTestDir(dir)
-
-	payloads := make([][]byte, numFiles)
-	for i := range payloads {
-		buf := make([]byte, fileSize)
-		_, err := rand.Read(buf)
-		require.NoError(t, err)
-		payloads[i] = buf
-	}
-
-	start := time.Now()
-	var wg sync.WaitGroup
-	errs := make(chan error, numFiles)
-	timedOut := make(chan struct{}, numFiles)
-	for i := 0; i < numFiles; i++ {
-		i := i
-		wg.Add(1)
-		go func() {
-			defer wg.Done()
-			name := fmt.Sprintf("file_%02d.bin", i)
-			path := filepath.Join(framework.GetMountPoint(), dir, name)
-			done := make(chan error, 1)
-			go func() { done <- os.WriteFile(path, payloads[i], 0644) }()
-			select {
-			case err := <-done:
-				if err != nil {
-					errs <- fmt.Errorf("writer %d: %w", i, err)
-				}
-			case <-time.After(90 * time.Second):
-				timedOut <- struct{}{}
-				errs <- fmt.Errorf("writer %d: timed out after 90s", i)
-			}
-		}()
-	}
-	wg.Wait()
-	close(errs)
-	// If any writer timed out, dump every live goroutine so CI shows the
-	// wedge instead of just a walltime.
-	select {
-	case <-timedOut:
-		t.Logf("at least one concurrent writer timed out — dumping goroutines:\n%s", dumpAllGoroutines())
-	default:
-	}
-	for err := range errs {
-		t.Fatal(err)
-	}
-	t.Logf("wrote %d × %d MiB under 16 MiB cap in %v", numFiles, fileSize/(1024*1024), time.Since(start))
-
-	for i := 0; i < numFiles; i++ {
-		name := fmt.Sprintf("file_%02d.bin", i)
-		path := filepath.Join(framework.GetMountPoint(), dir, name)
-		got, err := os.ReadFile(path)
-		require.NoError(t, err, "read %s", name)
-		require.Equal(t, len(payloads[i]), len(got), "size mismatch for %s", name)
-		if !bytes.Equal(payloads[i], got) {
-			t.Fatalf("content mismatch for %s", name)
-		}
-	}
-}
-
-// testLargeFileUnderCap writes a single file whose size exceeds the
-// 16 MiB cap through a single handle, verifying that the pipeline
-// drains its own earlier chunks and makes forward progress rather than
-// self-deadlocking when the global budget is already full of its own
-// earlier sealed chunks.
-func testLargeFileUnderCap(t *testing.T, framework *FuseTestFramework) {
-	const fileSize = 20 * 1024 * 1024 // 20 MiB ⇒ 10 chunks vs 8-slot budget
-
-	payload := make([]byte, fileSize)
-	_, err := rand.Read(payload)
-	require.NoError(t, err)
-
-	name := "write_buffer_cap_large.bin"
-	path := filepath.Join(framework.GetMountPoint(), name)
-
-	start := time.Now()
-	writeWithTimeout(t, path, payload, 90*time.Second)
-	t.Logf("wrote %d MiB through one handle under 16 MiB cap in %v", fileSize/(1024*1024), time.Since(start))
-
-	got, err := os.ReadFile(path)
-	require.NoError(t, err)
-	require.Equal(t, len(payload), len(got))
-	if !bytes.Equal(payload, got) {
-		t.Fatal("content mismatch on large single-handle write")
-	}
-}
-
-// testWriteBufferNoDeadlockAfterPressure verifies the mount is still
-// healthy after being driven against the cap. A budget-slot leak would
-// eventually cause every new chunk allocation to hang; a quick canary
-// write catches that as a hard failure.
-func testWriteBufferNoDeadlockAfterPressure(t *testing.T, framework *FuseTestFramework) {
-	name := "write_buffer_cap_canary.txt"
-	path := filepath.Join(framework.GetMountPoint(), name)
-	content := []byte("write buffer cap canary — mount still healthy")
-
-	writeWithTimeout(t, path, content, 30*time.Second)
-
-	got, err := os.ReadFile(path)
-	require.NoError(t, err)
-	require.Equal(t, content, got)
-}
@@ -14,7 +14,7 @@ require (
 replace github.com/seaweedfs/seaweedfs => ../../

 require (
-	cloud.google.com/go/auth v0.18.2 // indirect
+	cloud.google.com/go/auth v0.18.1 // indirect
 	cloud.google.com/go/auth/oauth2adapt v0.2.8 // indirect
 	cloud.google.com/go/compute/metadata v0.9.0 // indirect
 	github.com/Azure/azure-sdk-for-go/sdk/azcore v1.21.0 // indirect
@@ -44,23 +44,23 @@ require (
 	github.com/appscode/go-querystring v0.0.0-20170504095604-0126cfb3f1dc // indirect
 	github.com/aws/aws-sdk-go v1.55.8 // indirect
 	github.com/aws/aws-sdk-go-v2 v1.41.5 // indirect
-	github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.8 // indirect
+	github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.4 // indirect
 	github.com/aws/aws-sdk-go-v2/config v1.32.13 // indirect
-	github.com/aws/aws-sdk-go-v2/credentials v1.19.14 // indirect
+	github.com/aws/aws-sdk-go-v2/credentials v1.19.13 // indirect
 	github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.21 // indirect
 	github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.20.12 // indirect
 	github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.21 // indirect
 	github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.21 // indirect
 	github.com/aws/aws-sdk-go-v2/internal/ini v1.8.6 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.22 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.17 // indirect
 	github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.7 // indirect
-	github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.9.13 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.9.8 // indirect
 	github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.21 // indirect
-	github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.19.21 // indirect
-	github.com/aws/aws-sdk-go-v2/service/s3 v1.98.0 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.19.17 // indirect
+	github.com/aws/aws-sdk-go-v2/service/s3 v1.96.0 // indirect
 	github.com/aws/aws-sdk-go-v2/service/signin v1.0.9 // indirect
-	github.com/aws/aws-sdk-go-v2/service/sso v1.30.15 // indirect
-	github.com/aws/aws-sdk-go-v2/service/ssooidc v1.35.19 // indirect
+	github.com/aws/aws-sdk-go-v2/service/sso v1.30.14 // indirect
+	github.com/aws/aws-sdk-go-v2/service/ssooidc v1.35.18 // indirect
 	github.com/aws/aws-sdk-go-v2/service/sts v1.41.10 // indirect
 	github.com/aws/smithy-go v1.24.2 // indirect
 	github.com/bahlo/generic-list-go v0.2.0 // indirect
@@ -124,8 +124,8 @@ require (
 	github.com/google/btree v1.1.3 // indirect
 	github.com/google/s2a-go v0.1.9 // indirect
 	github.com/google/uuid v1.6.0 // indirect
-	github.com/googleapis/enterprise-certificate-proxy v0.3.14 // indirect
-	github.com/googleapis/gax-go/v2 v2.19.0 // indirect
+	github.com/googleapis/enterprise-certificate-proxy v0.3.11 // indirect
+	github.com/googleapis/gax-go/v2 v2.17.0 // indirect
 	github.com/gorilla/mux v1.8.1 // indirect
 	github.com/gorilla/schema v1.4.1 // indirect
 	github.com/hashicorp/errwrap v1.1.0 // indirect
@@ -197,6 +197,7 @@ require (
 	github.com/rcrowley/go-metrics v0.0.0-20250401214520-65e299d6c5c9 // indirect
 	github.com/rdleal/intervalst v1.5.0 // indirect
 	github.com/relvacode/iso8601 v1.7.0 // indirect
+	github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec // indirect
 	github.com/rfjakob/eme v1.1.2 // indirect
 	github.com/sabhiram/go-gitignore v0.0.0-20210923224102-525f6e181f06 // indirect
 	github.com/sagikazarmark/locafero v0.11.0 // indirect
@@ -241,29 +242,30 @@ require (
 	go.mongodb.org/mongo-driver v1.17.9 // indirect
 	go.opentelemetry.io/auto/sdk v1.2.1 // indirect
 	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.63.0 // indirect
-	go.opentelemetry.io/otel v1.42.0 // indirect
-	go.opentelemetry.io/otel/metric v1.42.0 // indirect
-	go.opentelemetry.io/otel/trace v1.42.0 // indirect
+	go.opentelemetry.io/otel v1.40.0 // indirect
+	go.opentelemetry.io/otel/metric v1.40.0 // indirect
+	go.opentelemetry.io/otel/trace v1.40.0 // indirect
 	go.yaml.in/yaml/v2 v2.4.3 // indirect
 	go.yaml.in/yaml/v3 v3.0.4 // indirect
 	golang.org/x/crypto v0.49.0 // indirect
 	golang.org/x/exp v0.0.0-20260218203240-3dfff04db8fa // indirect
 	golang.org/x/image v0.38.0 // indirect
-	golang.org/x/net v0.52.0 // indirect
+	golang.org/x/net v0.51.0 // indirect
 	golang.org/x/oauth2 v0.36.0 // indirect
 	golang.org/x/sync v0.20.0 // indirect
 	golang.org/x/sys v0.42.0 // indirect
 	golang.org/x/term v0.41.0 // indirect
 	golang.org/x/text v0.35.0 // indirect
-	golang.org/x/time v0.15.0 // indirect
-	google.golang.org/api v0.274.0 // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20260319201613-d00831a3d3e7 // indirect
+	golang.org/x/time v0.14.0 // indirect
+	google.golang.org/api v0.267.0 // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20260203192932-546029d2fa20 // indirect
 	google.golang.org/grpc/security/advancedtls v1.0.0 // indirect
 	google.golang.org/protobuf v1.36.11 // indirect
 	gopkg.in/natefinch/lumberjack.v2 v2.2.1 // indirect
 	gopkg.in/validator.v2 v2.0.1 // indirect
 	gopkg.in/yaml.v2 v2.4.0 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
+	modernc.org/mathutil v1.7.1 // indirect
 	moul.io/http2curl/v2 v2.3.0 // indirect
 	sigs.k8s.io/yaml v1.6.0 // indirect
 	storj.io/common v0.0.0-20251107171817-6221ae45072c // indirect
@@ -13,8 +13,8 @@ cloud.google.com/go v0.56.0/go.mod h1:jr7tqZxxKOVYizybht9+26Z/gUq7tiRzu+ACVAMbKV
 cloud.google.com/go v0.57.0/go.mod h1:oXiQ6Rzq3RAkkY7N6t3TcE6jE+CIBBbA36lwQ1JyzZs=
 cloud.google.com/go v0.62.0/go.mod h1:jmCYTdRCQuc1PHIIJ/maLInMho30T/Y0M4hTdTShOYc=
 cloud.google.com/go v0.65.0/go.mod h1:O5N8zS7uWy9vkA9vayVHs65eM1ubvY4h553ofrNHObY=
-cloud.google.com/go/auth v0.18.2 h1:+Nbt5Ev0xEqxlNjd6c+yYUeosQ5TtEUaNcN/3FozlaM=
-cloud.google.com/go/auth v0.18.2/go.mod h1:xD+oY7gcahcu7G2SG2DsBerfFxgPAJz17zz2joOFF3M=
+cloud.google.com/go/auth v0.18.1 h1:IwTEx92GFUo2pJ6Qea0EU3zYvKnTAeRCODxfA/G5UWs=
+cloud.google.com/go/auth v0.18.1/go.mod h1:GfTYoS9G3CWpRA3Va9doKN9mjPGRS+v41jmZAhBzbrA=
 cloud.google.com/go/auth/oauth2adapt v0.2.8 h1:keo8NaayQZ6wimpNSmW5OPc283g65QNIiLpZnkHRbnc=
 cloud.google.com/go/auth/oauth2adapt v0.2.8/go.mod h1:XQ9y31RkqZCcwJWNSx2Xvric3RrU88hAYYbjDWYDL+c=
 cloud.google.com/go/bigquery v1.0.1/go.mod h1:i/xbL2UlR5RvWAURpBYZTtm/cXjCha9lbfbpx4poX+o=
@@ -114,12 +114,12 @@ github.com/aws/aws-sdk-go v1.55.8 h1:JRmEUbU52aJQZ2AjX4q4Wu7t4uZjOu71uyNmaWlUkJQ
 github.com/aws/aws-sdk-go v1.55.8/go.mod h1:ZkViS9AqA6otK+JBBNH2++sx1sgxrPKcSzPPvQkUtXk=
 github.com/aws/aws-sdk-go-v2 v1.41.5 h1:dj5kopbwUsVUVFgO4Fi5BIT3t4WyqIDjGKCangnV/yY=
 github.com/aws/aws-sdk-go-v2 v1.41.5/go.mod h1:mwsPRE8ceUUpiTgF7QmQIJ7lgsKUPQOUl3o72QBrE1o=
-github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.8 h1:eBMB84YGghSocM7PsjmmPffTa+1FBUeNvGvFou6V/4o=
-github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.8/go.mod h1:lyw7GFp3qENLh7kwzf7iMzAxDn+NzjXEAGjKS2UOKqI=
+github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.4 h1:489krEF9xIGkOaaX3CE/Be2uWjiXrkCH6gUX+bZA/BU=
+github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.4/go.mod h1:IOAPF6oT9KCsceNTvvYMNHy0+kMF8akOjeDvPENWxp4=
 github.com/aws/aws-sdk-go-v2/config v1.32.13 h1:5KgbxMaS2coSWRrx9TX/QtWbqzgQkOdEa3sZPhBhCSg=
 github.com/aws/aws-sdk-go-v2/config v1.32.13/go.mod h1:8zz7wedqtCbw5e9Mi2doEwDyEgHcEE9YOJp6a8jdSMY=
-github.com/aws/aws-sdk-go-v2/credentials v1.19.14 h1:n+UcGWAIZHkXzYt87uMFBv/l8THYELoX6gVcUvgl6fI=
-github.com/aws/aws-sdk-go-v2/credentials v1.19.14/go.mod h1:cJKuyWB59Mqi0jM3nFYQRmnHVQIcgoxjEMAbLkpr62w=
+github.com/aws/aws-sdk-go-v2/credentials v1.19.13 h1:mA59E3fokBvyEGHKFdnpNNrvaR351cqiHgRg+JzOSRI=
+github.com/aws/aws-sdk-go-v2/credentials v1.19.13/go.mod h1:yoTXOQKea18nrM69wGF9jBdG4WocSZA1h38A+t/MAsk=
 github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.21 h1:NUS3K4BTDArQqNu2ih7yeDLaS3bmHD0YndtA6UP884g=
 github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.21/go.mod h1:YWNWJQNjKigKY1RHVJCuupeWDrrHjRqHm0N9rdrWzYI=
 github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.20.12 h1:Zy6Tme1AA13kX8x3CnkHx5cqdGWGaj/anwOiWGnA0Xo=
@@ -130,24 +130,24 @@ github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.21 h1:PEgGVtPoB6NTpPrBgq
 github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.21/go.mod h1:p+hz+PRAYlY3zcpJhPwXlLC4C+kqn70WIHwnzAfs6ps=
 github.com/aws/aws-sdk-go-v2/internal/ini v1.8.6 h1:qYQ4pzQ2Oz6WpQ8T3HvGHnZydA72MnLuFK9tJwmrbHw=
 github.com/aws/aws-sdk-go-v2/internal/ini v1.8.6/go.mod h1:O3h0IK87yXci+kg6flUKzJnWeziQUKciKrLjcatSNcY=
-github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.22 h1:rWyie/PxDRIdhNf4DzRk0lvjVOqFJuNnO8WwaIRVxzQ=
-github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.22/go.mod h1:zd/JsJ4P7oGfUhXn1VyLqaRZwPmZwg44Jf2dS84Dm3Y=
+github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.17 h1:JqcdRG//czea7Ppjb+g/n4o8i/R50aTBHkA7vu0lK+k=
+github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.17/go.mod h1:CO+WeGmIdj/MlPel2KwID9Gt7CNq4M65HUfBW97liM0=
 github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.7 h1:5EniKhLZe4xzL7a+fU3C2tfUN4nWIqlLesfrjkuPFTY=
 github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.7/go.mod h1:x0nZssQ3qZSnIcePWLvcoFisRXJzcTVvYpAAdYX8+GI=
-github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.9.13 h1:JRaIgADQS/U6uXDqlPiefP32yXTda7Kqfx+LgspooZM=
-github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.9.13/go.mod h1:CEuVn5WqOMilYl+tbccq8+N2ieCy0gVn3OtRb0vBNNM=
+github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.9.8 h1:Z5EiPIzXKewUQK0QTMkutjiaPVeVYXX7KIqhXu/0fXs=
+github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.9.8/go.mod h1:FsTpJtvC4U1fyDXk7c71XoDv3HlRm8V3NiYLeYLh5YE=
 github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.21 h1:c31//R3xgIJMSC8S6hEVq+38DcvUlgFY0FM6mSI5oto=
 github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.21/go.mod h1:r6+pf23ouCB718FUxaqzZdbpYFyDtehyZcmP5KL9FkA=
-github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.19.21 h1:ZlvrNcHSFFWURB8avufQq9gFsheUgjVD9536obIknfM=
-github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.19.21/go.mod h1:cv3TNhVrssKR0O/xxLJVRfd2oazSnZnkUeTf6ctUwfQ=
-github.com/aws/aws-sdk-go-v2/service/s3 v1.98.0 h1:foqo/ocQ7WqKwy3FojGtZQJo0FR4vto9qnz9VaumbCo=
-github.com/aws/aws-sdk-go-v2/service/s3 v1.98.0/go.mod h1:uoA43SdFwacedBfSgfFSjjCvYe8aYBS7EnU5GZ/YKMM=
+github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.19.17 h1:bGeHBsGZx0Dvu/eJC0Lh9adJa3M1xREcndxLNZlve2U=
+github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.19.17/go.mod h1:dcW24lbU0CzHusTE8LLHhRLI42ejmINN8Lcr22bwh/g=
+github.com/aws/aws-sdk-go-v2/service/s3 v1.96.0 h1:oeu8VPlOre74lBA/PMhxa5vewaMIMmILM+RraSyB8KA=
+github.com/aws/aws-sdk-go-v2/service/s3 v1.96.0/go.mod h1:5jggDlZ2CLQhwJBiZJb4vfk4f0GxWdEDruWKEJ1xOdo=
 github.com/aws/aws-sdk-go-v2/service/signin v1.0.9 h1:QKZH0S178gCmFEgst8hN0mCX1KxLgHBKKY/CLqwP8lg=
 github.com/aws/aws-sdk-go-v2/service/signin v1.0.9/go.mod h1:7yuQJoT+OoH8aqIxw9vwF+8KpvLZ8AWmvmUWHsGQZvI=
-github.com/aws/aws-sdk-go-v2/service/sso v1.30.15 h1:lFd1+ZSEYJZYvv9d6kXzhkZu07si3f+GQ1AaYwa2LUM=
-github.com/aws/aws-sdk-go-v2/service/sso v1.30.15/go.mod h1:WSvS1NLr7JaPunCXqpJnWk1Bjo7IxzZXrZi1QQCkuqM=
-github.com/aws/aws-sdk-go-v2/service/ssooidc v1.35.19 h1:dzztQ1YmfPrxdrOiuZRMF6fuOwWlWpD2StNLTceKpys=
-github.com/aws/aws-sdk-go-v2/service/ssooidc v1.35.19/go.mod h1:YO8TrYtFdl5w/4vmjL8zaBSsiNp3w0L1FfKVKenZT7w=
+github.com/aws/aws-sdk-go-v2/service/sso v1.30.14 h1:GcLE9ba5ehAQma6wlopUesYg/hbcOhFNWTjELkiWkh4=
+github.com/aws/aws-sdk-go-v2/service/sso v1.30.14/go.mod h1:WSvS1NLr7JaPunCXqpJnWk1Bjo7IxzZXrZi1QQCkuqM=
+github.com/aws/aws-sdk-go-v2/service/ssooidc v1.35.18 h1:mP49nTpfKtpXLt5SLn8Uv8z6W+03jYVoOSAl/c02nog=
+github.com/aws/aws-sdk-go-v2/service/ssooidc v1.35.18/go.mod h1:YO8TrYtFdl5w/4vmjL8zaBSsiNp3w0L1FfKVKenZT7w=
 github.com/aws/aws-sdk-go-v2/service/sts v1.41.10 h1:p8ogvvLugcR/zLBXTXrTkj0RYBUdErbMnAFFp12Lm/U=
 github.com/aws/aws-sdk-go-v2/service/sts v1.41.10/go.mod h1:60dv0eZJfeVXfbT1tFJinbHrDfSJ2GZl4Q//OSSNAVw=
 github.com/aws/smithy-go v1.24.2 h1:FzA3bu/nt/vDvmnkg+R8Xl46gmzEDam6mZ1hzmwXFng=
@@ -385,12 +385,12 @@ github.com/google/s2a-go v0.1.9 h1:LGD7gtMgezd8a/Xak7mEWL0PjoTQFvpRudN895yqKW0=
 github.com/google/s2a-go v0.1.9/go.mod h1:YA0Ei2ZQL3acow2O62kdp9UlnvMmU7kA6Eutn0dXayM=
 github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
 github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
-github.com/googleapis/enterprise-certificate-proxy v0.3.14 h1:yh8ncqsbUY4shRD5dA6RlzjJaT4hi3kII+zYw8wmLb8=
-github.com/googleapis/enterprise-certificate-proxy v0.3.14/go.mod h1:vqVt9yG9480NtzREnTlmGSBmFrA+bzb0yl0TxoBQXOg=
+github.com/googleapis/enterprise-certificate-proxy v0.3.11 h1:vAe81Msw+8tKUxi2Dqh/NZMz7475yUvmRIkXr4oN2ao=
+github.com/googleapis/enterprise-certificate-proxy v0.3.11/go.mod h1:RFV7MUdlb7AgEq2v7FmMCfeSMCllAzWxFgRdusoGks8=
 github.com/googleapis/gax-go/v2 v2.0.4/go.mod h1:0Wqv26UfaUD9n4G6kQubkQ+KchISgw+vpHVxEJEs9eg=
 github.com/googleapis/gax-go/v2 v2.0.5/go.mod h1:DWXyrwAJ9X0FpwwEdw+IPEYBICEFu5mhpdKc/us6bOk=
-github.com/googleapis/gax-go/v2 v2.19.0 h1:fYQaUOiGwll0cGj7jmHT/0nPlcrZDFPrZRhTsoCr8hE=
-github.com/googleapis/gax-go/v2 v2.19.0/go.mod h1:w2ROXVdfGEVFXzmlciUU4EdjHgWvB5h2n6x/8XSTTJA=
+github.com/googleapis/gax-go/v2 v2.17.0 h1:RksgfBpxqff0EZkDWYuz9q/uWsTVz+kf43LsZ1J6SMc=
+github.com/googleapis/gax-go/v2 v2.17.0/go.mod h1:mzaqghpQp4JDh3HvADwrat+6M3MOIDp5YKHhb9PAgDY=
 github.com/gopherjs/gopherjs v1.17.2 h1:fQnZVsXk8uxXIStYb0N4bGk7jeyTalG/wsZjQ25dO0g=
 github.com/gopherjs/gopherjs v1.17.2/go.mod h1:pRRIvn/QzFLrKfvEz3qUuEhtE/zLCWfreZ6J5gM2i+k=
 github.com/gorilla/mux v1.8.1 h1:TuBL49tXwgrFYWhqrNgrUNEY92u81SPhu7sTdzQEiWY=
@@ -600,6 +600,8 @@ github.com/rdleal/intervalst v1.5.0 h1:SEB9bCFz5IqD1yhfH1Wv8IBnY/JQxDplwkxHjT6ha
 github.com/rdleal/intervalst v1.5.0/go.mod h1:xO89Z6BC+LQDH+IPQQw/OESt5UADgFD41tYMUINGpxQ=
 github.com/relvacode/iso8601 v1.7.0 h1:BXy+V60stMP6cpswc+a93Mq3e65PfXCgDFfhvNNGrdo=
 github.com/relvacode/iso8601 v1.7.0/go.mod h1:FlNp+jz+TXpyRqgmM7tnzHHzBnz776kmAH2h3sZCn0I=
+github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec h1:W09IVJc94icq4NjY3clb7Lk8O1qJ8BdBEF8z0ibU0rE=
+github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec/go.mod h1:qqbHyh8v60DhA7CoWK5oRCqLrMHRGoxYCSS9EjAz6Eo=
 github.com/rfjakob/eme v1.1.2 h1:SxziR8msSOElPayZNFfQw4Tjx/Sbaeeh3eRvrHVMUs4=
 github.com/rfjakob/eme v1.1.2/go.mod h1:cVvpasglm/G3ngEfcfT/Wt0GwhkuO32pf/poW6Nyk1k=
 github.com/rogpeppe/go-internal v1.3.0/go.mod h1:M8bDsm7K2OlrFYOpmOWEs/qY81heoFRclV5y23lUDJ4=
@@ -752,16 +754,16 @@ go.opentelemetry.io/auto/sdk v1.2.1 h1:jXsnJ4Lmnqd11kwkBV2LgLoFMZKizbCi5fNZ/ipaZ
 go.opentelemetry.io/auto/sdk v1.2.1/go.mod h1:KRTj+aOaElaLi+wW1kO/DZRXwkF4C5xPbEe3ZiIhN7Y=
 go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.63.0 h1:RbKq8BG0FI8OiXhBfcRtqqHcZcka+gU3cskNuf05R18=
 go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.63.0/go.mod h1:h06DGIukJOevXaj/xrNjhi/2098RZzcLTbc0jDAUbsg=
-go.opentelemetry.io/otel v1.42.0 h1:lSQGzTgVR3+sgJDAU/7/ZMjN9Z+vUip7leaqBKy4sho=
-go.opentelemetry.io/otel v1.42.0/go.mod h1:lJNsdRMxCUIWuMlVJWzecSMuNjE7dOYyWlqOXWkdqCc=
-go.opentelemetry.io/otel/metric v1.42.0 h1:2jXG+3oZLNXEPfNmnpxKDeZsFI5o4J+nz6xUlaFdF/4=
-go.opentelemetry.io/otel/metric v1.42.0/go.mod h1:RlUN/7vTU7Ao/diDkEpQpnz3/92J9ko05BIwxYa2SSI=
-go.opentelemetry.io/otel/sdk v1.42.0 h1:LyC8+jqk6UJwdrI/8VydAq/hvkFKNHZVIWuslJXYsDo=
-go.opentelemetry.io/otel/sdk v1.42.0/go.mod h1:rGHCAxd9DAph0joO4W6OPwxjNTYWghRWmkHuGbayMts=
-go.opentelemetry.io/otel/sdk/metric v1.42.0 h1:D/1QR46Clz6ajyZ3G8SgNlTJKBdGp84q9RKCAZ3YGuA=
-go.opentelemetry.io/otel/sdk/metric v1.42.0/go.mod h1:Ua6AAlDKdZ7tdvaQKfSmnFTdHx37+J4ba8MwVCYM5hc=
-go.opentelemetry.io/otel/trace v1.42.0 h1:OUCgIPt+mzOnaUTpOQcBiM/PLQ/Op7oq6g4LenLmOYY=
-go.opentelemetry.io/otel/trace v1.42.0/go.mod h1:f3K9S+IFqnumBkKhRJMeaZeNk9epyhnCmQh/EysQCdc=
+go.opentelemetry.io/otel v1.40.0 h1:oA5YeOcpRTXq6NN7frwmwFR0Cn3RhTVZvXsP4duvCms=
+go.opentelemetry.io/otel v1.40.0/go.mod h1:IMb+uXZUKkMXdPddhwAHm6UfOwJyh4ct1ybIlV14J0g=
+go.opentelemetry.io/otel/metric v1.40.0 h1:rcZe317KPftE2rstWIBitCdVp89A2HqjkxR3c11+p9g=
+go.opentelemetry.io/otel/metric v1.40.0/go.mod h1:ib/crwQH7N3r5kfiBZQbwrTge743UDc7DTFVZrrXnqc=
+go.opentelemetry.io/otel/sdk v1.40.0 h1:KHW/jUzgo6wsPh9At46+h4upjtccTmuZCFAc9OJ71f8=
+go.opentelemetry.io/otel/sdk v1.40.0/go.mod h1:Ph7EFdYvxq72Y8Li9q8KebuYUr2KoeyHx0DRMKrYBUE=
+go.opentelemetry.io/otel/sdk/metric v1.40.0 h1:mtmdVqgQkeRxHgRv4qhyJduP3fYJRMX4AtAlbuWdCYw=
+go.opentelemetry.io/otel/sdk/metric v1.40.0/go.mod h1:4Z2bGMf0KSK3uRjlczMOeMhKU2rhUqdWNoKcYrtcBPg=
+go.opentelemetry.io/otel/trace v1.40.0 h1:WA4etStDttCSYuhwvEa8OP8I5EWu24lkOzp+ZYblVjw=
+go.opentelemetry.io/otel/trace v1.40.0/go.mod h1:zeAhriXecNGP/s2SEG3+Y8X9ujcJOTqQ5RgdEJcawiA=
 go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto=
 go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE=
 go.yaml.in/yaml/v2 v2.4.3 h1:6gvOSjQoTB3vt1l+CU+tSyi/HOjfOjRLJ4YwYZGwRO0=
@@ -867,8 +869,8 @@ golang.org/x/net v0.15.0/go.mod h1:idbUs1IY1+zTqbi8yxTbhexhEEk5ur9LInksu6HrEpk=
 golang.org/x/net v0.21.0/go.mod h1:bIjVDfnllIU7BJ2DNgfnXvpSvtn8VRwhlsaeUTyUS44=
 golang.org/x/net v0.25.0/go.mod h1:JkAGAh7GEvH74S6FOH42FLoXpXbE/aqXSrIQjXgsiwM=
 golang.org/x/net v0.33.0/go.mod h1:HXLR5J+9DxmrqMwG9qjGCxZ+zKXxBru04zlTvWlWuN4=
-golang.org/x/net v0.52.0 h1:He/TN1l0e4mmR3QqHMT2Xab3Aj3L9qjbhRm78/6jrW0=
-golang.org/x/net v0.52.0/go.mod h1:R1MAz7uMZxVMualyPXb+VaqGSa3LIaUqk0eEt3w36Sw=
+golang.org/x/net v0.51.0 h1:94R/GTO7mt3/4wIKpcR5gkGmRLOuE/2hNGeWq/GBIFo=
+golang.org/x/net v0.51.0/go.mod h1:aamm+2QF5ogm02fjy5Bb7CQ0WMt1/WVM7FtyaTLlA9Y=
 golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
 golang.org/x/oauth2 v0.0.0-20190226205417-e64efc72b421/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
 golang.org/x/oauth2 v0.0.0-20190604053449-0f29369cfe45/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
@@ -979,8 +981,8 @@ golang.org/x/text v0.35.0/go.mod h1:khi/HExzZJ2pGnjenulevKNX1W67CUy0AsXcNubPGCA=
 golang.org/x/time v0.0.0-20181108054448-85acf8d2951c/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20190308202827-9d24e82272b4/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20191024005414-555d28b269f0/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
-golang.org/x/time v0.15.0 h1:bbrp8t3bGUeFOx08pvsMYRTCVSMk89u4tKbNOZbp88U=
-golang.org/x/time v0.15.0/go.mod h1:Y4YMaQmXwGQZoFaVFk4YpCt4FLQMYKZe9oeV/f4MSno=
+golang.org/x/time v0.14.0 h1:MRx4UaLrDotUKUdCIqzPC48t1Y9hANFKIRpNx+Te8PI=
+golang.org/x/time v0.14.0/go.mod h1:eL/Oa2bBBK0TkX57Fyni+NgnyQQN4LitPmob2Hjnqw4=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20190114222345-bf090417da8b/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20190226205152-f727befe758c/go.mod h1:9Yl7xja0Znq3iFh3HoIrodX9oNMXvdceNzlUR8zjMvY=
@@ -1052,8 +1054,8 @@ google.golang.org/api v0.24.0/go.mod h1:lIXQywCXRcnZPGlsd8NbLnOjtAoL6em04bJ9+z0M
 google.golang.org/api v0.28.0/go.mod h1:lIXQywCXRcnZPGlsd8NbLnOjtAoL6em04bJ9+z0MncE=
 google.golang.org/api v0.29.0/go.mod h1:Lcubydp8VUV7KeIHD9z2Bys/sm/vGKnG1UHuDBSrHWM=
 google.golang.org/api v0.30.0/go.mod h1:QGmEvQ87FHZNiUVJkT14jQNYJ4ZJjdRF23ZXz5138Fc=
-google.golang.org/api v0.274.0 h1:aYhycS5QQCwxHLwfEHRRLf9yNsfvp1JadKKWBE54RFA=
-google.golang.org/api v0.274.0/go.mod h1:JbAt7mF+XVmWu6xNP8/+CTiGH30ofmCmk9nM8d8fHew=
+google.golang.org/api v0.267.0 h1:w+vfWPMPYeRs8qH1aYYsFX68jMls5acWl/jocfLomwE=
+google.golang.org/api v0.267.0/go.mod h1:Jzc0+ZfLnyvXma3UtaTl023TdhZu6OMBP9tJ+0EmFD0=
 google.golang.org/appengine v1.1.0/go.mod h1:EbEs0AVv82hx2wNQdGPgUI5lhzA/G0D9YwlJXL52JkM=
 google.golang.org/appengine v1.4.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
 google.golang.org/appengine v1.5.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
@@ -1089,12 +1091,12 @@ google.golang.org/genproto v0.0.0-20200618031413-b414f8b61790/go.mod h1:jDfRM7Fc
 google.golang.org/genproto v0.0.0-20200729003335-053ba62fc06f/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
 google.golang.org/genproto v0.0.0-20200804131852-c06518451d9c/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
 google.golang.org/genproto v0.0.0-20200825200019-8632dd797987/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
-google.golang.org/genproto v0.0.0-20260316180232-0b37fe3546d5 h1:JNfk58HZ8lfmXbYK2vx/UvsqIL59TzByCxPIX4TDmsE=
-google.golang.org/genproto v0.0.0-20260316180232-0b37fe3546d5/go.mod h1:x5julN69+ED4PcFk/XWayw35O0lf/nGa4aNgODCmNmw=
-google.golang.org/genproto/googleapis/api v0.0.0-20260316180232-0b37fe3546d5 h1:CogIeEXn4qWYzzQU0QqvYBM8yDF9cFYzDq9ojSpv0Js=
-google.golang.org/genproto/googleapis/api v0.0.0-20260316180232-0b37fe3546d5/go.mod h1:EIQZ5bFCfRQDV4MhRle7+OgjNtZ6P1PiZBgAKuxXu/Y=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20260319201613-d00831a3d3e7 h1:ndE4FoJqsIceKP2oYSnUZqhTdYufCYYkqwtFzfrhI7w=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20260319201613-d00831a3d3e7/go.mod h1:4Hqkh8ycfw05ld/3BWL7rJOSfebL2Q+DVDeRgYgxUU8=
+google.golang.org/genproto v0.0.0-20260128011058-8636f8732409 h1:VQZ/yAbAtjkHgH80teYd2em3xtIkkHd7ZhqfH2N9CsM=
+google.golang.org/genproto v0.0.0-20260128011058-8636f8732409/go.mod h1:rxKD3IEILWEu3P44seeNOAwZN4SaoKaQ/2eTg4mM6EM=
+google.golang.org/genproto/googleapis/api v0.0.0-20260203192932-546029d2fa20 h1:7ei4lp52gK1uSejlA8AZl5AJjeLUOHBQscRQZUgAcu0=
+google.golang.org/genproto/googleapis/api v0.0.0-20260203192932-546029d2fa20/go.mod h1:ZdbssH/1SOVnjnDlXzxDHK2MCidiqXtbYccJNzNYPEE=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20260203192932-546029d2fa20 h1:Jr5R2J6F6qWyzINc+4AM8t5pfUz6beZpHp678GNrMbE=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20260203192932-546029d2fa20/go.mod h1:j9x/tPzZkyxcgEFkiKEEGxfvyumM01BEtsW8xzOahRQ=
 google.golang.org/grpc v1.19.0/go.mod h1:mqu4LbDTu4XGKhr4mRzUsmM4RtVoemTSY81AxZiDr8c=
 google.golang.org/grpc v1.20.1/go.mod h1:10oTOabMzJvdu6/UiuZezV6QK5dSlG84ov/aaiqXj38=
 google.golang.org/grpc v1.21.1/go.mod h1:oYelfM1adQP15Ek0mdvEgi9Df8B9CZIaU1084ijfRaM=
@@ -1152,6 +1154,8 @@ honnef.co/go/tools v0.0.0-20190523083050-ea95bdfd59fc/go.mod h1:rf3lG4BRIbNafJWh
 honnef.co/go/tools v0.0.1-2019.2.3/go.mod h1:a3bituU0lyd329TUQxRnasdCoJDkEUEAqEt0JzvZhAg=
 honnef.co/go/tools v0.0.1-2020.1.3/go.mod h1:X/FiERA/W4tHapMX5mGpAtMSVEeEUOyHaw9vFzvIQ3k=
 honnef.co/go/tools v0.0.1-2020.1.4/go.mod h1:X/FiERA/W4tHapMX5mGpAtMSVEeEUOyHaw9vFzvIQ3k=
+modernc.org/mathutil v1.7.1 h1:GCZVGXdaN8gTqB1Mf/usp1Y/hSqgI2vAGGP4jZMCxOU=
+modernc.org/mathutil v1.7.1/go.mod h1:4p5IwJITfppl0G4sUEDtCr4DthTaT47/N3aT6MhfgJg=
 moul.io/http2curl/v2 v2.3.0 h1:9r3JfDzWPcbIklMOs2TnIFzDYvfAZvjeavG6EzP7jYs=
 moul.io/http2curl/v2 v2.3.0/go.mod h1:RW4hyBjTWSYDOxapodpNEtX0g5Eb16sxklBqmd2RHcE=
 rsc.io/binaryregexp v0.2.0/go.mod h1:qTv7/COck+e2FymRvadv62gMdZztPaShugOCi3I+8D8=
@@ -11,7 +11,7 @@
    <properties>
        <maven.compiler.source>11</maven.compiler.source>
        <maven.compiler.target>11</maven.compiler.target>
-        <kafka.version>3.9.2</kafka.version>
+        <kafka.version>3.9.1</kafka.version>
    </properties>

    <dependencies>
@@ -11,7 +11,7 @@
    <properties>
        <maven.compiler.source>11</maven.compiler.source>
        <maven.compiler.target>11</maven.compiler.target>
-        <kafka.version>3.9.2</kafka.version>
+        <kafka.version>3.9.1</kafka.version>
        <confluent.version>7.6.0</confluent.version>
    </properties>

@@ -6,6 +6,7 @@ import (
 	"encoding/json"
 	"fmt"
 	"io"
+	"net"
 	"net/http"
 	"os"
 	"os/exec"
@@ -16,8 +17,6 @@ import (
 	"sync"
 	"testing"
 	"time"
-
-	"github.com/seaweedfs/seaweedfs/test/testutil"
 )

 const (
@@ -52,8 +51,8 @@ type MasterCluster struct {

 // clusterStatus is the JSON returned by /cluster/status.
 type clusterStatus struct {
-	IsLeader bool     `json:"IsLeader"`
-	Leader   string   `json:"Leader"`
+	IsLeader bool   `json:"IsLeader"`
+	Leader   string `json:"Leader"`
 	Peers    []string `json:"Peers"`
 }

@@ -74,23 +73,23 @@ func StartMasterCluster(t testing.TB) *MasterCluster {
 	logsDir := filepath.Join(baseDir, "logs")
 	os.MkdirAll(logsDir, 0o755)

-	// Allocate 3 mini-safe ports (each guarantees port+10000 is also free).
-	httpPorts, err := testutil.AllocateMiniPorts(3)
+	// Allocate 3 port pairs (http, grpc) atomically to prevent reuse.
+	portPairs, err := allocateMultipleMasterPortPairs(3)
 	if err != nil {
 		t.Fatalf("allocate ports: %v", err)
 	}
 	var nodes [3]*masterNode
 	var peerParts []string
-	for i, hp := range httpPorts {
+	for i, pp := range portPairs {
 		dataDir := filepath.Join(baseDir, fmt.Sprintf("m%d", i))
 		os.MkdirAll(dataDir, 0o755)
 		nodes[i] = &masterNode{
-			port:     hp,
-			grpcPort: hp + testutil.GrpcPortOffset,
+			port:     pp[0],
+			grpcPort: pp[1],
 			dataDir:  dataDir,
 			logFile:  filepath.Join(logsDir, fmt.Sprintf("master%d.log", i)),
 		}
-		peerParts = append(peerParts, fmt.Sprintf("127.0.0.1:%d", hp))
+		peerParts = append(peerParts, fmt.Sprintf("127.0.0.1:%d", pp[0]))
 	}

 	mc := &MasterCluster{
@@ -358,6 +357,42 @@ func (mc *MasterCluster) tailLog(i int) string {
 	return strings.Join(lines, "\n")
 }

+// --- port and binary helpers (adapted from test/volume_server/framework) ---
+
+// allocateMultipleMasterPortPairs finds n non-overlapping (http, grpc) port
+// pairs, holding all listeners until all are found, then releasing them
+// together to avoid races between consecutive allocations.
+func allocateMultipleMasterPortPairs(n int) ([][2]int, error) {
+	var listeners []net.Listener
+	var pairs [][2]int
+
+	defer func() {
+		for _, l := range listeners {
+			l.Close()
+		}
+	}()
+
+	for masterPort := 10000; masterPort <= 55535 && len(pairs) < n; masterPort++ {
+		grpcPort := masterPort + 10000
+		l1, err := net.Listen("tcp", net.JoinHostPort("127.0.0.1", strconv.Itoa(masterPort)))
+		if err != nil {
+			continue
+		}
+		l2, err := net.Listen("tcp", net.JoinHostPort("127.0.0.1", strconv.Itoa(grpcPort)))
+		if err != nil {
+			l1.Close()
+			continue
+		}
+		listeners = append(listeners, l1, l2)
+		pairs = append(pairs, [2]int{masterPort, grpcPort})
+	}
+
+	if len(pairs) < n {
+		return nil, fmt.Errorf("could only allocate %d of %d master port pairs", len(pairs), n)
+	}
+	return pairs, nil
+}
+
 func findOrBuildWeedBinary() (string, error) {
 	if fromEnv := os.Getenv("WEED_BINARY"); fromEnv != "" {
 		if isExecutableFile(fromEnv) {
@@ -1,36 +0,0 @@
-.PHONY: all build test test-verbose test-short test-debug clean deps tidy
-
-all: build test
-
-# Build the weed binary first
-build:
-	cd ../../weed && go build -o weed .
-
-# Install test dependencies
-deps:
-	go mod download
-
-# Run all tests
-test: build deps
-	go test -timeout 5m ./...
-
-# Run tests with verbose output
-test-verbose: build deps
-	go test -v -timeout 5m ./...
-
-# Skip long-running integration tests
-test-short: deps
-	go test -short -v ./...
-
-# Run tests with debug output from SeaweedFS
-test-debug: build deps
-	go test -v -timeout 5m ./... 2>&1 | tee test.log
-
-# Clean up test artifacts
-clean:
-	rm -f test.log
-	go clean -testcache
-
-# Update go.sum
-tidy:
-	go mod tidy
@@ -1,92 +0,0 @@
-# SeaweedFS NFS Integration Tests
-
-End-to-end tests that boot a real SeaweedFS cluster (`master` + `volume` +
-`filer`) plus the experimental `weed nfs` frontend and drive it through the
-NFSv3 wire protocol. The tests talk to the server over TCP using
-`github.com/willscott/go-nfs-client`, which means they do **not** need a
-kernel NFS mount, privileged ports, or any platform-specific tooling.
-
-## Prerequisites
-
-1. Build the `weed` binary:
-   ```bash
-   cd ../../weed
-   go build -o weed .
-   ```
-2. Go 1.24 or later.
-
-## Running the tests
-
-```bash
-# Build weed and run everything
-make test
-
-# Verbose output, keeps the subprocess stdout
-make test-verbose
-
-# Skip integration tests — useful when iterating on the framework itself
-make test-short
-
-# Run a single test
-go test -v -run TestNfsBasicReadWrite ./...
-```
-
-Every test starts its own cluster on random loopback ports, so runs are
-isolated and can execute in parallel.
-
-## Layout
-
- `framework.go` — launches `weed master`, `weed volume`, `weed filer`, and
-  `weed nfs` as subprocesses, waits for each to accept TCP, and exposes a
-  `Mount()` helper that returns an `nfsclient.Target`.
- `basic_test.go` — covers the most common NFS operations:
-  - Read/write round-trip (`TestNfsBasicReadWrite`)
-  - Mkdir / ReadDirPlus / RmDir (`TestNfsMkdirAndRmdir`)
-  - Nested directory + leaf file (`TestNfsNestedDirectories`)
-  - Rename preserves content (`TestNfsRenamePreservesContent`)
-  - Overwrite shrinks file size (`TestNfsOverwriteShrinksFile`)
-  - Large binary file round-trip (`TestNfsLargeFile`)
-  - Arbitrary binary and empty files (`TestNfsBinaryAndEmptyFiles`)
-  - Symlink + Readlink (`TestNfsSymlinkRoundTrip`)
-  - ReadDirPlus ordering sanity (`TestNfsReadDirPlusOrdering`)
-  - Remove on missing path errors cleanly (`TestNfsRemoveMissingFailsCleanly`)
-  - FSINFO advertises non-zero limits (`TestNfsFSInfoReturnsSaneLimits`)
-  - Sequential append writes concatenate (`TestNfsAppendIsSequential`)
-  - ReadDir after remove (`TestNfsReadDirAfterRemove`)
-
-## Debugging a failing test
-
-Keep the cluster temp dir for inspection:
-
-```go
-config := DefaultTestConfig()
-config.SkipCleanup = true
-```
-
-Enable subprocess stdout/stderr:
-
-```go
-config := DefaultTestConfig()
-config.EnableDebug = true
-```
-
-Or run with `-v`, which flips `EnableDebug` automatically via `testing.Verbose()`.
-
-## Notes
-
- The NFS server binds to `127.0.0.1` with `-ip.bind=127.0.0.1` and exports
-  `/nfs_export`. The test framework pre-creates that directory via the
-  filer's HTTP API before starting the NFS server — the NFS server requires
-  its export root to exist in the filer's namespace with a real entry, and
-  the filer's synthetic `/` root does not match the `Name=="/"` check the
-  NFS server performs during `ensureIndexedEntry`.
- Ports are allocated dynamically. Each test run opens a short-lived
-  listener on `127.0.0.1:0`, reads back the assigned port, closes the
-  listener, and hands the port to `weed master/volume/filer/nfs`. There is
-  a tiny race window between close and reopen that has not been a problem
-  in practice but is worth remembering if you see a "bind: address already
-  in use" failure.
- All four `weed` components are started with explicit `-port.grpc=...`
-  flags. Without them, the default is `-port + 10000`, which overflows
-  `65535` whenever the HTTP port lands above `55535` — the kernel's
-  ephemeral port range on macOS routinely does.
@@ -1,400 +0,0 @@
-package nfs
-
-import (
-	"bytes"
-	"fmt"
-	"io"
-	"os"
-	"path"
-	"strings"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-	nfsclient "github.com/willscott/go-nfs-client/nfs"
-)
-
-// setupFramework is a small helper that boots the cluster for a single test
-// and tears everything down on completion. Every test gets a fresh filer +
-// volume pair so they cannot step on each other's namespace.
-func setupFramework(t *testing.T) *NfsTestFramework {
-	t.Helper()
-	if testing.Short() {
-		t.Skip("skipping integration test in short mode")
-	}
-	config := DefaultTestConfig()
-	config.EnableDebug = testing.Verbose()
-	fw := NewNfsTestFramework(t, config)
-	require.NoError(t, fw.Setup(config), "framework setup")
-	t.Cleanup(fw.Cleanup)
-	return fw
-}
-
-// writeAll writes payload to path on the target in a single Write call. The
-// NFS WRITE3 RPC chunks internally, so this exists purely so tests read
-// linearly.
-func writeAll(t *testing.T, target *nfsclient.Target, remotePath string, payload []byte) {
-	t.Helper()
-	file, err := target.OpenFile(remotePath, 0o644)
-	require.NoError(t, err, "open %s for write", remotePath)
-	if len(payload) > 0 {
-		n, err := file.Write(payload)
-		require.NoError(t, err, "write %s", remotePath)
-		require.Equal(t, len(payload), n, "short write on %s", remotePath)
-	}
-	require.NoError(t, file.Close(), "close %s", remotePath)
-}
-
-// readAll opens path on the target and returns the full file contents.
-func readAll(t *testing.T, target *nfsclient.Target, remotePath string) []byte {
-	t.Helper()
-	file, err := target.Open(remotePath)
-	require.NoError(t, err, "open %s for read", remotePath)
-	defer file.Close()
-	content, err := io.ReadAll(file)
-	require.NoError(t, err, "read %s", remotePath)
-	return content
-}
-
-// TestNfsBasicReadWrite exercises the most common NFS path: OpenFile + Write
-// + Close followed by Open + Read to verify round-trip data integrity.
-func TestNfsBasicReadWrite(t *testing.T) {
-	fw := setupFramework(t)
-	target, cleanup, err := fw.Mount()
-	require.NoError(t, err)
-	defer cleanup()
-
-	payload := []byte("hello from seaweedfs nfs integration test")
-	writeAll(t, target, "/hello.txt", payload)
-
-	got := readAll(t, target, "/hello.txt")
-	assert.Equal(t, payload, got, "round-tripped content must match")
-
-	info, err := target.Getattr("/hello.txt")
-	require.NoError(t, err)
-	assert.Equal(t, int64(len(payload)), int64(info.Filesize))
-}
-
-// TestNfsMkdirAndRmdir covers Mkdir, ReadDirPlus, and RmDir. The readdir
-// assertion also verifies that the newly-created directory shows up under
-// the export root the way a POSIX client would expect.
-func TestNfsMkdirAndRmdir(t *testing.T) {
-	fw := setupFramework(t)
-	target, cleanup, err := fw.Mount()
-	require.NoError(t, err)
-	defer cleanup()
-
-	_, err = target.Mkdir("/dir1", 0o755)
-	require.NoError(t, err)
-
-	entries, err := target.ReadDirPlus("/")
-	require.NoError(t, err)
-	found := false
-	for _, entry := range entries {
-		if entry.Name() == "dir1" {
-			found = true
-			assert.True(t, entry.IsDir(), "dir1 should be a directory")
-		}
-	}
-	assert.True(t, found, "expected dir1 in readdir listing")
-
-	require.NoError(t, target.RmDir("/dir1"))
-
-	// After removal, dir1 must be gone from the listing.
-	entries, err = target.ReadDirPlus("/")
-	require.NoError(t, err)
-	for _, entry := range entries {
-		assert.NotEqual(t, "dir1", entry.Name(), "dir1 should be removed")
-	}
-}
-
-// TestNfsNestedDirectories ensures the server can materialise a deep tree in
-// a single Mkdir-per-segment sequence and that reads/writes work at the
-// leaves.
-func TestNfsNestedDirectories(t *testing.T) {
-	fw := setupFramework(t)
-	target, cleanup, err := fw.Mount()
-	require.NoError(t, err)
-	defer cleanup()
-
-	for _, segment := range []string{"/a", "/a/b", "/a/b/c"} {
-		_, err := target.Mkdir(segment, 0o755)
-		require.NoError(t, err, "mkdir %s", segment)
-	}
-
-	payload := []byte("deep path content")
-	writeAll(t, target, "/a/b/c/leaf.txt", payload)
-
-	got := readAll(t, target, "/a/b/c/leaf.txt")
-	assert.Equal(t, payload, got)
-
-	require.NoError(t, target.Remove("/a/b/c/leaf.txt"))
-	require.NoError(t, target.RmDir("/a/b/c"))
-	require.NoError(t, target.RmDir("/a/b"))
-	require.NoError(t, target.RmDir("/a"))
-}
-
-// TestNfsRenamePreservesContent renames a file and makes sure the content
-// at the new path matches what was written at the old one, and that the
-// old path disappears. It does not assert on inode identity because pjdfstest
-// already covers that and this test intentionally avoids depending on the
-// mount-side identity plumbing.
-func TestNfsRenamePreservesContent(t *testing.T) {
-	fw := setupFramework(t)
-	target, cleanup, err := fw.Mount()
-	require.NoError(t, err)
-	defer cleanup()
-
-	payload := []byte("rename me")
-	writeAll(t, target, "/src.txt", payload)
-
-	require.NoError(t, target.Rename("/src.txt", "/dst.txt"))
-
-	_, _, err = target.Lookup("/src.txt")
-	assert.Error(t, err, "source should be gone after rename")
-
-	got := readAll(t, target, "/dst.txt")
-	assert.Equal(t, payload, got)
-
-	require.NoError(t, target.Remove("/dst.txt"))
-}
-
-// TestNfsOverwriteShrinksFile rewrites an existing file with shorter content
-// and asserts Getattr reports the new (smaller) size. go-nfs-client's
-// OpenFile does not pass O_TRUNC, so the test truncates explicitly via
-// Setattr(size=0) before the second write — mirroring what `echo >file`
-// does on a POSIX client.
-func TestNfsOverwriteShrinksFile(t *testing.T) {
-	fw := setupFramework(t)
-	target, cleanup, err := fw.Mount()
-	require.NoError(t, err)
-	defer cleanup()
-
-	writeAll(t, target, "/overwrite.txt", []byte("the quick brown fox"))
-
-	require.NoError(t, target.Setattr("/overwrite.txt", nfsclient.Sattr3{
-		Size: nfsclient.SetSize{SetIt: true, Size: 0},
-	}))
-
-	writeAll(t, target, "/overwrite.txt", []byte("short"))
-
-	info, err := target.Getattr("/overwrite.txt")
-	require.NoError(t, err)
-	assert.Equal(t, int64(len("short")), int64(info.Filesize))
-
-	got := readAll(t, target, "/overwrite.txt")
-	assert.Equal(t, []byte("short"), got)
-
-	require.NoError(t, target.Remove("/overwrite.txt"))
-}
-
-// TestNfsLargeFile writes a multi-megabyte payload so the write path has to
-// cut chunks and flush through the volume server rather than inlining
-// content in the filer entry.
-func TestNfsLargeFile(t *testing.T) {
-	fw := setupFramework(t)
-	target, cleanup, err := fw.Mount()
-	require.NoError(t, err)
-	defer cleanup()
-
-	const size = 3 * 1024 * 1024 // 3 MiB — exceeds the 4 MiB inline cutoff boundary when combined with metadata
-	payload := make([]byte, size)
-	for i := range payload {
-		payload[i] = byte(i % 251) // non-repeating to catch offset bugs
-	}
-
-	writeAll(t, target, "/big.bin", payload)
-
-	info, err := target.Getattr("/big.bin")
-	require.NoError(t, err)
-	assert.Equal(t, int64(size), int64(info.Filesize))
-
-	got := readAll(t, target, "/big.bin")
-	require.Equal(t, size, len(got))
-	assert.True(t, bytes.Equal(payload, got), "large file content must round-trip byte-for-byte")
-
-	require.NoError(t, target.Remove("/big.bin"))
-}
-
-// TestNfsBinaryAndEmptyFiles covers two edge-case payloads the write path
-// tends to regress on: arbitrary binary bytes and zero-length files.
-func TestNfsBinaryAndEmptyFiles(t *testing.T) {
-	fw := setupFramework(t)
-	target, cleanup, err := fw.Mount()
-	require.NoError(t, err)
-	defer cleanup()
-
-	t.Run("AllByteValues", func(t *testing.T) {
-		payload := make([]byte, 256)
-		for i := range payload {
-			payload[i] = byte(i)
-		}
-		writeAll(t, target, "/binary.bin", payload)
-		assert.Equal(t, payload, readAll(t, target, "/binary.bin"))
-		require.NoError(t, target.Remove("/binary.bin"))
-	})
-
-	t.Run("EmptyFile", func(t *testing.T) {
-		writeAll(t, target, "/empty.txt", nil)
-		info, err := target.Getattr("/empty.txt")
-		require.NoError(t, err)
-		assert.Equal(t, int64(0), int64(info.Filesize))
-		require.NoError(t, target.Remove("/empty.txt"))
-	})
-}
-
-// TestNfsSymlinkRoundTrip covers Symlink and Readlink through the nfs server.
-// Readlink returns the target path; the server does not auto-traverse it.
-func TestNfsSymlinkRoundTrip(t *testing.T) {
-	fw := setupFramework(t)
-	target, cleanup, err := fw.Mount()
-	require.NoError(t, err)
-	defer cleanup()
-
-	// Symlink uses a different RPC than open+create, and our server routes it
-	// through the billy Change interface.
-	require.NoError(t, target.Symlink("/target.txt", "/link.txt"))
-
-	// The underlying target does not need to exist for readlink to succeed.
-	file, _, err := target.Lookup("/link.txt")
-	require.NoError(t, err, "lookup symlink")
-	assert.True(t, file.Mode()&os.ModeSymlink != 0, "expected symlink mode, got %s", file.Mode())
-
-	require.NoError(t, target.Remove("/link.txt"))
-}
-
-// TestNfsReadDirPlusOrdering creates a handful of files with distinct names
-// and ensures ReadDirPlus surfaces every one of them. The server pages
-// listings from the filer, so we want to make sure nothing is truncated.
-func TestNfsReadDirPlusOrdering(t *testing.T) {
-	fw := setupFramework(t)
-	target, cleanup, err := fw.Mount()
-	require.NoError(t, err)
-	defer cleanup()
-
-	_, err = target.Mkdir("/listing", 0o755)
-	require.NoError(t, err)
-
-	names := []string{"alpha.txt", "beta.txt", "gamma.txt", "delta.txt", "epsilon.txt"}
-	for _, name := range names {
-		writeAll(t, target, path.Join("/listing", name), []byte(name))
-	}
-
-	entries, err := target.ReadDirPlus("/listing")
-	require.NoError(t, err)
-	seen := make(map[string]struct{}, len(entries))
-	for _, entry := range entries {
-		if entry.Name() == "." || entry.Name() == ".." {
-			continue
-		}
-		seen[entry.Name()] = struct{}{}
-	}
-	for _, name := range names {
-		_, ok := seen[name]
-		assert.True(t, ok, "expected %s in directory listing", name)
-	}
-
-	for _, name := range names {
-		require.NoError(t, target.Remove(path.Join("/listing", name)))
-	}
-	require.NoError(t, target.RmDir("/listing"))
-}
-
-// TestNfsRemoveMissingFailsCleanly asserts that removing a non-existent path
-// surfaces an error instead of silently succeeding. A bug where the server
-// returned NFS3_OK on missing entries would hide metadata drift.
-func TestNfsRemoveMissingFailsCleanly(t *testing.T) {
-	fw := setupFramework(t)
-	target, cleanup, err := fw.Mount()
-	require.NoError(t, err)
-	defer cleanup()
-
-	err = target.Remove("/does_not_exist.txt")
-	require.Error(t, err, "removing a missing file must error")
-	// NFS3 surfaces this as NFS3ERR_NOENT; make sure the error text is
-	// recognisable without locking us into the library's exact wording.
-	assert.True(t,
-		strings.Contains(strings.ToLower(err.Error()), "noent") ||
-			strings.Contains(strings.ToLower(err.Error()), "not exist") ||
-			strings.Contains(strings.ToLower(err.Error()), "no such"),
-		"unexpected error shape: %v", err)
-}
-
-// TestNfsFSInfoReturnsSaneLimits pokes at FSINFO so we catch regressions
-// where the server advertises zero read/write limits (which would make
-// clients fall back to the 8 KiB floor and slow every test that follows).
-func TestNfsFSInfoReturnsSaneLimits(t *testing.T) {
-	fw := setupFramework(t)
-	target, cleanup, err := fw.Mount()
-	require.NoError(t, err)
-	defer cleanup()
-
-	info, err := target.FSInfo()
-	require.NoError(t, err)
-	require.NotNil(t, info)
-	assert.Greater(t, info.RTPref, uint32(0), "rtpref must be positive")
-	assert.Greater(t, info.WTPref, uint32(0), "wtpref must be positive")
-}
-
-// TestNfsAppendIsSequential writes two chunks to the same file in separate
-// Open cycles and asserts the concatenation is preserved. The second write
-// uses O_APPEND (the default Open path in go-nfs-client does not pass
-// flags, so we explicitly reopen after writing the first chunk).
-func TestNfsAppendIsSequential(t *testing.T) {
-	fw := setupFramework(t)
-	target, cleanup, err := fw.Mount()
-	require.NoError(t, err)
-	defer cleanup()
-
-	const prefix = "part1-"
-	const suffix = "part2"
-
-	writeAll(t, target, "/concat.txt", []byte(prefix))
-
-	file, err := target.OpenFile("/concat.txt", 0o644)
-	require.NoError(t, err)
-	// Seek to end before writing so we append rather than overwrite. go-nfs
-	// client's File.Seek uses the same offset tracking as Write so this is
-	// enough to place the second chunk after the first.
-	_, err = file.Seek(int64(len(prefix)), io.SeekStart)
-	require.NoError(t, err)
-	_, err = file.Write([]byte(suffix))
-	require.NoError(t, err)
-	require.NoError(t, file.Close())
-
-	got := readAll(t, target, "/concat.txt")
-	assert.Equal(t, prefix+suffix, string(got))
-
-	require.NoError(t, target.Remove("/concat.txt"))
-}
-
-// Regression: readdir should not emit stale entries after a remove. This is
-// the scenario the PR's meta cache invalidation logic was written to fix.
-func TestNfsReadDirAfterRemove(t *testing.T) {
-	fw := setupFramework(t)
-	target, cleanup, err := fw.Mount()
-	require.NoError(t, err)
-	defer cleanup()
-
-	_, err = target.Mkdir("/churn", 0o755)
-	require.NoError(t, err)
-	for i := 0; i < 5; i++ {
-		writeAll(t, target, path.Join("/churn", fmt.Sprintf("f%d.txt", i)), []byte{byte(i)})
-	}
-	// Remove the middle one and re-list.
-	require.NoError(t, target.Remove("/churn/f2.txt"))
-
-	entries, err := target.ReadDirPlus("/churn")
-	require.NoError(t, err)
-	for _, entry := range entries {
-		assert.NotEqual(t, "f2.txt", entry.Name(), "removed file should not reappear in listing")
-	}
-
-	for i := 0; i < 5; i++ {
-		if i == 2 {
-			continue
-		}
-		require.NoError(t, target.Remove(path.Join("/churn", fmt.Sprintf("f%d.txt", i))))
-	}
-	require.NoError(t, target.RmDir("/churn"))
-}
@@ -1,423 +0,0 @@
-package nfs
-
-import (
-	"bytes"
-	"fmt"
-	"io"
-	"mime/multipart"
-	"net"
-	"net/http"
-	"os"
-	"os/exec"
-	"path/filepath"
-	"runtime"
-	"strings"
-	"syscall"
-	"testing"
-	"time"
-
-	"github.com/seaweedfs/seaweedfs/test/testutil"
-	"github.com/stretchr/testify/require"
-	nfsclient "github.com/willscott/go-nfs-client/nfs"
-	"github.com/willscott/go-nfs-client/nfs/rpc"
-)
-
-// NfsTestFramework boots a minimal SeaweedFS cluster (master + volume + filer)
-// plus the experimental `weed nfs` frontend and hands out NFSv3 RPC clients
-// that talk to it. Everything is driven via subprocesses so the tests exercise
-// the same binary an operator would deploy, and no kernel mount is required.
-type NfsTestFramework struct {
-	t             *testing.T
-	tempDir       string
-	dataDir       string
-	masterProcess *os.Process
-	volumeProcess *os.Process
-	filerProcess  *os.Process
-	nfsProcess    *os.Process
-	masterAddr    string
-	masterGrpc    int
-	volumeAddr    string
-	volumeGrpc    int
-	filerAddr     string
-	filerGrpc     int
-	nfsAddr       string
-	exportRoot    string
-	weedBinary    string
-	isSetup       bool
-	skipCleanup   bool
-}
-
-// TestConfig controls how the framework boots the cluster.
-type TestConfig struct {
-	NumVolumes  int
-	EnableDebug bool
-	SkipCleanup bool // keep temp dir on failure for inspection
-	// ExportRoot is the filer path the NFS server exports. Defaults to "/"
-	// so tests can use any path, with a single warning logged by the server.
-	ExportRoot string
-}
-
-// DefaultTestConfig returns the defaults used by most tests. A dedicated
-// /nfs_export subtree is used as the NFS export root because the NFS server
-// requires the export directory to exist in the filer's namespace and carry
-// a non-zero inode — passing "/" would succeed only for filer setups that
-// have already backfilled the root inode.
-func DefaultTestConfig() *TestConfig {
-	return &TestConfig{
-		NumVolumes:  3,
-		EnableDebug: false,
-		SkipCleanup: false,
-		ExportRoot:  "/nfs_export",
-	}
-}
-
-// NewNfsTestFramework allocates a framework bound to the current test. Call
-// Setup next to actually start the cluster.
-func NewNfsTestFramework(t *testing.T, config *TestConfig) *NfsTestFramework {
-	if config == nil {
-		config = DefaultTestConfig()
-	}
-
-	tempDir, err := os.MkdirTemp("", "seaweedfs_nfs_test_")
-	require.NoError(t, err)
-
-	// testutil.MustAllocatePorts holds every listener open until the full
-	// batch has been reserved, which avoids the "close-then-hope" race my
-	// original per-port helper had. We need seven ports: four HTTP (master,
-	// volume, filer, nfs) and three gRPC (master, volume, filer — nfs has
-	// no gRPC endpoint).
-	ports := testutil.MustAllocatePorts(t, 7)
-
-	exportRoot := config.ExportRoot
-	if exportRoot == "" {
-		exportRoot = "/"
-	}
-
-	return &NfsTestFramework{
-		t:           t,
-		tempDir:     tempDir,
-		dataDir:     filepath.Join(tempDir, "data"),
-		masterAddr:  fmt.Sprintf("127.0.0.1:%d", ports[0]),
-		masterGrpc:  ports[1],
-		volumeAddr:  fmt.Sprintf("127.0.0.1:%d", ports[2]),
-		volumeGrpc:  ports[3],
-		filerAddr:   fmt.Sprintf("127.0.0.1:%d", ports[4]),
-		filerGrpc:   ports[5],
-		nfsAddr:     fmt.Sprintf("127.0.0.1:%d", ports[6]),
-		exportRoot:  exportRoot,
-		weedBinary:  findWeedBinary(),
-		isSetup:     false,
-		skipCleanup: config.SkipCleanup,
-	}
-}
-
-// Setup starts the SeaweedFS cluster and the NFS frontend, waiting for each
-// component to accept connections before moving on.
-func (f *NfsTestFramework) Setup(config *TestConfig) error {
-	if f.isSetup {
-		return fmt.Errorf("framework already setup")
-	}
-
-	dirs := []string{
-		f.dataDir,
-		filepath.Join(f.dataDir, "master"),
-		filepath.Join(f.dataDir, "volume"),
-	}
-	for _, dir := range dirs {
-		if err := os.MkdirAll(dir, 0755); err != nil {
-			return fmt.Errorf("failed to create directory %s: %v", dir, err)
-		}
-	}
-
-	if err := f.startMaster(config); err != nil {
-		return fmt.Errorf("failed to start master: %v", err)
-	}
-	if !testutil.WaitForPort(portFromAddr(f.masterAddr), testutil.SeaweedMiniStartupTimeout) {
-		return fmt.Errorf("master not ready at %s", f.masterAddr)
-	}
-
-	if err := f.startVolumeServer(config); err != nil {
-		return fmt.Errorf("failed to start volume server: %v", err)
-	}
-	if !testutil.WaitForPort(portFromAddr(f.volumeAddr), testutil.SeaweedMiniStartupTimeout) {
-		return fmt.Errorf("volume server not ready at %s", f.volumeAddr)
-	}
-
-	if err := f.startFiler(config); err != nil {
-		return fmt.Errorf("failed to start filer: %v", err)
-	}
-	if !testutil.WaitForPort(portFromAddr(f.filerAddr), testutil.SeaweedMiniStartupTimeout) {
-		return fmt.Errorf("filer not ready at %s", f.filerAddr)
-	}
-
-	// Pre-create the export root in the filer's namespace. The NFS server
-	// expects its export directory to exist with a real inode; uploading a
-	// placeholder file creates the parent directory implicitly and then
-	// removing the file leaves the empty directory in place.
-	if f.exportRoot != "/" {
-		if err := f.ensureExportRootExists(); err != nil {
-			return fmt.Errorf("failed to pre-create export root %s: %v", f.exportRoot, err)
-		}
-	}
-
-	if err := f.startNfsServer(config); err != nil {
-		return fmt.Errorf("failed to start NFS server: %v", err)
-	}
-	if !testutil.WaitForPort(portFromAddr(f.nfsAddr), testutil.SeaweedMiniStartupTimeout) {
-		return fmt.Errorf("NFS server not ready at %s", f.nfsAddr)
-	}
-
-	// Let the NFS server finish wiring up its gRPC subscription to the filer
-	// before the first client call hits MOUNT/LOOKUP.
-	time.Sleep(500 * time.Millisecond)
-
-	f.isSetup = true
-	return nil
-}
-
-// Cleanup stops all processes. Temp state is preserved if SkipCleanup is set.
-func (f *NfsTestFramework) Cleanup() {
-	processes := []*os.Process{f.nfsProcess, f.filerProcess, f.volumeProcess, f.masterProcess}
-	for _, proc := range processes {
-		if proc != nil {
-			_ = proc.Signal(syscall.SIGTERM)
-			_, _ = proc.Wait()
-		}
-	}
-	if !f.skipCleanup {
-		_ = os.RemoveAll(f.tempDir)
-	}
-}
-
-// NfsAddr returns the TCP address the NFS server is listening on.
-func (f *NfsTestFramework) NfsAddr() string { return f.nfsAddr }
-
-// FilerAddr returns the TCP address of the filer.
-func (f *NfsTestFramework) FilerAddr() string { return f.filerAddr }
-
-// ExportRoot returns the path the NFS server exports.
-func (f *NfsTestFramework) ExportRoot() string { return f.exportRoot }
-
-// Mount opens an NFSv3 MOUNT+NFS connection against the running NFS server
-// and returns a Target that tests can drive like a mini-VFS. Caller is
-// responsible for calling the returned cleanup func to Unmount and close the
-// TCP connection.
-func (f *NfsTestFramework) Mount() (*nfsclient.Target, func(), error) {
-	var (
-		client *rpc.Client
-		err    error
-	)
-	// The NFS server's TCP listener may already be accepting connections when
-	// waitForService returns, but the RPC program registration can trail it
-	// by a few milliseconds. Retry the dial to absorb that small window.
-	for attempt := 0; attempt < 20; attempt++ {
-		client, err = rpc.DialTCP("tcp", f.nfsAddr, false)
-		if err == nil {
-			break
-		}
-		time.Sleep(25 * time.Millisecond)
-	}
-	if err != nil {
-		return nil, nil, fmt.Errorf("dial NFS: %w", err)
-	}
-
-	// Note: do not set Mount.Addr here. When Addr is non-empty, the go-nfs
-	// client re-dials via portmapper and concatenates `:111` onto the
-	// address, which produces "too many colons" for a raw `host:port`
-	// string. Reusing the existing RPC client avoids that path entirely.
-	mounter := &nfsclient.Mount{Client: client}
-	target, err := mounter.Mount(f.exportRoot, rpc.AuthNull)
-	if err != nil {
-		client.Close()
-		return nil, nil, fmt.Errorf("mount %s: %w", f.exportRoot, err)
-	}
-
-	cleanup := func() {
-		_ = mounter.Unmount()
-		client.Close()
-	}
-	return target, cleanup, nil
-}
-
-func (f *NfsTestFramework) startMaster(config *TestConfig) error {
-	_, masterPort := splitHostPort(f.masterAddr)
-	args := []string{
-		"master",
-		"-ip=127.0.0.1",
-		fmt.Sprintf("-port=%d", masterPort),
-		fmt.Sprintf("-port.grpc=%d", f.masterGrpc),
-		"-mdir=" + filepath.Join(f.dataDir, "master"),
-		"-raftBootstrap",
-		"-peers=none",
-	}
-	return f.startProcess(&f.masterProcess, config, args)
-}
-
-func (f *NfsTestFramework) startVolumeServer(config *TestConfig) error {
-	_, volumePort := splitHostPort(f.volumeAddr)
-	// pb.ServerAddress encodes a non-default gRPC port as `host:port.grpc`.
-	// See weed/pb/server_address.go — the dot, not a colon, is the separator
-	// between the HTTP port and the gRPC port.
-	masterWithGrpc := fmt.Sprintf("%s.%d", f.masterAddr, f.masterGrpc)
-	args := []string{
-		"volume",
-		"-master=" + masterWithGrpc,
-		"-ip=127.0.0.1",
-		fmt.Sprintf("-port=%d", volumePort),
-		fmt.Sprintf("-port.grpc=%d", f.volumeGrpc),
-		"-dir=" + filepath.Join(f.dataDir, "volume"),
-		fmt.Sprintf("-max=%d", config.NumVolumes),
-	}
-	return f.startProcess(&f.volumeProcess, config, args)
-}
-
-func (f *NfsTestFramework) startFiler(config *TestConfig) error {
-	_, filerPort := splitHostPort(f.filerAddr)
-	masterWithGrpc := fmt.Sprintf("%s.%d", f.masterAddr, f.masterGrpc)
-	args := []string{
-		"filer",
-		"-master=" + masterWithGrpc,
-		"-ip=127.0.0.1",
-		fmt.Sprintf("-port=%d", filerPort),
-		fmt.Sprintf("-port.grpc=%d", f.filerGrpc),
-	}
-	return f.startProcess(&f.filerProcess, config, args)
-}
-
-func (f *NfsTestFramework) startNfsServer(config *TestConfig) error {
-	_, nfsPort := splitHostPort(f.nfsAddr)
-	// `host:port.grpc` encoding — see pb/server_address.go.
-	filerWithGrpc := fmt.Sprintf("%s.%d", f.filerAddr, f.filerGrpc)
-	args := []string{
-		"nfs",
-		"-filer=" + filerWithGrpc,
-		"-ip.bind=127.0.0.1",
-		fmt.Sprintf("-port=%d", nfsPort),
-		"-filer.path=" + f.exportRoot,
-	}
-	return f.startProcess(&f.nfsProcess, config, args)
-}
-
-func (f *NfsTestFramework) startProcess(target **os.Process, config *TestConfig, args []string) error {
-	cmd := exec.Command(f.weedBinary, args...)
-	cmd.Dir = f.tempDir
-	if config.EnableDebug {
-		cmd.Stdout = os.Stdout
-		cmd.Stderr = os.Stderr
-	}
-	if err := cmd.Start(); err != nil {
-		return err
-	}
-	*target = cmd.Process
-	return nil
-}
-
-// portFromAddr returns just the port number from a `host:port` string.
-// testutil.WaitForPort takes an int port, not a full address.
-func portFromAddr(addr string) int {
-	_, port := splitHostPort(addr)
-	return port
-}
-
-// ensureExportRootExists posts a placeholder file to f.exportRoot via the
-// filer's HTTP API, then deletes it. That roundtrip implicitly creates the
-// target directory so the NFS server has something to mount. We bypass
-// weed/pb here because the HTTP client is simpler and needs no gRPC stubs.
-func (f *NfsTestFramework) ensureExportRootExists() error {
-	exportRoot := strings.TrimRight(f.exportRoot, "/")
-	if exportRoot == "" {
-		return nil
-	}
-	placeholder := exportRoot + "/.nfs_test_init"
-	filerURL := "http://" + f.filerAddr + placeholder
-
-	var body bytes.Buffer
-	writer := multipart.NewWriter(&body)
-	part, err := writer.CreateFormFile("file", ".nfs_test_init")
-	if err != nil {
-		return err
-	}
-	if _, err := io.WriteString(part, ""); err != nil {
-		return err
-	}
-	if err := writer.Close(); err != nil {
-		return err
-	}
-
-	httpClient := &http.Client{Timeout: 10 * time.Second}
-	req, err := http.NewRequest(http.MethodPost, filerURL, &body)
-	if err != nil {
-		return err
-	}
-	req.Header.Set("Content-Type", writer.FormDataContentType())
-	resp, err := httpClient.Do(req)
-	if err != nil {
-		return err
-	}
-	_, _ = io.Copy(io.Discard, resp.Body)
-	resp.Body.Close()
-	if resp.StatusCode/100 != 2 {
-		return fmt.Errorf("filer POST %s returned status %d", filerURL, resp.StatusCode)
-	}
-
-	// Delete the placeholder; the directory stays behind.
-	deleteReq, err := http.NewRequest(http.MethodDelete, filerURL, nil)
-	if err != nil {
-		return err
-	}
-	deleteResp, err := httpClient.Do(deleteReq)
-	if err != nil {
-		return err
-	}
-	_, _ = io.Copy(io.Discard, deleteResp.Body)
-	deleteResp.Body.Close()
-	if deleteResp.StatusCode/100 != 2 && deleteResp.StatusCode != http.StatusNotFound {
-		return fmt.Errorf("filer DELETE %s returned status %d", filerURL, deleteResp.StatusCode)
-	}
-	return nil
-}
-
-func splitHostPort(addr string) (string, int) {
-	host, portStr, err := net.SplitHostPort(addr)
-	if err != nil {
-		return "", 0
-	}
-	var port int
-	_, _ = fmt.Sscanf(portStr, "%d", &port)
-	return host, port
-}
-
-// findWeedBinary locates the weed binary, preferring the local build in the
-// checkout so tests run against the code under review rather than whatever is
-// on $PATH.
-func findWeedBinary() string {
-	if _, thisFile, _, ok := runtime.Caller(0); ok {
-		thisDir := filepath.Dir(thisFile)
-		candidates := []string{
-			filepath.Join(thisDir, "../../weed/weed"),
-			filepath.Join(thisDir, "../weed/weed"),
-		}
-		for _, candidate := range candidates {
-			if _, err := os.Stat(candidate); err == nil {
-				abs, _ := filepath.Abs(candidate)
-				return abs
-			}
-		}
-	}
-	cwd, _ := os.Getwd()
-	candidates := []string{
-		filepath.Join(cwd, "../../weed/weed"),
-		filepath.Join(cwd, "../weed/weed"),
-		filepath.Join(cwd, "./weed"),
-	}
-	for _, candidate := range candidates {
-		if _, err := os.Stat(candidate); err == nil {
-			abs, _ := filepath.Abs(candidate)
-			return abs
-		}
-	}
-	if path, err := exec.LookPath("weed"); err == nil {
-		return path
-	}
-	return "weed"
-}
@@ -1,21 +0,0 @@
-module seaweedfs-nfs-tests
-
-go 1.25.0
-
-// test/testutil lives inside the main seaweedfs module; pull it in via a
-// local replace so this integration suite can reuse the shared port
-// allocator and readiness helpers instead of reinventing them.
-replace github.com/seaweedfs/seaweedfs => ../..
-
-require (
-	github.com/seaweedfs/seaweedfs v0.0.0-00010101000000-000000000000
-	github.com/stretchr/testify v1.11.1
-	github.com/willscott/go-nfs-client v0.0.0-20251022144359-801f10d98886
-)
-
-require (
-	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
-	github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
-	github.com/rasky/go-xdr v0.0.0-20170124162913-1a41d1a06c93 // indirect
-	gopkg.in/yaml.v3 v3.0.1 // indirect
-)
@@ -1,14 +0,0 @@
-github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc h1:U9qPSI2PIWSS1VwoXQT9A3Wy9MM3WgvqSxFWenqJduM=
-github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
-github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 h1:Jamvg5psRIccs7FGNTlIRMkT8wgtp5eCXdBlqhYGL6U=
-github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
-github.com/rasky/go-xdr v0.0.0-20170124162913-1a41d1a06c93 h1:UVArwN/wkKjMVhh2EQGC0tEc1+FqiLlvYXY5mQ2f8Wg=
-github.com/rasky/go-xdr v0.0.0-20170124162913-1a41d1a06c93/go.mod h1:Nfe4efndBz4TibWycNE+lqyJZiMX4ycx+QKV8Ta0f/o=
-github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
-github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
-github.com/willscott/go-nfs-client v0.0.0-20251022144359-801f10d98886 h1:DtrBtkgTJk2XGt4T7eKdKVkd9A5NCevN2e4inLXtsqA=
-github.com/willscott/go-nfs-client v0.0.0-20251022144359-801f10d98886/go.mod h1:Tq++Lr/FgiS3X48q5FETemXiSLGuYMQT2sPjYNPJSwA=
-gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405 h1:yhCVgyC4o1eVCa2tZl7eS0r+SDo693bJlVdllGtEeKM=
-gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
-gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
-gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
@@ -1,28 +0,0 @@
-FROM chrislusf/seaweedfs:e2e
-
-RUN apt-get update && \
-    DEBIAN_FRONTEND=noninteractive apt-get install -y \
-    --no-install-recommends \
-    --no-install-suggests \
-    autoconf \
-    automake \
-    build-essential \
-    git \
-    libtap-harness-archive-perl \
-    perl \
-    && apt-get clean \
-    && rm -rf /var/lib/apt/lists/*
-
-ARG PJDFSTEST_REPO=https://github.com/sanwan/pjdfstest.git
-ARG PJDFSTEST_REF=d25636a227606f8960e5179741d8f4ad7030ef41
-
-RUN git clone "${PJDFSTEST_REPO}" /opt/pjdfstest && \
-    cd /opt/pjdfstest && \
-    git checkout "${PJDFSTEST_REF}" && \
-    autoreconf -ifs && \
-    ./configure && \
-    make pjdfstest
-
-COPY run_inside_container.sh /run.sh
-COPY known_failures.txt /known_failures.txt
-RUN chmod +x /run.sh
@@ -1,57 +0,0 @@
-services:
-  master:
-    image: chrislusf/seaweedfs:e2e
-    command: "-v=4 master -ip=master -ip.bind=0.0.0.0 -raftBootstrap"
-    healthcheck:
-      test: ["CMD", "curl", "--fail", "-I", "http://localhost:9333/cluster/healthz"]
-      interval: 2s
-      timeout: 10s
-      retries: 30
-      start_period: 10s
-
-  volume:
-    image: chrislusf/seaweedfs:e2e
-    command: "-v=4 volume -master=master:9333 -ip=volume -ip.bind=0.0.0.0 -preStopSeconds=1"
-    healthcheck:
-      test: ["CMD", "curl", "--fail", "-I", "http://localhost:8080/healthz"]
-      interval: 2s
-      timeout: 10s
-      retries: 15
-      start_period: 5s
-    depends_on:
-      master:
-        condition: service_healthy
-
-  filer:
-    image: chrislusf/seaweedfs:e2e
-    command: "-v=4 filer -master=master:9333 -ip=filer -ip.bind=0.0.0.0"
-    healthcheck:
-      test: ["CMD", "curl", "--fail", "-I", "http://localhost:8888/healthz"]
-      interval: 2s
-      timeout: 10s
-      retries: 15
-      start_period: 5s
-    depends_on:
-      volume:
-        condition: service_healthy
-
-  mount:
-    image: chrislusf/seaweedfs:pjdfstest
-    build:
-      context: .
-    command: "-v=4 mount -filer=filer:8888 -filer.path=/ -dirAutoCreate -dir=/mnt/seaweedfs -allowOthers"
-    cap_add:
-      - SYS_ADMIN
-    devices:
-      - /dev/fuse
-    security_opt:
-      - apparmor:unconfined
-    healthcheck:
-      test: ["CMD", "mountpoint", "-q", "--", "/mnt/seaweedfs"]
-      interval: 2s
-      timeout: 10s
-      retries: 15
-      start_period: 10s
-    depends_on:
-      filer:
-        condition: service_healthy
@@ -1,8 +0,0 @@
-# Known pjdfstest failures for SeaweedFS FUSE mount.
-#
-# Tests listed here are skipped during CI runs. Each entry must be a path
-# relative to the pjdfstest root (e.g. tests/chmod/02.t).
-#
-# A failure in any test NOT listed here will cause the CI job to fail,
-# catching regressions immediately.
-
@@ -1,173 +0,0 @@
-#!/usr/bin/env bash
-#
-# Run the pjdfstest POSIX compliance suite against a SeaweedFS FUSE mount.
-#
-# This script:
-#   1. Starts a self-contained "weed mini" server (master+volume+filer in one)
-#   2. Mounts the filesystem with "weed mount"
-#   3. Builds pjdfstest from upstream and runs it under prove(1)
-#
-# Requirements: weed in $PATH, fusermount3, perl with TAP::Harness::Archive,
-# autoconf, make, sudo (pjdfstest exercises chown/chmod which need root).
-#
-# Usage:
-#   test/pjdfstest/run.sh                # runs full suite
-#   PJDFSTEST_TESTS=tests/chmod ./run.sh # runs a subset
-
-set -euo pipefail
-
-WEED_BIN="${WEED_BIN:-weed}"
-WORK_DIR="${WORK_DIR:-$(mktemp -d /tmp/seaweedfs-pjdfstest.XXXXXX)}"
-MOUNT_DIR="${MOUNT_DIR:-${WORK_DIR}/mnt}"
-DATA_DIR="${DATA_DIR:-${WORK_DIR}/data}"
-LOG_DIR="${LOG_DIR:-${WORK_DIR}/logs}"
-FILER_PORT="${FILER_PORT:-28888}"
-FILER_ADDR="127.0.0.1:${FILER_PORT}"
-
-# Pin to an immutable upstream commit so CI is reproducible. Override via env
-# if you want to test against a different ref or fork.
-PJDFSTEST_REPO="${PJDFSTEST_REPO:-https://github.com/sanwan/pjdfstest.git}"
-PJDFSTEST_REF="${PJDFSTEST_REF:-d25636a227606f8960e5179741d8f4ad7030ef41}"
-PJDFSTEST_TESTS="${PJDFSTEST_TESTS:-tests/}"
-
-mini_pid=""
-mount_pid=""
-
-CI_LOG_DIR="/tmp/seaweedfs-pjdfstest-logs"
-
-cleanup() {
-  set +e
-  if [[ -n "${mount_pid}" ]] && kill -0 "${mount_pid}" 2>/dev/null; then
-    kill -TERM "${mount_pid}" 2>/dev/null || true
-    wait "${mount_pid}" 2>/dev/null || true
-  fi
-  if mountpoint -q "${MOUNT_DIR}" 2>/dev/null; then
-    fusermount3 -u "${MOUNT_DIR}" 2>/dev/null || \
-      fusermount -u "${MOUNT_DIR}" 2>/dev/null || \
-      sudo umount "${MOUNT_DIR}" 2>/dev/null || true
-  fi
-  if [[ -n "${mini_pid}" ]] && kill -0 "${mini_pid}" 2>/dev/null; then
-    kill -TERM "${mini_pid}" 2>/dev/null || true
-    wait "${mini_pid}" 2>/dev/null || true
-  fi
-  # Copy logs to a fixed path for CI artifact upload.
-  mkdir -p "${CI_LOG_DIR}"
-  cp "${LOG_DIR}"/*.log "${CI_LOG_DIR}/" 2>/dev/null || true
-}
-trap cleanup EXIT INT TERM
-
-mkdir -p "${MOUNT_DIR}" "${DATA_DIR}" "${LOG_DIR}"
-
-echo "==> Starting weed mini on ${FILER_ADDR}"
-"${WEED_BIN}" mini \
-  -dir="${DATA_DIR}" \
-  -ip=127.0.0.1 \
-  -filer.port="${FILER_PORT}" \
-  -s3=false \
-  -webdav=false \
-  -admin.ui=false \
-  >"${LOG_DIR}/mini.log" 2>&1 &
-mini_pid=$!
-
-# Wait for filer to accept connections.
-for i in $(seq 1 60); do
-  if (echo > "/dev/tcp/127.0.0.1/${FILER_PORT}") 2>/dev/null; then
-    break
-  fi
-  if ! kill -0 "${mini_pid}" 2>/dev/null; then
-    echo "weed mini exited early; log tail:" >&2
-    tail -n 100 "${LOG_DIR}/mini.log" >&2 || true
-    exit 1
-  fi
-  sleep 0.5
-done
-
-if ! (echo > "/dev/tcp/127.0.0.1/${FILER_PORT}") 2>/dev/null; then
-  echo "weed mini filer did not become reachable within 30s; log tail:" >&2
-  tail -n 100 "${LOG_DIR}/mini.log" >&2 || true
-  exit 1
-fi
-
-echo "==> Mounting SeaweedFS at ${MOUNT_DIR}"
-# allowOthers is required so that pjdfstest's setuid/setgid sub-tests (run via
-# sudo) can access files created as the invoking user.
-sudo "${WEED_BIN}" mount \
-  -filer="${FILER_ADDR}" \
-  -dir="${MOUNT_DIR}" \
-  -filer.path=/ \
-  -dirAutoCreate \
-  -allowOthers=true \
-  >"${LOG_DIR}/mount.log" 2>&1 &
-mount_pid=$!
-
-for i in $(seq 1 60); do
-  if mountpoint -q "${MOUNT_DIR}"; then
-    break
-  fi
-  if ! kill -0 "${mount_pid}" 2>/dev/null; then
-    echo "weed mount exited early; log tail:" >&2
-    tail -n 100 "${LOG_DIR}/mount.log" >&2 || true
-    exit 1
-  fi
-  sleep 0.5
-done
-
-if ! mountpoint -q "${MOUNT_DIR}"; then
-  echo "FUSE mount did not come up within 30s" >&2
-  tail -n 100 "${LOG_DIR}/mount.log" >&2 || true
-  exit 1
-fi
-
-echo "==> Cloning and building pjdfstest"
-PJDFSTEST_DIR="${WORK_DIR}/pjdfstest"
-if [[ ! -d "${PJDFSTEST_DIR}/.git" ]]; then
-  git clone "${PJDFSTEST_REPO}" "${PJDFSTEST_DIR}"
-fi
-git -C "${PJDFSTEST_DIR}" remote set-url origin "${PJDFSTEST_REPO}"
-git -C "${PJDFSTEST_DIR}" fetch --depth 1 origin "${PJDFSTEST_REF}"
-git -C "${PJDFSTEST_DIR}" checkout --detach FETCH_HEAD
-(
-  cd "${PJDFSTEST_DIR}"
-  autoreconf -ifs
-  ./configure
-  make pjdfstest
-)
-
-# pjdfstest must run inside the filesystem under test.
-TEST_ROOT="${MOUNT_DIR}/pjdfstest-root"
-sudo mkdir -p "${TEST_ROOT}"
-sudo cp -r "${PJDFSTEST_DIR}/." "${TEST_ROOT}/"
-
-cd "${TEST_ROOT}"
-
-SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-KNOWN_FAILURES="${SCRIPT_DIR}/known_failures.txt"
-
-# Build the list of tests to run, excluding known failures.
-if [[ -f "${KNOWN_FAILURES}" ]] && [[ "${PJDFSTEST_TESTS}" == "tests/" ]]; then
-  mapfile -t skip < <(grep -v '^#' "${KNOWN_FAILURES}" | grep -v '^$')
-  all_tests=()
-  while IFS= read -r -d '' t; do
-    all_tests+=("$t")
-  done < <(find tests/ -name '*.t' -print0 | sort -z)
-
-  run_tests=()
-  for t in "${all_tests[@]}"; do
-    is_skipped=false
-    for s in "${skip[@]}"; do
-      if [[ "$t" == "$s" ]]; then
-        is_skipped=true
-        break
-      fi
-    done
-    if ! $is_skipped; then
-      run_tests+=("$t")
-    fi
-  done
-
-  echo "==> Running pjdfstest (${#run_tests[@]} tests, ${#skip[@]} skipped)"
-  sudo prove -rv "${run_tests[@]}"
-else
-  echo "==> Running pjdfstest (${PJDFSTEST_TESTS})"
-  sudo prove -rv "${PJDFSTEST_TESTS}"
-fi
@@ -1,48 +0,0 @@
-#!/usr/bin/env bash
-#
-# Runs pjdfstest inside the mount container against /mnt/seaweedfs.
-# Invoked via: docker compose exec mount /run.sh
-#
-# Uses known_failures.txt to skip tests with known issues. Any failure
-# in a test NOT in the skip list causes a non-zero exit (regression).
-set -euo pipefail
-
-MOUNT_DIR="/mnt/seaweedfs"
-PJDFSTEST_TESTS="${PJDFSTEST_TESTS:-tests/}"
-KNOWN_FAILURES="/known_failures.txt"
-
-# Copy pjdfstest into the mounted filesystem so tests exercise the FS under test.
-TEST_ROOT="${MOUNT_DIR}/pjdfstest-root"
-mkdir -p "${TEST_ROOT}"
-cp -r /opt/pjdfstest/. "${TEST_ROOT}/"
-
-cd "${TEST_ROOT}"
-
-# Build the list of tests to run, excluding known failures.
-if [[ -f "${KNOWN_FAILURES}" ]] && [[ "${PJDFSTEST_TESTS}" == "tests/" ]]; then
-  mapfile -t skip < <(grep -v '^#' "${KNOWN_FAILURES}" | grep -v '^$')
-  all_tests=()
-  while IFS= read -r -d '' t; do
-    all_tests+=("$t")
-  done < <(find tests/ -name '*.t' -print0 | sort -z)
-
-  run_tests=()
-  for t in "${all_tests[@]}"; do
-    is_skipped=false
-    for s in "${skip[@]}"; do
-      if [[ "$t" == "$s" ]]; then
-        is_skipped=true
-        break
-      fi
-    done
-    if ! $is_skipped; then
-      run_tests+=("$t")
-    fi
-  done
-
-  echo "==> Running pjdfstest (${#run_tests[@]} tests, ${#skip[@]} skipped)"
-  prove -rv "${run_tests[@]}"
-else
-  echo "==> Running pjdfstest (${PJDFSTEST_TESTS})"
-  prove -rv "${PJDFSTEST_TESTS}"
-fi
@@ -7,7 +7,6 @@ import (
 	"path/filepath"
 	"testing"

-	"github.com/seaweedfs/seaweedfs/weed/storage/needle"
 	"github.com/seaweedfs/seaweedfs/weed/storage/types"
 )

@@ -22,12 +21,7 @@ func WriteTestVolumeFiles(t *testing.T, baseDir string, volumeID uint32, datSize
 	datPath := filepath.Join(baseDir, volumeFilename(volumeID, ".dat"))
 	idxPath := filepath.Join(baseDir, volumeFilename(volumeID, ".idx"))

-	// The idx entry records the needle's data size. The actual on-disk size
-	// includes header + checksum + timestamp (GetActualSize). The .dat must
-	// be large enough to hold the full needle.
-	needleDataSize := types.Size(datSize)
-	actualSize := needle.GetActualSize(needleDataSize, needle.Version3)
-	data := make([]byte, actualSize)
+	data := make([]byte, datSize)
 	rng := rand.New(rand.NewSource(99))
 	_, _ = rng.Read(data)
 	if err := os.WriteFile(datPath, data, 0644); err != nil {
@@ -41,7 +35,7 @@ func WriteTestVolumeFiles(t *testing.T, baseDir string, volumeID uint32, datSize

 	types.NeedleIdToBytes(entry[:idEnd], types.NeedleId(1))
 	types.OffsetToBytes(entry[idEnd:offsetEnd], types.ToOffset(0))
-	types.SizeToBytes(entry[offsetEnd:sizeEnd], needleDataSize)
+	types.SizeToBytes(entry[offsetEnd:sizeEnd], types.Size(datSize))

 	if err := os.WriteFile(idxPath, entry, 0644); err != nil {
 		t.Fatalf("write idx file: %v", err)
@@ -5,6 +5,7 @@ import (
 	"crypto/rand"
 	"fmt"
 	"io"
+	"net"
 	"net/http"
 	"os"
 	"os/exec"
@@ -12,8 +13,6 @@ import (
 	"strings"
 	"testing"
 	"time"
-
-	"github.com/seaweedfs/seaweedfs/test/testutil"
 )

 type TestEnvironment struct {
@@ -97,26 +96,29 @@ func NewTestEnvironment(t *testing.T) *TestEnvironment {
 		t.Fatalf("Failed to create temp dir: %v", err)
 	}

-	bindIP := testutil.FindBindIP()
+	bindIP := findBindIP()

-	// 9 ports: master(2), volume(2), filer(2), s3(2), iceberg(1)
-	ports := testutil.MustAllocatePorts(t, 9)
+	masterPort, masterGrpcPort := mustFreePortPair(t, "Master")
+	volumePort, volumeGrpcPort := mustFreePortPair(t, "Volume")
+	filerPort, filerGrpcPort := mustFreePortPair(t, "Filer")
+	s3Port, s3GrpcPort := mustFreePortPair(t, "S3")
+	icebergPort := mustFreePort(t, "Iceberg")

 	return &TestEnvironment{
 		seaweedDir:      seaweedDir,
 		weedBinary:      weedBinary,
 		dataDir:         dataDir,
 		bindIP:          bindIP,
-		masterPort:      ports[0],
-		masterGrpcPort:  ports[1],
-		volumePort:      ports[2],
-		volumeGrpcPort:  ports[3],
-		filerPort:       ports[4],
-		filerGrpcPort:   ports[5],
-		s3Port:          ports[6],
-		s3GrpcPort:      ports[7],
-		icebergPort:     ports[8],
-		dockerAvailable: testutil.HasDocker(),
+		s3Port:          s3Port,
+		s3GrpcPort:      s3GrpcPort,
+		icebergPort:     icebergPort,
+		masterPort:      masterPort,
+		masterGrpcPort:  masterGrpcPort,
+		filerPort:       filerPort,
+		filerGrpcPort:   filerGrpcPort,
+		volumePort:      volumePort,
+		volumeGrpcPort:  volumeGrpcPort,
+		dockerAvailable: hasDocker(),
 	}
 }

@@ -331,6 +333,73 @@ func createObjectBucket(t *testing.T, env *TestEnvironment, bucketName string) {
 	}
 }

+func hasDocker() bool {
+	cmd := exec.Command("docker", "version")
+	return cmd.Run() == nil
+}
+
+func mustFreePort(t *testing.T, name string) int {
+	t.Helper()
+
+	port, err := getFreePort()
+	if err != nil {
+		t.Fatalf("Failed to get free port for %s: %v", name, err)
+	}
+	return port
+}
+
+func mustFreePortPair(t *testing.T, name string) (int, int) {
+	t.Helper()
+
+	httpPort, grpcPort, err := findAvailablePortPair()
+	if err != nil {
+		t.Fatalf("Failed to get free port pair for %s: %v", name, err)
+	}
+	return httpPort, grpcPort
+}
+
+func findAvailablePortPair() (int, int, error) {
+	httpPort, err := getFreePort()
+	if err != nil {
+		return 0, 0, err
+	}
+	grpcPort, err := getFreePort()
+	if err != nil {
+		return 0, 0, err
+	}
+	return httpPort, grpcPort, nil
+}
+
+func getFreePort() (int, error) {
+	listener, err := net.Listen("tcp", "127.0.0.1:0")
+	if err != nil {
+		return 0, err
+	}
+	defer listener.Close()
+
+	addr := listener.Addr().(*net.TCPAddr)
+	return addr.Port, nil
+}
+
+func findBindIP() string {
+	addrs, err := net.InterfaceAddrs()
+	if err != nil {
+		return "127.0.0.1"
+	}
+	for _, addr := range addrs {
+		ipNet, ok := addr.(*net.IPNet)
+		if !ok || ipNet.IP == nil {
+			continue
+		}
+		ip := ipNet.IP.To4()
+		if ip == nil || ip.IsLoopback() || ip.IsLinkLocalUnicast() {
+			continue
+		}
+		return ip.String()
+	}
+	return "127.0.0.1"
+}
+
 func randomString(length int) string {
 	const charset = "abcdefghijklmnopqrstuvwxyz0123456789"
 	b := make([]byte, length)
@@ -1,3 +0,0 @@
-test-volume-data/
-weed-test.log
-weed-server.pid
@@ -1,100 +0,0 @@
-# S3 Checksum Integration Tests
-# Covers flexible-checksum behavior on presigned URL uploads (issue #9075).
-
-.PHONY: help build-weed check-deps start-server stop-server test test-with-server logs clean health-check
-
-WEED_BINARY := ../../../weed/weed_binary
-S3_PORT := 8333
-ACCESS_KEY ?= some_access_key1
-SECRET_KEY ?= some_secret_key1
-TEST_TIMEOUT := 10m
-TEST_PATTERN ?= TestPresignedPut
-SERVER_DIR := ./test-volume-data/server-data
-
-help:
-	@echo "S3 Checksum Integration Tests"
-	@echo ""
-	@echo "Targets:"
-	@echo "  build-weed         Build the SeaweedFS binary"
-	@echo "  start-server       Start a local SeaweedFS S3 server for testing"
-	@echo "  stop-server        Stop the local SeaweedFS server"
-	@echo "  test               Run checksum tests (server must already be running)"
-	@echo "  test-with-server   Start server, run tests, stop server"
-	@echo "  logs               Tail server log"
-	@echo "  clean              Remove test artifacts"
-
-build-weed:
-	@echo "Building SeaweedFS binary..."
-	@cd ../../../weed && go build -o weed_binary .
-	@chmod +x $(WEED_BINARY)
-
-check-deps: build-weed
-	@command -v go >/dev/null 2>&1 || (echo "Go is required but not installed" && exit 1)
-	@test -f $(WEED_BINARY) || (echo "SeaweedFS binary not found at $(WEED_BINARY)" && exit 1)
-	@go list -m github.com/aws/aws-sdk-go-v2 >/dev/null 2>&1 || (echo "AWS SDK Go v2 not found. Run 'go mod tidy'." && exit 1)
-	@go list -m github.com/stretchr/testify >/dev/null 2>&1 || (echo "Testify not found. Run 'go mod tidy'." && exit 1)
-
-start-server: check-deps
-	@echo "Starting SeaweedFS server..."
-	@rm -f weed-server.pid
-	@mkdir -p $(SERVER_DIR)
-	@AWS_ACCESS_KEY_ID=$(ACCESS_KEY) AWS_SECRET_ACCESS_KEY=$(SECRET_KEY) $(WEED_BINARY) mini \
-		-dir=$(SERVER_DIR) \
-		-s3.port=$(S3_PORT) \
-		> weed-test.log 2>&1 & \
-		echo $$! > weed-server.pid
-	@for i in $$(seq 1 90); do \
-		if curl -s http://localhost:$(S3_PORT) >/dev/null 2>&1; then \
-			echo "✅ SeaweedFS server started on port $(S3_PORT) after $$i seconds"; \
-			exit 0; \
-		fi; \
-		sleep 1; \
-	done; \
-	echo "❌ Server failed to start within 90 seconds"; \
-	if [ -f weed-server.pid ]; then \
-		PID=$$(cat weed-server.pid); \
-		if ps -p $$PID >/dev/null 2>&1; then \
-			kill -TERM $$PID 2>/dev/null || true; \
-			sleep 1; \
-			ps -p $$PID >/dev/null 2>&1 && kill -KILL $$PID 2>/dev/null || true; \
-		fi; \
-		rm -f weed-server.pid; \
-	fi; \
-	if [ -f weed-test.log ]; then tail -100 weed-test.log; fi; \
-	exit 1
-
-stop-server:
-	@if [ -f weed-server.pid ]; then \
-		PID=$$(cat weed-server.pid); \
-		if ps -p $$PID >/dev/null 2>&1; then \
-			kill -TERM $$PID 2>/dev/null || true; \
-			sleep 2; \
-			ps -p $$PID >/dev/null 2>&1 && kill -KILL $$PID 2>/dev/null || true; \
-		fi; \
-		rm -f weed-server.pid; \
-	fi
-	@echo "✅ SeaweedFS server stopped"
-
-test: check-deps
-	@echo "Running checksum tests (pattern: $(TEST_PATTERN))..."
-	@S3_ENDPOINT=http://localhost:$(S3_PORT) \
-		S3_ACCESS_KEY=$(ACCESS_KEY) \
-		S3_SECRET_KEY=$(SECRET_KEY) \
-		go test -v -timeout=$(TEST_TIMEOUT) -run "$(TEST_PATTERN)" .
-
-test-with-server: start-server
-	@sleep 3
-	@$(MAKE) test || (echo "Tests failed, stopping server..." && $(MAKE) stop-server && exit 1)
-	@$(MAKE) stop-server
-	@echo "✅ Checksum tests completed"
-
-logs:
-	@if [ -f weed-test.log ]; then tail -f weed-test.log; else echo "No log file"; fi
-
-health-check:
-	@curl -s http://localhost:$(S3_PORT) >/dev/null 2>&1 && echo "✅ S3 on $(S3_PORT)" || (echo "❌ S3 not up" && exit 1)
-
-clean:
-	@$(MAKE) stop-server
-	@rm -f weed-test.log weed-server.pid
-	@rm -rf ./test-volume-data
@@ -1,256 +0,0 @@
-package checksum_test
-
-import (
-	"bytes"
-	"context"
-	"crypto/sha256"
-	"encoding/base64"
-	"fmt"
-	"io"
-	"net/http"
-	"net/url"
-	"os"
-	"strings"
-	"testing"
-	"time"
-
-	"github.com/aws/aws-sdk-go-v2/aws"
-	v4 "github.com/aws/aws-sdk-go-v2/aws/signer/v4"
-	"github.com/aws/aws-sdk-go-v2/config"
-	"github.com/aws/aws-sdk-go-v2/credentials"
-	"github.com/aws/aws-sdk-go-v2/service/s3"
-	"github.com/aws/aws-sdk-go-v2/service/s3/types"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-// Integration test for https://github.com/seaweedfs/seaweedfs/issues/9075:
-// presigned PUT URLs that request a flexible-checksum algorithm (SHA256, SHA1, ...)
-// must cause the server to compute and persist that checksum, and HEAD/GET must
-// return the x-amz-checksum-* header when the caller asks for it.
-//
-// AWS SDK presigners hoist headers like x-amz-sdk-checksum-algorithm into the
-// signed URL's query string, so we deliberately upload the body with a plain
-// http.Client to ensure the server sees the checksum algorithm via the query
-// string — which is exactly what a browser / curl / non-SDK client does.
-
-type s3TestConfig struct {
-	Endpoint     string
-	AccessKey    string
-	SecretKey    string
-	Region       string
-	BucketPrefix string
-}
-
-var defaultConfig = &s3TestConfig{
-	Endpoint:     "http://localhost:8333",
-	AccessKey:    "some_access_key1",
-	SecretKey:    "some_secret_key1",
-	Region:       "us-east-1",
-	BucketPrefix: "test-checksum-",
-}
-
-func getenvAny(keys ...string) string {
-	for _, k := range keys {
-		if v := os.Getenv(k); v != "" {
-			return v
-		}
-	}
-	return ""
-}
-
-func init() {
-	if v := getenvAny("S3_ENDPOINT"); v != "" {
-		defaultConfig.Endpoint = v
-	}
-	if v := getenvAny("S3_ACCESS_KEY", "AWS_ACCESS_KEY_ID"); v != "" {
-		defaultConfig.AccessKey = v
-	}
-	if v := getenvAny("S3_SECRET_KEY", "AWS_SECRET_ACCESS_KEY"); v != "" {
-		defaultConfig.SecretKey = v
-	}
-	if v := getenvAny("AWS_REGION", "AWS_DEFAULT_REGION"); v != "" {
-		defaultConfig.Region = v
-	}
-}
-
-// presignedHTTPClient is used for non-SDK PUTs to a presigned URL. A fixed
-// timeout keeps tests from hanging forever if the server stalls.
-var presignedHTTPClient = &http.Client{Timeout: 30 * time.Second}
-
-func getS3Client(t *testing.T) *s3.Client {
-	cfg, err := config.LoadDefaultConfig(context.TODO(),
-		config.WithRegion(defaultConfig.Region),
-		config.WithCredentialsProvider(credentials.NewStaticCredentialsProvider(
-			defaultConfig.AccessKey, defaultConfig.SecretKey, "")),
-		config.WithEndpointResolverWithOptions(aws.EndpointResolverWithOptionsFunc(
-			func(service, region string, _ ...interface{}) (aws.Endpoint, error) {
-				return aws.Endpoint{
-					URL:               defaultConfig.Endpoint,
-					SigningRegion:     defaultConfig.Region,
-					HostnameImmutable: true,
-				}, nil
-			})),
-	)
-	require.NoError(t, err)
-	return s3.NewFromConfig(cfg, func(o *s3.Options) { o.UsePathStyle = true })
-}
-
-func uniqueBucket() string {
-	return fmt.Sprintf("%s%d", defaultConfig.BucketPrefix, time.Now().UnixNano())
-}
-
-func createBucket(t *testing.T, client *s3.Client, name string) {
-	_, err := client.CreateBucket(context.TODO(), &s3.CreateBucketInput{Bucket: aws.String(name)})
-	require.NoError(t, err)
-}
-
-func cleanupBucket(t *testing.T, client *s3.Client, name string) {
-	t.Helper()
-	objs, err := client.ListObjectsV2(context.TODO(), &s3.ListObjectsV2Input{Bucket: aws.String(name)})
-	if err == nil {
-		for _, o := range objs.Contents {
-			_, _ = client.DeleteObject(context.TODO(), &s3.DeleteObjectInput{
-				Bucket: aws.String(name), Key: o.Key,
-			})
-		}
-	}
-	_, _ = client.DeleteBucket(context.TODO(), &s3.DeleteBucketInput{Bucket: aws.String(name)})
-}
-
-// uploadViaPresignedURL PUTs body to the given presigned URL using a plain
-// http.Client, mirroring what a browser / curl / non-SDK client would do.
-// Crucially this path does NOT run any AWS SDK middleware, so the server must
-// compute and store the checksum based on the algorithm parameter that was
-// hoisted into the query string by the presigner.
-//
-// extraHeaders are additional HTTP headers the presigner signed (e.g.
-// Content-MD5). Their values must exactly match what was signed or SigV4
-// verification will return SignatureDoesNotMatch.
-func uploadViaPresignedURL(t *testing.T, url string, body []byte, extraHeaders map[string]string) {
-	t.Helper()
-	req, err := http.NewRequest(http.MethodPut, url, bytes.NewReader(body))
-	require.NoError(t, err)
-	req.ContentLength = int64(len(body))
-	for k, v := range extraHeaders {
-		req.Header.Set(k, v)
-	}
-	resp, err := presignedHTTPClient.Do(req)
-	require.NoError(t, err)
-	defer resp.Body.Close()
-	respBody, err := io.ReadAll(resp.Body)
-	require.NoError(t, err, "read presigned PUT response body")
-	require.Equalf(t, http.StatusOK, resp.StatusCode,
-		"presigned PUT failed: %d %s", resp.StatusCode, string(respBody))
-}
-
-// presignPutURL builds a presigned S3 PutObject URL using the low-level
-// SigV4 presigner, with an optional x-amz-sdk-checksum-algorithm query
-// parameter baked into the signed canonical query string.
-//
-// We use the raw signer instead of s3.PresignClient because the SDK's
-// flexible-checksum middleware tries to inject a Content-MD5 header for
-// flexible-checksum PutObject calls, and at presign time (no body) it seeds
-// MD5-of-empty, which then mismatches any real body uploaded through a plain
-// http.Client. The raw signer has no such middleware and produces exactly
-// the kind of URL a browser, curl caller, or custom client would receive.
-func presignPutURL(t *testing.T, bucket, key, checksumAlgorithm string) string {
-	t.Helper()
-	putURL, err := url.Parse(fmt.Sprintf("%s/%s/%s", strings.TrimRight(defaultConfig.Endpoint, "/"), bucket, key))
-	require.NoError(t, err)
-	q := putURL.Query()
-	// PresignHTTP does not add X-Amz-Expires on its own; the caller must
-	// seed it so the signer picks it up into the canonical query string.
-	q.Set("X-Amz-Expires", "600")
-	if checksumAlgorithm != "" {
-		q.Set("x-amz-sdk-checksum-algorithm", checksumAlgorithm)
-	}
-	putURL.RawQuery = q.Encode()
-
-	req, err := http.NewRequest(http.MethodPut, putURL.String(), nil)
-	require.NoError(t, err)
-
-	signer := v4.NewSigner()
-	creds := aws.Credentials{
-		AccessKeyID:     defaultConfig.AccessKey,
-		SecretAccessKey: defaultConfig.SecretKey,
-	}
-	// For presigned URLs the AWS convention is UNSIGNED-PAYLOAD so the
-	// signer doesn't require a body-hash up front.
-	signedURL, _, err := signer.PresignHTTP(context.TODO(), creds, req,
-		"UNSIGNED-PAYLOAD", "s3", defaultConfig.Region, time.Now(),
-		func(o *v4.SignerOptions) {
-			o.DisableURIPathEscaping = true
-		})
-	require.NoError(t, err)
-	return signedURL
-}
-
-// TestPresignedPutWithChecksumSHA256 reproduces issue #9075: a presigned PUT
-// URL that carries x-amz-sdk-checksum-algorithm=SHA256 in its query string
-// must cause the object to be stored with an x-amz-checksum-sha256 attribute,
-// visible via HEAD when the caller requests ChecksumMode=ENABLED.
-func TestPresignedPutWithChecksumSHA256(t *testing.T) {
-	client := getS3Client(t)
-	bucket := uniqueBucket()
-	createBucket(t, client, bucket)
-	defer cleanupBucket(t, client, bucket)
-
-	key := "presigned-sha256.txt"
-	body := []byte("hello seaweedfs checksum")
-	sha256Sum := sha256.Sum256(body)
-	expected := base64.StdEncoding.EncodeToString(sha256Sum[:])
-
-	signedURL := presignPutURL(t, bucket, key, "SHA256")
-	uploadViaPresignedURL(t, signedURL, body, nil)
-
-	head, err := client.HeadObject(context.TODO(), &s3.HeadObjectInput{
-		Bucket:       aws.String(bucket),
-		Key:          aws.String(key),
-		ChecksumMode: types.ChecksumModeEnabled,
-	})
-	require.NoError(t, err)
-	require.NotNil(t, head.ChecksumSHA256, "x-amz-checksum-sha256 missing from HEAD response")
-	assert.Equal(t, expected, aws.ToString(head.ChecksumSHA256),
-		"stored SHA256 does not match body")
-
-	// GET with ChecksumMode=ENABLED should also return the header and the body should match.
-	getOut, err := client.GetObject(context.TODO(), &s3.GetObjectInput{
-		Bucket:       aws.String(bucket),
-		Key:          aws.String(key),
-		ChecksumMode: types.ChecksumModeEnabled,
-	})
-	require.NoError(t, err)
-	defer getOut.Body.Close()
-	require.NotNil(t, getOut.ChecksumSHA256, "x-amz-checksum-sha256 missing from GET response")
-	assert.Equal(t, expected, aws.ToString(getOut.ChecksumSHA256))
-	got, err := io.ReadAll(getOut.Body)
-	require.NoError(t, err)
-	assert.Equal(t, body, got)
-}
-
-// TestPresignedPutWithoutChecksumAlgorithm is a negative control: when the
-// caller doesn't request a checksum algorithm, HEAD should not return one.
-func TestPresignedPutWithoutChecksumAlgorithm(t *testing.T) {
-	client := getS3Client(t)
-	bucket := uniqueBucket()
-	createBucket(t, client, bucket)
-	defer cleanupBucket(t, client, bucket)
-
-	key := "presigned-nosum.txt"
-	body := []byte("no checksum requested")
-
-	signedURL := presignPutURL(t, bucket, key, "")
-	uploadViaPresignedURL(t, signedURL, body, nil)
-
-	head, err := client.HeadObject(context.TODO(), &s3.HeadObjectInput{
-		Bucket:       aws.String(bucket),
-		Key:          aws.String(key),
-		ChecksumMode: types.ChecksumModeEnabled,
-	})
-	require.NoError(t, err)
-	assert.Nil(t, head.ChecksumSHA256)
-	assert.Nil(t, head.ChecksumSHA1)
-	assert.Nil(t, head.ChecksumCRC32)
-	assert.Nil(t, head.ChecksumCRC32C)
-}
@@ -20,7 +20,6 @@ import (
 	"github.com/aws/aws-sdk-go-v2/config"
 	"github.com/aws/aws-sdk-go-v2/credentials"
 	"github.com/aws/aws-sdk-go-v2/service/s3"
-	"github.com/seaweedfs/seaweedfs/test/testutil"
 	"github.com/seaweedfs/seaweedfs/test/volume_server/framework"
 	"github.com/seaweedfs/seaweedfs/weed/cluster/lock_manager"
 	"github.com/seaweedfs/seaweedfs/weed/pb"
@@ -116,7 +115,7 @@ func startDistributedLockCluster(t *testing.T) *distributedLockCluster {
 		require.NoError(t, os.MkdirAll(dir, 0o755), "create %s", dir)
 	}

-	ports, err := testutil.AllocatePorts(12)
+	ports, err := allocatePorts(12)
 	require.NoError(t, err, "allocate ports")
 	cluster.masterPort = ports[0]
 	cluster.masterGrpcPort = ports[1]
@@ -592,6 +591,26 @@ func (c *distributedLockCluster) tailLog(name string) string {
 	return strings.Join(lines, "\n")
 }

+func allocatePorts(count int) ([]int, error) {
+	listeners := make([]net.Listener, 0, count)
+	ports := make([]int, 0, count)
+	for i := 0; i < count; i++ {
+		l, err := net.Listen("tcp", "127.0.0.1:0")
+		if err != nil {
+			for _, openListener := range listeners {
+				_ = openListener.Close()
+			}
+			return nil, err
+		}
+		listeners = append(listeners, l)
+		ports = append(ports, l.Addr().(*net.TCPAddr).Port)
+	}
+	for _, l := range listeners {
+		_ = l.Close()
+	}
+	return ports, nil
+}
+
 func stopProcess(cmd *exec.Cmd) {
 	if cmd == nil || cmd.Process == nil {
 		return
@@ -321,13 +321,6 @@ func TestIAMPolicyManagement(t *testing.T) {
 		require.NoError(t, err)
 		defer iamClient.DeleteUser(&iam.DeleteUserInput{UserName: aws.String(userName)})

-		// List user policies before any inline policy is attached
-		listResp, err := iamClient.ListUserPolicies(&iam.ListUserPoliciesInput{
-			UserName: aws.String(userName),
-		})
-		require.NoError(t, err)
-		assert.Empty(t, listResp.PolicyNames, "New user should have no inline policies")
-
 		policyName := "test-inline-policy"
 		policyDoc := `{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":"s3:GetObject","Resource":"arn:aws:s3:::*"}]}`

@@ -339,14 +332,6 @@ func TestIAMPolicyManagement(t *testing.T) {
 		})
 		require.NoError(t, err)

-		// List user policies after attaching inline policy
-		listResp, err = iamClient.ListUserPolicies(&iam.ListUserPoliciesInput{
-			UserName: aws.String(userName),
-		})
-		require.NoError(t, err)
-		assert.NotEmpty(t, listResp.PolicyNames, "User should have inline policies after PutUserPolicy")
-		assert.False(t, *listResp.IsTruncated)
-
 		// Get user policy
 		getResp, err := iamClient.GetUserPolicy(&iam.GetUserPolicyInput{
 			UserName:   aws.String(userName),
@@ -363,22 +348,5 @@ func TestIAMPolicyManagement(t *testing.T) {
 			PolicyName: aws.String(policyName),
 		})
 		require.NoError(t, err)
-
-		// List user policies after deletion
-		listResp, err = iamClient.ListUserPolicies(&iam.ListUserPoliciesInput{
-			UserName: aws.String(userName),
-		})
-		require.NoError(t, err)
-		assert.Empty(t, listResp.PolicyNames, "User should have no inline policies after DeleteUserPolicy")
-	})
-
-	t.Run("list_user_policies_nonexistent_user", func(t *testing.T) {
-		_, err := iamClient.ListUserPolicies(&iam.ListUserPoliciesInput{
-			UserName: aws.String("nonexistent-user-for-list-policies"),
-		})
-		require.Error(t, err)
-		awsErr, ok := err.(awserr.Error)
-		require.True(t, ok, "Expected AWS error type")
-		assert.Equal(t, iam.ErrCodeNoSuchEntityException, awsErr.Code())
 	})
 }
@@ -778,105 +778,6 @@ func TestIAMGroupRawAPI(t *testing.T) {
 	})
 }

-// TestIAMGroupInlinePolicy tests group inline policy operations:
-// PutGroupPolicy, GetGroupPolicy, ListGroupPolicies, DeleteGroupPolicy
-func TestIAMGroupInlinePolicy(t *testing.T) {
-	framework := NewS3IAMTestFramework(t)
-	defer framework.Cleanup()
-
-	iamClient, err := framework.CreateIAMClientWithJWT("admin-user", "TestAdminRole")
-	require.NoError(t, err)
-
-	// Skip if running against embedded IAM (which returns NotImplemented for group inline policies)
-	_, probeErr := iamClient.ListGroupPolicies(&iam.ListGroupPoliciesInput{GroupName: aws.String("probe-group-inline-support")})
-	if probeErr != nil {
-		if awsErr, ok := probeErr.(awserr.Error); ok && awsErr.Code() == "NotImplemented" {
-			t.Skip("Skipping: group inline policies not supported in embedded IAM mode")
-		}
-	}
-	require.NoError(t, err)
-
-	groupName := "test-group-inline-policy"
-	policyName := "TestInlinePolicy"
-	_, err = iamClient.CreateGroup(&iam.CreateGroupInput{
-		GroupName: aws.String(groupName),
-	})
-	require.NoError(t, err)
-	defer func() {
-		// Clean up inline policies before deleting the group
-		iamClient.DeleteGroupPolicy(&iam.DeleteGroupPolicyInput{
-			GroupName:  aws.String(groupName),
-			PolicyName: aws.String(policyName),
-		})
-		iamClient.DeleteGroup(&iam.DeleteGroupInput{GroupName: aws.String(groupName)})
-	}()
-
-	t.Run("list_empty", func(t *testing.T) {
-		resp, err := iamClient.ListGroupPolicies(&iam.ListGroupPoliciesInput{
-			GroupName: aws.String(groupName),
-		})
-		require.NoError(t, err)
-		assert.Empty(t, resp.PolicyNames)
-		assert.False(t, *resp.IsTruncated)
-	})
-
-	policyDoc := `{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":"s3:GetObject","Resource":"arn:aws:s3:::test-bucket/*"}]}`
-
-	t.Run("put_group_policy", func(t *testing.T) {
-		_, err := iamClient.PutGroupPolicy(&iam.PutGroupPolicyInput{
-			GroupName:      aws.String(groupName),
-			PolicyName:     aws.String(policyName),
-			PolicyDocument: aws.String(policyDoc),
-		})
-		require.NoError(t, err)
-	})
-
-	t.Run("list_after_put", func(t *testing.T) {
-		resp, err := iamClient.ListGroupPolicies(&iam.ListGroupPoliciesInput{
-			GroupName: aws.String(groupName),
-		})
-		require.NoError(t, err)
-		assert.NotEmpty(t, resp.PolicyNames)
-	})
-
-	t.Run("get_group_policy", func(t *testing.T) {
-		resp, err := iamClient.GetGroupPolicy(&iam.GetGroupPolicyInput{
-			GroupName:  aws.String(groupName),
-			PolicyName: aws.String(policyName),
-		})
-		require.NoError(t, err)
-		assert.Equal(t, groupName, *resp.GroupName)
-		assert.Equal(t, policyName, *resp.PolicyName)
-		assert.Contains(t, *resp.PolicyDocument, "s3:GetObject")
-	})
-
-	t.Run("delete_group_policy", func(t *testing.T) {
-		_, err := iamClient.DeleteGroupPolicy(&iam.DeleteGroupPolicyInput{
-			GroupName:  aws.String(groupName),
-			PolicyName: aws.String(policyName),
-		})
-		require.NoError(t, err)
-	})
-
-	t.Run("list_after_delete", func(t *testing.T) {
-		resp, err := iamClient.ListGroupPolicies(&iam.ListGroupPoliciesInput{
-			GroupName: aws.String(groupName),
-		})
-		require.NoError(t, err)
-		assert.Empty(t, resp.PolicyNames)
-	})
-
-	t.Run("nonexistent_group", func(t *testing.T) {
-		_, err := iamClient.ListGroupPolicies(&iam.ListGroupPoliciesInput{
-			GroupName: aws.String("nonexistent-group-for-policies"),
-		})
-		require.Error(t, err)
-		awsErr, ok := err.(awserr.Error)
-		require.True(t, ok, "Expected AWS error type")
-		assert.Equal(t, iam.ErrCodeNoSuchEntityException, awsErr.Code())
-	})
-}
-
 // createS3Client creates an S3 client with static credentials
 func createS3Client(t *testing.T, accessKey, secretKey string) *s3.S3 {
 	sess, err := session.NewSession(&aws.Config{
@@ -7,6 +7,7 @@ import (
 	"encoding/base64"
 	"fmt"
 	"math/rand"
+	"net"
 	"net/http"
 	"os"
 	"os/exec"
@@ -24,7 +25,6 @@ import (
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"

-	"github.com/seaweedfs/seaweedfs/test/testutil"
 	"github.com/seaweedfs/seaweedfs/test/volume_server/framework"
 	"github.com/seaweedfs/seaweedfs/weed/command"
 	"github.com/seaweedfs/seaweedfs/weed/glog"
@@ -39,19 +39,19 @@ const (

 // TestCluster manages the weed mini instance for integration testing
 type TestCluster struct {
-	dataDir       string
-	ctx           context.Context
-	cancel        context.CancelFunc
-	s3Client      *s3.S3
-	isRunning     bool
-	startOnce     sync.Once
-	wg            sync.WaitGroup
-	masterPort    int
-	volumePort    int
-	filerPort     int
-	s3Port        int
-	s3Endpoint    string
-	rustVolumeCmd *exec.Cmd
+	dataDir        string
+	ctx            context.Context
+	cancel         context.CancelFunc
+	s3Client       *s3.S3
+	isRunning      bool
+	startOnce      sync.Once
+	wg             sync.WaitGroup
+	masterPort     int
+	volumePort     int
+	filerPort      int
+	s3Port         int
+	s3Endpoint     string
+	rustVolumeCmd  *exec.Cmd
 }

 // TestS3Integration demonstrates basic S3 operations against a running weed mini instance
@@ -112,16 +112,37 @@ func TestS3Integration(t *testing.T) {
 }

 // findAvailablePort finds an available port by binding to port 0
+func findAvailablePort() (int, error) {
+	listener, err := net.Listen("tcp", "127.0.0.1:0")
+	if err != nil {
+		return 0, err
+	}
+	defer listener.Close()
+
+	addr := listener.Addr().(*net.TCPAddr)
+	return addr.Port, nil
+}

 // startMiniCluster starts a weed mini instance directly without exec.
 // Extra flags (e.g. "-s3.allowDeleteBucketNotEmpty=false") can be appended via extraArgs.
 func startMiniCluster(t *testing.T, extraArgs ...string) (*TestCluster, error) {
-	// Allocate non-colliding ports (including gRPC offsets) for weed mini.
-	ports := testutil.MustFreeMiniPorts(t, []string{"Master", "Volume", "Filer", "S3"})
-	masterPort := ports[0]
-	volumePort := ports[1]
-	filerPort := ports[2]
-	s3Port := ports[3]
+	// Find available ports
+	masterPort, err := findAvailablePort()
+	if err != nil {
+		return nil, fmt.Errorf("failed to find master port: %v", err)
+	}
+	volumePort, err := findAvailablePort()
+	if err != nil {
+		return nil, fmt.Errorf("failed to find volume port: %v", err)
+	}
+	filerPort, err := findAvailablePort()
+	if err != nil {
+		return nil, fmt.Errorf("failed to find filer port: %v", err)
+	}
+	s3Port, err := findAvailablePort()
+	if err != nil {
+		return nil, fmt.Errorf("failed to find s3 port: %v", err)
+	}
 	// Create temporary directory for test data
 	testDir := t.TempDir()

@@ -146,7 +167,7 @@ func startMiniCluster(t *testing.T, extraArgs ...string) (*TestCluster, error) {

 	// Create empty security.toml to disable JWT authentication in tests
 	securityToml := filepath.Join(testDir, "security.toml")
-	err := os.WriteFile(securityToml, []byte("# Empty security config for testing\n"), 0644)
+	err = os.WriteFile(securityToml, []byte("# Empty security config for testing\n"), 0644)
 	if err != nil {
 		cancel()
 		return nil, fmt.Errorf("failed to create security.toml: %v", err)
@@ -212,9 +233,10 @@ func startMiniCluster(t *testing.T, extraArgs ...string) (*TestCluster, error) {
 	}()

 	// Wait for S3 service to be ready
-	if !testutil.WaitForService(cluster.s3Endpoint, 30*time.Second) {
+	err = waitForS3Ready(cluster.s3Endpoint, 30*time.Second)
+	if err != nil {
 		cancel()
-		return nil, fmt.Errorf("S3 service failed to start at %s", cluster.s3Endpoint)
+		return nil, fmt.Errorf("S3 service failed to start: %v", err)
 	}

 	// If VOLUME_SERVER_IMPL=rust, start a Rust volume server alongside weed mini
@@ -255,12 +277,14 @@ func (c *TestCluster) startRustVolumeServer(t *testing.T) error {
 		return fmt.Errorf("resolve rust volume binary: %v", err)
 	}

-	rustPorts, err := testutil.AllocatePorts(2)
+	rustVolumePort, err := findAvailablePort()
 	if err != nil {
-		return fmt.Errorf("find rust volume ports: %v", err)
+		return fmt.Errorf("find rust volume port: %v", err)
+	}
+	rustVolumeGrpcPort, err := findAvailablePort()
+	if err != nil {
+		return fmt.Errorf("find rust volume grpc port: %v", err)
 	}
-	rustVolumePort := rustPorts[0]
-	rustVolumeGrpcPort := rustPorts[1]

 	rustVolumeDir := filepath.Join(c.dataDir, "rust-volume")
 	if err := os.MkdirAll(rustVolumeDir, 0o755); err != nil {
@@ -353,6 +377,25 @@ func (c *TestCluster) Stop() {
 	}
 }

+// waitForS3Ready waits for the S3 service to be ready
+func waitForS3Ready(endpoint string, timeout time.Duration) error {
+	client := &http.Client{Timeout: 1 * time.Second}
+	deadline := time.Now().Add(timeout)
+
+	for time.Now().Before(deadline) {
+		resp, err := client.Get(endpoint)
+		if err == nil {
+			resp.Body.Close()
+			// Wait a bit more to ensure service is fully ready
+			time.Sleep(500 * time.Millisecond)
+			return nil
+		}
+		time.Sleep(200 * time.Millisecond)
+	}
+
+	return fmt.Errorf("timeout waiting for S3 service at %s", endpoint)
+}
+
 // Test functions

 func testCreateBucket(t *testing.T, cluster *TestCluster) {
@@ -317,3 +317,4 @@ func hasKey(policy map[string]interface{}, key string) bool {

 	return false
 }
+
@@ -4,6 +4,7 @@ import (
 	"context"
 	"errors"
 	"fmt"
+	"net"
 	"net/http"
 	"os"
 	"os/exec"
@@ -20,7 +21,6 @@ import (
 	"github.com/aws/aws-sdk-go/aws/session"
 	"github.com/aws/aws-sdk-go/service/iam"
 	"github.com/aws/aws-sdk-go/service/s3"
-	"github.com/seaweedfs/seaweedfs/test/testutil"
 	"github.com/seaweedfs/seaweedfs/test/volume_server/framework"
 	"github.com/seaweedfs/seaweedfs/weed/command"
 	"github.com/seaweedfs/seaweedfs/weed/glog"
@@ -703,12 +703,43 @@ func uniqueName(prefix string) string {

 // --- Test setup helpers ---

+func findAvailablePort() (int, error) {
+	listener, err := net.Listen("tcp", "127.0.0.1:0")
+	if err != nil {
+		return 0, err
+	}
+	defer listener.Close()
+	addr := listener.Addr().(*net.TCPAddr)
+	return addr.Port, nil
+}
+
+// findAvailablePortPair finds an available http port P such that P and P+10000 (grpc) are both available
+func findAvailablePortPair() (int, int, error) {
+	httpPort, err := findAvailablePort()
+	if err != nil {
+		return 0, 0, err
+	}
+	for i := 0; i < 100; i++ {
+		grpcPort, err := findAvailablePort()
+		if err != nil {
+			return 0, 0, err
+		}
+		if grpcPort != httpPort {
+			return httpPort, grpcPort, nil
+		}
+	}
+	return 0, 0, fmt.Errorf("failed to find available port pair")
+}
+
 func startMiniCluster(t *testing.T) (*TestCluster, error) {
-	ports := testutil.MustAllocatePorts(t, 8)
-	masterPort, masterGrpcPort := ports[0], ports[1]
-	volumePort, volumeGrpcPort := ports[2], ports[3]
-	filerPort, filerGrpcPort := ports[4], ports[5]
-	s3Port, s3GrpcPort := ports[6], ports[7]
+	masterPort, masterGrpcPort, err := findAvailablePortPair()
+	require.NoError(t, err)
+	volumePort, volumeGrpcPort, err := findAvailablePortPair()
+	require.NoError(t, err)
+	filerPort, filerGrpcPort, err := findAvailablePortPair()
+	require.NoError(t, err)
+	s3Port, s3GrpcPort, err := findAvailablePortPair()
+	require.NoError(t, err)

 	testDir := t.TempDir()

@@ -729,15 +760,13 @@ func startMiniCluster(t *testing.T) (*TestCluster, error) {

 	// Disable authentication for tests
 	securityToml := filepath.Join(testDir, "security.toml")
-	err := os.WriteFile(securityToml, []byte("# Empty security config\n"), 0644)
+	err = os.WriteFile(securityToml, []byte("# Empty security config\n"), 0644)
 	require.NoError(t, err)

-	// Configure credential store for IAM tests.
-	// Use filer_etc instead of memory because the memory store does not
-	// persist groups or service accounts through LoadConfiguration/SaveConfiguration.
+	// Configure credential store for IAM tests
 	credentialToml := filepath.Join(testDir, "credential.toml")
 	credentialConfig := `
-[credential.filer_etc]
+[credential.memory]
 enabled = true
 `
 	err = os.WriteFile(credentialToml, []byte(credentialConfig), 0644)
@@ -790,9 +819,10 @@ enabled = true
 	}()

 	// Wait for S3
-	if !testutil.WaitForService(cluster.s3Endpoint, 60*time.Second) {
+	err = waitForS3Ready(cluster.s3Endpoint, 60*time.Second)
+	if err != nil {
 		cancel()
-		return nil, fmt.Errorf("timeout waiting for S3 at %s", cluster.s3Endpoint)
+		return nil, err
 	}

 	// If VOLUME_SERVER_IMPL=rust, start a Rust volume server alongside weed mini
@@ -807,6 +837,20 @@ enabled = true
 	return cluster, nil
 }

+func waitForS3Ready(endpoint string, timeout time.Duration) error {
+	client := &http.Client{Timeout: 1 * time.Second}
+	deadline := time.Now().Add(timeout)
+	for time.Now().Before(deadline) {
+		resp, err := client.Get(endpoint)
+		if err == nil {
+			resp.Body.Close()
+			return nil
+		}
+		time.Sleep(200 * time.Millisecond)
+	}
+	return fmt.Errorf("timeout waiting for S3")
+}
+
 // startRustVolumeServer starts a Rust volume server that registers with the same master.
 func (c *TestCluster) startRustVolumeServer(t *testing.T) error {
 	t.Helper()
@@ -816,12 +860,14 @@ func (c *TestCluster) startRustVolumeServer(t *testing.T) error {
 		return fmt.Errorf("resolve rust volume binary: %v", err)
 	}

-	rustPorts, err := testutil.AllocatePorts(2)
+	rustVolumePort, err := findAvailablePort()
 	if err != nil {
-		return fmt.Errorf("find rust volume ports: %v", err)
+		return fmt.Errorf("find rust volume port: %v", err)
+	}
+	rustVolumeGrpcPort, err := findAvailablePort()
+	if err != nil {
+		return fmt.Errorf("find rust volume grpc port: %v", err)
 	}
-	rustVolumePort := rustPorts[0]
-	rustVolumeGrpcPort := rustPorts[1]

 	rustVolumeDir := filepath.Join(c.dataDir, "rust-volume")
 	if err := os.MkdirAll(rustVolumeDir, 0o755); err != nil {
@@ -1,75 +0,0 @@
-package policy
-
-import (
-	"fmt"
-	"testing"
-
-	"github.com/seaweedfs/seaweedfs/weed/pb"
-	"github.com/stretchr/testify/require"
-)
-
-// TestShellAccessKeyLifecycle exercises s3.accesskey.* commands end-to-end.
-func TestShellAccessKeyLifecycle(t *testing.T) {
-	if testing.Short() {
-		t.Skip("Skipping integration test in short mode")
-	}
-	cluster, err := startMiniCluster(t)
-	require.NoError(t, err)
-	defer cluster.Stop()
-
-	const weedCmd = "weed"
-	master := string(pb.NewServerAddress("127.0.0.1", cluster.masterPort, cluster.masterGrpcPort))
-	filer := string(pb.NewServerAddress("127.0.0.1", cluster.filerPort, cluster.filerGrpcPort))
-
-	userName := uniqueName("akuser")
-	// Create user with explicit key so we know the initial value.
-	initialAK := "INITIALAK1234567890X"
-	initialSK := "initialsecret1234567890abcdefghijklmnop"
-	execShell(t, weedCmd, master, filer,
-		fmt.Sprintf("s3.user.create -name %s -access_key %s -secret_key %s", userName, initialAK, initialSK))
-	defer execShell(t, weedCmd, master, filer, fmt.Sprintf("s3.user.delete -name %s", userName))
-
-	t.Run("ListInitialKey", func(t *testing.T) {
-		out := execShell(t, weedCmd, master, filer, fmt.Sprintf("s3.accesskey.list -user %s", userName))
-		requireContains(t, out, initialAK, "accesskey.list initial")
-	})
-
-	var createdAK string
-	t.Run("CreateAdditionalKey", func(t *testing.T) {
-		out := execShell(t, weedCmd, master, filer, fmt.Sprintf("s3.accesskey.create -user %s", userName))
-		requireContains(t, out, "Access Key:", "accesskey.create output")
-		requireContains(t, out, "Secret Key:", "accesskey.create output")
-		createdAK = extractFieldAfter(out, "Access Key:")
-		if createdAK == "" {
-			t.Fatalf("failed to extract access key from create output:\n%s", out)
-		}
-
-		out = execShell(t, weedCmd, master, filer, fmt.Sprintf("s3.accesskey.list -user %s", userName))
-		requireContains(t, out, initialAK, "list contains original")
-		requireContains(t, out, createdAK, "list contains new key")
-	})
-
-	t.Run("RotateKey", func(t *testing.T) {
-		if createdAK == "" {
-			t.Fatal("createdAK is empty; CreateAdditionalKey must run successfully first")
-		}
-		out := execShell(t, weedCmd, master, filer,
-			fmt.Sprintf("s3.accesskey.rotate -user %s -access_key %s", userName, initialAK))
-		requireContains(t, out, initialAK, "rotate shows old key")
-		requireContains(t, out, "deleted", "rotate marks old key deleted")
-
-		out = execShell(t, weedCmd, master, filer, fmt.Sprintf("s3.accesskey.list -user %s", userName))
-		requireNotContains(t, out, initialAK, "old key removed")
-		requireContains(t, out, createdAK, "other key still present")
-	})
-
-	t.Run("DeleteKey", func(t *testing.T) {
-		if createdAK == "" {
-			t.Fatal("createdAK is empty; CreateAdditionalKey must run successfully first")
-		}
-		execShell(t, weedCmd, master, filer,
-			fmt.Sprintf("s3.accesskey.delete -user %s -access_key %s", userName, createdAK))
-		out := execShell(t, weedCmd, master, filer, fmt.Sprintf("s3.accesskey.list -user %s", userName))
-		requireNotContains(t, out, createdAK, "deleted key removed from list")
-	})
-}
@@ -1,54 +0,0 @@
-package policy
-
-import (
-	"fmt"
-	"testing"
-
-	"github.com/seaweedfs/seaweedfs/weed/pb"
-	"github.com/stretchr/testify/require"
-)
-
-// TestShellAnonymousAccess exercises s3.anonymous.* commands end-to-end.
-func TestShellAnonymousAccess(t *testing.T) {
-	if testing.Short() {
-		t.Skip("Skipping integration test in short mode")
-	}
-	cluster, err := startMiniCluster(t)
-	require.NoError(t, err)
-	defer cluster.Stop()
-
-	const weedCmd = "weed"
-	master := string(pb.NewServerAddress("127.0.0.1", cluster.masterPort, cluster.masterGrpcPort))
-	filer := string(pb.NewServerAddress("127.0.0.1", cluster.filerPort, cluster.filerGrpcPort))
-
-	bucketName := uniqueName("anon-bkt")
-	execShell(t, weedCmd, master, filer, fmt.Sprintf("s3.bucket.create -name %s", bucketName))
-	defer execShell(t, weedCmd, master, filer, fmt.Sprintf("s3.bucket.delete -name %s", bucketName))
-
-	t.Run("SetAndGet", func(t *testing.T) {
-		out := execShell(t, weedCmd, master, filer,
-			fmt.Sprintf("s3.anonymous.set -bucket %s -access Read,List", bucketName))
-		requireContains(t, out, bucketName, "anonymous.set output")
-
-		out = execShell(t, weedCmd, master, filer, fmt.Sprintf("s3.anonymous.get -bucket %s", bucketName))
-		requireContains(t, out, bucketName, "anonymous.get bucket")
-		requireContains(t, out, "Read", "anonymous.get read action")
-		requireContains(t, out, "List", "anonymous.get list action")
-	})
-
-	t.Run("List", func(t *testing.T) {
-		out := execShell(t, weedCmd, master, filer, "s3.anonymous.list")
-		requireContains(t, out, bucketName, "anonymous.list contains bucket")
-	})
-
-	t.Run("SetNone", func(t *testing.T) {
-		execShell(t, weedCmd, master, filer,
-			fmt.Sprintf("s3.anonymous.set -bucket %s -access none", bucketName))
-
-		out := execShell(t, weedCmd, master, filer, fmt.Sprintf("s3.anonymous.get -bucket %s", bucketName))
-		requireContains(t, out, "none", "anonymous.get after set none")
-
-		out = execShell(t, weedCmd, master, filer, "s3.anonymous.list")
-		requireNotContains(t, out, bucketName, "anonymous.list after clearing")
-	})
-}
@@ -1,128 +0,0 @@
-package policy
-
-import (
-	"fmt"
-	"testing"
-
-	"github.com/seaweedfs/seaweedfs/weed/pb"
-	"github.com/stretchr/testify/require"
-)
-
-// TestShellBucketLifecycle exercises s3.bucket.* commands end-to-end:
-// create/list/delete, owner, quota, versioning, lock, quota.enforce.
-func TestShellBucketLifecycle(t *testing.T) {
-	if testing.Short() {
-		t.Skip("Skipping integration test in short mode")
-	}
-	cluster, err := startMiniCluster(t)
-	require.NoError(t, err)
-	defer cluster.Stop()
-
-	const weedCmd = "weed"
-	master := string(pb.NewServerAddress("127.0.0.1", cluster.masterPort, cluster.masterGrpcPort))
-	filer := string(pb.NewServerAddress("127.0.0.1", cluster.filerPort, cluster.filerGrpcPort))
-
-	t.Run("CreateListDelete", func(t *testing.T) {
-		bucketName := uniqueName("bkt")
-		out := execShell(t, weedCmd, master, filer, fmt.Sprintf("s3.bucket.create -name %s", bucketName))
-		requireContains(t, out, bucketName, "bucket.create output")
-
-		out = execShell(t, weedCmd, master, filer, "s3.bucket.list")
-		requireContains(t, out, bucketName, "bucket.list contains created")
-
-		execShell(t, weedCmd, master, filer, fmt.Sprintf("s3.bucket.delete -name %s", bucketName))
-
-		out = execShell(t, weedCmd, master, filer, "s3.bucket.list")
-		requireNotContains(t, out, bucketName, "bucket.list after delete")
-	})
-
-	t.Run("Owner", func(t *testing.T) {
-		bucketName := uniqueName("bkt-own")
-		ownerName := uniqueName("owner")
-		execShell(t, weedCmd, master, filer, fmt.Sprintf("s3.user.create -name %s", ownerName))
-		defer execShell(t, weedCmd, master, filer, fmt.Sprintf("s3.user.delete -name %s", ownerName))
-
-		execShell(t, weedCmd, master, filer, fmt.Sprintf("s3.bucket.create -name %s", bucketName))
-		defer execShell(t, weedCmd, master, filer, fmt.Sprintf("s3.bucket.delete -name %s", bucketName))
-
-		// Initially no owner.
-		out := execShell(t, weedCmd, master, filer, fmt.Sprintf("s3.bucket.owner -name %s", bucketName))
-		requireContains(t, out, "none", "initial owner none")
-
-		// Set owner.
-		execShell(t, weedCmd, master, filer,
-			fmt.Sprintf("s3.bucket.owner -name %s -owner %s", bucketName, ownerName))
-		out = execShell(t, weedCmd, master, filer, fmt.Sprintf("s3.bucket.owner -name %s", bucketName))
-		requireContains(t, out, ownerName, "owner set")
-
-		// Remove owner.
-		execShell(t, weedCmd, master, filer, fmt.Sprintf("s3.bucket.owner -name %s -delete", bucketName))
-		out = execShell(t, weedCmd, master, filer, fmt.Sprintf("s3.bucket.owner -name %s", bucketName))
-		requireContains(t, out, "none", "owner removed")
-	})
-
-	t.Run("Quota", func(t *testing.T) {
-		bucketName := uniqueName("bkt-quota")
-		execShell(t, weedCmd, master, filer, fmt.Sprintf("s3.bucket.create -name %s", bucketName))
-		defer execShell(t, weedCmd, master, filer, fmt.Sprintf("s3.bucket.delete -name %s", bucketName))
-
-		execShell(t, weedCmd, master, filer,
-			fmt.Sprintf("s3.bucket.quota -name %s -op=set -sizeMB=1024", bucketName))
-
-		out := execShell(t, weedCmd, master, filer, fmt.Sprintf("s3.bucket.quota -name %s -op=get", bucketName))
-		requireContains(t, out, "1024", "quota.get shows size")
-
-		execShell(t, weedCmd, master, filer, fmt.Sprintf("s3.bucket.quota -name %s -op=disable", bucketName))
-		execShell(t, weedCmd, master, filer, fmt.Sprintf("s3.bucket.quota -name %s -op=enable", bucketName))
-
-		// Enforce should run on an empty bucket without error.
-		execShell(t, weedCmd, master, filer, "s3.bucket.quota.enforce -apply")
-
-		execShell(t, weedCmd, master, filer, fmt.Sprintf("s3.bucket.quota -name %s -op=remove", bucketName))
-	})
-
-	t.Run("Versioning", func(t *testing.T) {
-		bucketName := uniqueName("bkt-ver")
-		execShell(t, weedCmd, master, filer, fmt.Sprintf("s3.bucket.create -name %s", bucketName))
-		defer execShell(t, weedCmd, master, filer, fmt.Sprintf("s3.bucket.delete -name %s", bucketName))
-
-		execShell(t, weedCmd, master, filer, fmt.Sprintf("s3.bucket.versioning -name %s -enable", bucketName))
-		out := execShell(t, weedCmd, master, filer, fmt.Sprintf("s3.bucket.versioning -name %s", bucketName))
-		requireContains(t, out, "Enabled", "versioning enabled")
-
-		execShell(t, weedCmd, master, filer, fmt.Sprintf("s3.bucket.versioning -name %s -suspend", bucketName))
-		out = execShell(t, weedCmd, master, filer, fmt.Sprintf("s3.bucket.versioning -name %s", bucketName))
-		requireContains(t, out, "Suspended", "versioning suspended")
-	})
-
-	t.Run("Lock", func(t *testing.T) {
-		bucketName := uniqueName("bkt-lock")
-		execShell(t, weedCmd, master, filer, fmt.Sprintf("s3.bucket.create -name %s", bucketName))
-		defer execShell(t, weedCmd, master, filer, fmt.Sprintf("s3.bucket.delete -name %s", bucketName))
-
-		out := execShell(t, weedCmd, master, filer, fmt.Sprintf("s3.bucket.lock -name %s", bucketName))
-		requireContains(t, out, "Disabled", "lock initially disabled")
-
-		execShell(t, weedCmd, master, filer, fmt.Sprintf("s3.bucket.lock -name %s -enable", bucketName))
-
-		out = execShell(t, weedCmd, master, filer, fmt.Sprintf("s3.bucket.lock -name %s", bucketName))
-		requireContains(t, out, "Enabled", "lock enabled")
-
-		// Versioning should have been auto-enabled.
-		out = execShell(t, weedCmd, master, filer, fmt.Sprintf("s3.bucket.versioning -name %s", bucketName))
-		requireContains(t, out, "Enabled", "versioning auto-enabled by lock")
-	})
-
-	t.Run("CreateWithLock", func(t *testing.T) {
-		bucketName := uniqueName("bkt-wlock")
-		out := execShell(t, weedCmd, master, filer,
-			fmt.Sprintf("s3.bucket.create -name %s -withLock", bucketName))
-		// Cleanup may fail if the bucket contains locked objects; we created none.
-		defer execShell(t, weedCmd, master, filer, fmt.Sprintf("s3.bucket.delete -name %s", bucketName))
-
-		requireContains(t, out, "Object Lock", "create -withLock output")
-
-		out = execShell(t, weedCmd, master, filer, fmt.Sprintf("s3.bucket.lock -name %s", bucketName))
-		requireContains(t, out, "Enabled", "lock enabled after create -withLock")
-	})
-}
@@ -1,86 +0,0 @@
-package policy
-
-import (
-	"fmt"
-	"os"
-	"path/filepath"
-	"testing"
-
-	"github.com/seaweedfs/seaweedfs/weed/pb"
-	"github.com/stretchr/testify/require"
-)
-
-// TestShellConfigShow verifies s3.config.show outputs a summary of IAM config.
-func TestShellConfigShow(t *testing.T) {
-	if testing.Short() {
-		t.Skip("Skipping integration test in short mode")
-	}
-	cluster, err := startMiniCluster(t)
-	require.NoError(t, err)
-	defer cluster.Stop()
-
-	const weedCmd = "weed"
-	master := string(pb.NewServerAddress("127.0.0.1", cluster.masterPort, cluster.masterGrpcPort))
-	filer := string(pb.NewServerAddress("127.0.0.1", cluster.filerPort, cluster.filerGrpcPort))
-
-	userName := uniqueName("cfg-user")
-	groupName := uniqueName("cfg-grp")
-	execShell(t, weedCmd, master, filer, fmt.Sprintf("s3.user.create -name %s", userName))
-	defer execShell(t, weedCmd, master, filer, fmt.Sprintf("s3.user.delete -name %s", userName))
-	execShell(t, weedCmd, master, filer, fmt.Sprintf("s3.group.create -name %s", groupName))
-	defer execShell(t, weedCmd, master, filer, fmt.Sprintf("s3.group.delete -name %s", groupName))
-
-	out := execShell(t, weedCmd, master, filer, "s3.config.show")
-	requireContains(t, out, "S3 IAM Configuration Summary", "config.show header")
-	requireContains(t, out, userName, "config.show contains user")
-	requireContains(t, out, groupName, "config.show contains group")
-}
-
-// TestShellIAMExportImport does a roundtrip: create resources, export, delete, import, verify.
-func TestShellIAMExportImport(t *testing.T) {
-	if testing.Short() {
-		t.Skip("Skipping integration test in short mode")
-	}
-	cluster, err := startMiniCluster(t)
-	require.NoError(t, err)
-	defer cluster.Stop()
-
-	const weedCmd = "weed"
-	master := string(pb.NewServerAddress("127.0.0.1", cluster.masterPort, cluster.masterGrpcPort))
-	filer := string(pb.NewServerAddress("127.0.0.1", cluster.filerPort, cluster.filerGrpcPort))
-
-	userName := uniqueName("exp-user")
-	groupName := uniqueName("exp-grp")
-	execShell(t, weedCmd, master, filer, fmt.Sprintf("s3.user.create -name %s", userName))
-	execShell(t, weedCmd, master, filer, fmt.Sprintf("s3.group.create -name %s", groupName))
-
-	exportFile := filepath.Join(t.TempDir(), "iam_export.txt")
-	execShell(t, weedCmd, master, filer, fmt.Sprintf("s3.iam.export -file %s", exportFile))
-
-	data, err := os.ReadFile(exportFile)
-	require.NoError(t, err)
-	content := string(data)
-	requireContains(t, content, userName, "export file contains user")
-	requireContains(t, content, groupName, "export file contains group")
-
-	// Delete the resources.
-	execShell(t, weedCmd, master, filer, fmt.Sprintf("s3.user.delete -name %s", userName))
-	execShell(t, weedCmd, master, filer, fmt.Sprintf("s3.group.delete -name %s", groupName))
-
-	out := execShell(t, weedCmd, master, filer, "s3.user.list")
-	requireNotContains(t, out, userName, "user gone before import")
-
-	// Import.
-	out = execShell(t, weedCmd, master, filer, fmt.Sprintf("s3.iam.import -file %s -apply", exportFile))
-	requireContains(t, out, "Imported IAM configuration", "import output")
-
-	// Verify resources restored.
-	out = execShell(t, weedCmd, master, filer, "s3.user.list")
-	requireContains(t, out, userName, "user restored after import")
-	out = execShell(t, weedCmd, master, filer, "s3.group.list")
-	requireContains(t, out, groupName, "group restored after import")
-
-	// Cleanup.
-	execShell(t, weedCmd, master, filer, fmt.Sprintf("s3.user.delete -name %s", userName))
-	execShell(t, weedCmd, master, filer, fmt.Sprintf("s3.group.delete -name %s", groupName))
-}
@@ -1,62 +0,0 @@
-package policy
-
-import (
-	"fmt"
-	"testing"
-
-	"github.com/seaweedfs/seaweedfs/weed/pb"
-	"github.com/stretchr/testify/require"
-)
-
-// TestShellGroupLifecycle exercises s3.group.* commands end-to-end.
-func TestShellGroupLifecycle(t *testing.T) {
-	if testing.Short() {
-		t.Skip("Skipping integration test in short mode")
-	}
-	cluster, err := startMiniCluster(t)
-	require.NoError(t, err)
-	defer cluster.Stop()
-
-	const weedCmd = "weed"
-	master := string(pb.NewServerAddress("127.0.0.1", cluster.masterPort, cluster.masterGrpcPort))
-	filer := string(pb.NewServerAddress("127.0.0.1", cluster.filerPort, cluster.filerGrpcPort))
-
-	groupName := uniqueName("grp")
-	userName := uniqueName("grpuser")
-
-	execShell(t, weedCmd, master, filer, fmt.Sprintf("s3.user.create -name %s", userName))
-	defer execShell(t, weedCmd, master, filer, fmt.Sprintf("s3.user.delete -name %s", userName))
-
-	t.Run("CreateShowList", func(t *testing.T) {
-		out := execShell(t, weedCmd, master, filer, fmt.Sprintf("s3.group.create -name %s", groupName))
-		requireContains(t, out, groupName, "group.create output")
-
-		out = execShell(t, weedCmd, master, filer, fmt.Sprintf("s3.group.show -name %s", groupName))
-		requireContains(t, out, groupName, "group.show output")
-
-		out = execShell(t, weedCmd, master, filer, "s3.group.list")
-		requireContains(t, out, groupName, "group.list")
-	})
-
-	t.Run("AddRemoveUser", func(t *testing.T) {
-		out := execShell(t, weedCmd, master, filer,
-			fmt.Sprintf("s3.group.add-user -group %s -user %s", groupName, userName))
-		requireContains(t, out, userName, "group.add-user output")
-
-		out = execShell(t, weedCmd, master, filer, fmt.Sprintf("s3.group.show -name %s", groupName))
-		requireContains(t, out, userName, "group.show after add")
-
-		out = execShell(t, weedCmd, master, filer,
-			fmt.Sprintf("s3.group.remove-user -group %s -user %s", groupName, userName))
-		requireContains(t, out, userName, "group.remove-user output")
-
-		out = execShell(t, weedCmd, master, filer, fmt.Sprintf("s3.group.show -name %s", groupName))
-		requireNotContains(t, out, fmt.Sprintf("\"%s\"", userName), "group.show after remove")
-	})
-
-	t.Run("Delete", func(t *testing.T) {
-		execShell(t, weedCmd, master, filer, fmt.Sprintf("s3.group.delete -name %s", groupName))
-		out := execShell(t, weedCmd, master, filer, "s3.group.list")
-		requireNotContains(t, out, fmt.Sprintf("\"%s\"", groupName), "group.list after delete")
-	})
-}
@@ -1,73 +0,0 @@
-package policy
-
-import (
-	"strings"
-	"testing"
-)
-
-// requireContains fails the test if substr is not found in output.
-func requireContains(t *testing.T, output, substr, context string) {
-	t.Helper()
-	if !strings.Contains(output, substr) {
-		t.Fatalf("%s: expected output to contain %q\n--- output ---\n%s\n--- end ---", context, substr, output)
-	}
-}
-
-// requireNotContains fails the test if substr IS found in output.
-func requireNotContains(t *testing.T, output, substr, context string) {
-	t.Helper()
-	if strings.Contains(output, substr) {
-		t.Fatalf("%s: expected output to NOT contain %q\n--- output ---\n%s\n--- end ---", context, substr, output)
-	}
-}
-
-// extractFieldAfter returns the first occurrence of the value after a "Prefix: " line.
-// Example: extractFieldAfter(out, "Access Key:") -> "AKIAXXXX..."
-// Returns "" if not found.
-func extractFieldAfter(output, prefix string) string {
-	for _, line := range strings.Split(output, "\n") {
-		line = strings.TrimSpace(line)
-		if strings.HasPrefix(line, prefix) {
-			return strings.TrimSpace(strings.TrimPrefix(line, prefix))
-		}
-	}
-	return ""
-}
-
-// splitLines splits output into trimmed non-empty lines.
-func splitLines(output string) []string {
-	var lines []string
-	for _, line := range strings.Split(output, "\n") {
-		if trimmed := strings.TrimSpace(line); trimmed != "" {
-			lines = append(lines, trimmed)
-		}
-	}
-	return lines
-}
-
-// fieldsOf splits a line on whitespace.
-func fieldsOf(line string) []string {
-	return strings.Fields(line)
-}
-
-// extractServiceAccountID parses the tab-separated output of `s3.serviceaccount.list`
-// and returns the ID of the first row whose PARENT column matches parentUser.
-// The list output format is:
-//
-//	ID                                         PARENT     STATUS    DESCRIPTION
-//	sa:user-yyy:a1b2c3d4e5f6...                user-yyy   enabled   some desc
-func extractServiceAccountID(t *testing.T, listOutput, parentUser string) string {
-	t.Helper()
-	for _, line := range strings.Split(listOutput, "\n") {
-		line = strings.TrimSpace(line)
-		if line == "" || strings.HasPrefix(line, "ID") || strings.HasPrefix(line, "No service accounts") {
-			continue
-		}
-		fields := strings.Fields(line)
-		if len(fields) >= 2 && fields[1] == parentUser {
-			return fields[0]
-		}
-	}
-	t.Fatalf("could not find service account with parent=%q in output:\n%s", parentUser, listOutput)
-	return ""
-}
@@ -1,67 +0,0 @@
-package policy
-
-import (
-	"fmt"
-	"os"
-	"testing"
-
-	"github.com/seaweedfs/seaweedfs/weed/pb"
-	"github.com/stretchr/testify/require"
-)
-
-// TestShellPolicyAttachDetach exercises s3.policy.attach and s3.policy.detach.
-func TestShellPolicyAttachDetach(t *testing.T) {
-	if testing.Short() {
-		t.Skip("Skipping integration test in short mode")
-	}
-	cluster, err := startMiniCluster(t)
-	require.NoError(t, err)
-	defer cluster.Stop()
-
-	const weedCmd = "weed"
-	master := string(pb.NewServerAddress("127.0.0.1", cluster.masterPort, cluster.masterGrpcPort))
-	filer := string(pb.NewServerAddress("127.0.0.1", cluster.filerPort, cluster.filerGrpcPort))
-
-	// Create a policy via file.
-	policyJSON := `{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":"s3:GetObject","Resource":"*"}]}`
-	tmpFile, err := os.CreateTemp("", "test_policy_*.json")
-	require.NoError(t, err)
-	defer os.Remove(tmpFile.Name())
-	_, err = tmpFile.WriteString(policyJSON)
-	require.NoError(t, err)
-	require.NoError(t, tmpFile.Close())
-
-	policyName := uniqueName("attach-pol")
-	userName := uniqueName("attach-user")
-
-	execShell(t, weedCmd, master, filer,
-		fmt.Sprintf("s3.policy -put -name=%s -file=%s", policyName, tmpFile.Name()))
-	defer execShell(t, weedCmd, master, filer, fmt.Sprintf("s3.policy -delete -name=%s", policyName))
-
-	execShell(t, weedCmd, master, filer, fmt.Sprintf("s3.user.create -name %s", userName))
-	defer execShell(t, weedCmd, master, filer, fmt.Sprintf("s3.user.delete -name %s", userName))
-
-	t.Run("AttachAndVerify", func(t *testing.T) {
-		out := execShell(t, weedCmd, master, filer,
-			fmt.Sprintf("s3.policy.attach -policy %s -user %s", policyName, userName))
-		requireContains(t, out, policyName, "policy.attach output")
-
-		out = execShell(t, weedCmd, master, filer, fmt.Sprintf("s3.user.show -name %s", userName))
-		requireContains(t, out, policyName, "user.show after attach")
-	})
-
-	t.Run("AttachIdempotent", func(t *testing.T) {
-		// Should succeed without error per the command's idempotent design.
-		execShell(t, weedCmd, master, filer,
-			fmt.Sprintf("s3.policy.attach -policy %s -user %s", policyName, userName))
-	})
-
-	t.Run("DetachAndVerify", func(t *testing.T) {
-		out := execShell(t, weedCmd, master, filer,
-			fmt.Sprintf("s3.policy.detach -policy %s -user %s", policyName, userName))
-		requireContains(t, out, policyName, "policy.detach output")
-
-		out = execShell(t, weedCmd, master, filer, fmt.Sprintf("s3.user.show -name %s", userName))
-		requireNotContains(t, out, fmt.Sprintf("\"%s\"", policyName), "user.show after detach")
-	})
-}
@@ -1,80 +0,0 @@
-package policy
-
-import (
-	"fmt"
-	"testing"
-
-	"github.com/seaweedfs/seaweedfs/weed/pb"
-	"github.com/stretchr/testify/require"
-)
-
-// TestShellServiceAccountLifecycle exercises s3.serviceaccount.* commands end-to-end.
-func TestShellServiceAccountLifecycle(t *testing.T) {
-	if testing.Short() {
-		t.Skip("Skipping integration test in short mode")
-	}
-	cluster, err := startMiniCluster(t)
-	require.NoError(t, err)
-	defer cluster.Stop()
-
-	const weedCmd = "weed"
-	master := string(pb.NewServerAddress("127.0.0.1", cluster.masterPort, cluster.masterGrpcPort))
-	filer := string(pb.NewServerAddress("127.0.0.1", cluster.filerPort, cluster.filerGrpcPort))
-
-	userName := uniqueName("sauser")
-	execShell(t, weedCmd, master, filer, fmt.Sprintf("s3.user.create -name %s", userName))
-	defer execShell(t, weedCmd, master, filer, fmt.Sprintf("s3.user.delete -name %s", userName))
-
-	var saID string
-
-	t.Run("CreateAndList", func(t *testing.T) {
-		description := "integration-test-sa"
-		out := execShell(t, weedCmd, master, filer,
-			fmt.Sprintf("s3.serviceaccount.create -user %s -description %s", userName, description))
-		requireContains(t, out, "Created service account", "serviceaccount.create")
-		requireContains(t, out, "Access Key:", "serviceaccount.create credentials")
-		requireContains(t, out, "Secret Key:", "serviceaccount.create credentials")
-
-		out = execShell(t, weedCmd, master, filer, fmt.Sprintf("s3.serviceaccount.list -user %s", userName))
-		requireContains(t, out, userName, "serviceaccount.list parent column")
-		saID = extractServiceAccountID(t, out, userName)
-	})
-
-	t.Run("Show", func(t *testing.T) {
-		if saID == "" {
-			t.Skip("no saID extracted")
-		}
-		out := execShell(t, weedCmd, master, filer, fmt.Sprintf("s3.serviceaccount.show -id %s", saID))
-		requireContains(t, out, saID, "show contains id")
-		requireContains(t, out, userName, "show contains parent")
-		requireContains(t, out, "enabled", "show contains status")
-	})
-
-	t.Run("CreateWithActions", func(t *testing.T) {
-		out := execShell(t, weedCmd, master, filer,
-			fmt.Sprintf("s3.serviceaccount.create -user %s -actions Read,List -expiry 24h", userName))
-		requireContains(t, out, "Access Key:", "serviceaccount.create with options")
-
-		out = execShell(t, weedCmd, master, filer, fmt.Sprintf("s3.serviceaccount.list -user %s", userName))
-		// Should now have at least 2 service accounts — count lines that start with parent in field[1]
-		count := 0
-		for _, line := range splitLines(out) {
-			fields := fieldsOf(line)
-			if len(fields) >= 2 && fields[1] == userName {
-				count++
-			}
-		}
-		if count < 2 {
-			t.Fatalf("expected at least 2 service accounts for %s, got %d\n%s", userName, count, out)
-		}
-	})
-
-	t.Run("Delete", func(t *testing.T) {
-		if saID == "" {
-			t.Skip("no saID extracted")
-		}
-		execShell(t, weedCmd, master, filer, fmt.Sprintf("s3.serviceaccount.delete -id %s", saID))
-		out := execShell(t, weedCmd, master, filer, fmt.Sprintf("s3.serviceaccount.list -user %s", userName))
-		requireNotContains(t, out, saID, "deleted sa removed from list")
-	})
-}
@@ -1,110 +0,0 @@
-package policy
-
-import (
-	"fmt"
-	"testing"
-
-	"github.com/seaweedfs/seaweedfs/weed/pb"
-	"github.com/stretchr/testify/require"
-)
-
-// TestShellUserLifecycle exercises the s3.user.* commands end-to-end:
-// create, show, list, enable, disable, delete, and provision.
-func TestShellUserLifecycle(t *testing.T) {
-	if testing.Short() {
-		t.Skip("Skipping integration test in short mode")
-	}
-	cluster, err := startMiniCluster(t)
-	require.NoError(t, err)
-	defer cluster.Stop()
-
-	const weedCmd = "weed"
-	master := string(pb.NewServerAddress("127.0.0.1", cluster.masterPort, cluster.masterGrpcPort))
-	filer := string(pb.NewServerAddress("127.0.0.1", cluster.filerPort, cluster.filerGrpcPort))
-
-	t.Run("CreateShowListDelete", func(t *testing.T) {
-		userName := uniqueName("user")
-
-		out := execShell(t, weedCmd, master, filer, fmt.Sprintf("s3.user.create -name %s", userName))
-		requireContains(t, out, userName, "user.create output")
-		requireContains(t, out, "access_key", "user.create JSON")
-		requireContains(t, out, "Secret Key:", "user.create stderr")
-
-		out = execShell(t, weedCmd, master, filer, fmt.Sprintf("s3.user.show -name %s", userName))
-		requireContains(t, out, userName, "user.show")
-
-		out = execShell(t, weedCmd, master, filer, "s3.user.list")
-		requireContains(t, out, userName, "user.list")
-
-		execShell(t, weedCmd, master, filer, fmt.Sprintf("s3.user.delete -name %s", userName))
-
-		out = execShell(t, weedCmd, master, filer, "s3.user.list")
-		requireNotContains(t, out, userName, "user.list after delete")
-	})
-
-	t.Run("CreateWithExplicitKeys", func(t *testing.T) {
-		userName := uniqueName("user-expl")
-		ak := "TESTAK1234567890ABCD"
-		sk := "testsecretkey1234567890abcdefghijklmnopq"
-
-		out := execShell(t, weedCmd, master, filer,
-			fmt.Sprintf("s3.user.create -name %s -access_key %s -secret_key %s", userName, ak, sk))
-		requireContains(t, out, ak, "user.create with explicit keys")
-
-		out = execShell(t, weedCmd, master, filer, fmt.Sprintf("s3.user.show -name %s", userName))
-		requireContains(t, out, ak, "user.show reveals access key")
-
-		execShell(t, weedCmd, master, filer, fmt.Sprintf("s3.user.delete -name %s", userName))
-	})
-
-	t.Run("EnableDisable", func(t *testing.T) {
-		userName := uniqueName("user-toggle")
-
-		execShell(t, weedCmd, master, filer, fmt.Sprintf("s3.user.create -name %s", userName))
-
-		out := execShell(t, weedCmd, master, filer, fmt.Sprintf("s3.user.disable -name %s", userName))
-		requireContains(t, out, "disabled", "user.disable")
-
-		out = execShell(t, weedCmd, master, filer, fmt.Sprintf("s3.user.show -name %s", userName))
-		requireContains(t, out, "disabled", "user.show after disable")
-
-		out = execShell(t, weedCmd, master, filer, fmt.Sprintf("s3.user.enable -name %s", userName))
-		requireContains(t, out, "enabled", "user.enable")
-
-		out = execShell(t, weedCmd, master, filer, fmt.Sprintf("s3.user.show -name %s", userName))
-		requireContains(t, out, "enabled", "user.show after enable")
-
-		execShell(t, weedCmd, master, filer, fmt.Sprintf("s3.user.delete -name %s", userName))
-	})
-
-	t.Run("Provision", func(t *testing.T) {
-		userName := uniqueName("prov-user")
-		bucketName := uniqueName("prov-bkt")
-
-		execShell(t, weedCmd, master, filer, fmt.Sprintf("s3.bucket.create -name %s", bucketName))
-
-		out := execShell(t, weedCmd, master, filer,
-			fmt.Sprintf("s3.user.provision -name %s -bucket %s -role readwrite", userName, bucketName))
-		requireContains(t, out, "Created policy", "provision output")
-		requireContains(t, out, "Created user", "provision output")
-		requireContains(t, out, "Access Key:", "provision credentials")
-		requireContains(t, out, "Secret Key:", "provision credentials")
-
-		out = execShell(t, weedCmd, master, filer, fmt.Sprintf("s3.user.show -name %s", userName))
-		requireContains(t, out, userName, "user.show after provision")
-
-		// Second call with same user but different bucket/role should succeed without creating duplicate user.
-		bucket2 := uniqueName("prov-bkt2")
-		execShell(t, weedCmd, master, filer, fmt.Sprintf("s3.bucket.create -name %s", bucket2))
-		out = execShell(t, weedCmd, master, filer,
-			fmt.Sprintf("s3.user.provision -name %s -bucket %s -role readonly", userName, bucket2))
-		requireContains(t, out, "already exists", "provision on existing user")
-		requireContains(t, out, "Created policy", "second policy created")
-		requireContains(t, out, "Attached policy", "second policy attached to existing user")
-		requireNotContains(t, out, "Access Key:", "no new credentials for existing user")
-
-		execShell(t, weedCmd, master, filer, fmt.Sprintf("s3.user.delete -name %s", userName))
-		execShell(t, weedCmd, master, filer, fmt.Sprintf("s3.bucket.delete -name %s", bucketName))
-		execShell(t, weedCmd, master, filer, fmt.Sprintf("s3.bucket.delete -name %s", bucket2))
-	})
-}
@@ -70,8 +70,7 @@ print("WRITE_COUNT=" + str(count))
 		"issue-8285/output/_temporary/0/",
 		"issue-8285/output/_temporary/0/_temporary/",
 	}
-	// Empty folder cleanup has a 2m default delay + 30s processor interval
-	lingering := waitForObjectsToDisappear(t, env, "test", temporaryCandidates, 3*time.Minute)
+	lingering := waitForObjectsToDisappear(t, env, "test", temporaryCandidates, 35*time.Second)
 	if len(lingering) > 0 {
 		t.Fatalf("issue #8285 regression detected: lingering temporary directories: %v", lingering)
 	}
@@ -14,7 +14,7 @@ import (
 	"github.com/aws/aws-sdk-go-v2/aws"
 	"github.com/aws/aws-sdk-go-v2/credentials"
 	"github.com/aws/aws-sdk-go-v2/service/s3"
-	"github.com/seaweedfs/seaweedfs/test/testutil"
+	"github.com/seaweedfs/seaweedfs/test/s3tables/testutil"
 	"github.com/testcontainers/testcontainers-go"
 )

@@ -94,10 +94,9 @@ func (env *TestEnvironment) StartSeaweedFS(t *testing.T) {
 		t.Fatalf("failed to create temp directory: %v", err)
 	}

-	ports := testutil.MustFreeMiniPorts(t, []string{"Master", "Filer", "S3"})
-	env.masterPort = ports[0]
-	env.filerPort = ports[1]
-	env.s3Port = ports[2]
+	env.masterPort = testutil.MustFreeMiniPort(t, "Master")
+	env.filerPort = testutil.MustFreeMiniPort(t, "Filer")
+	env.s3Port = testutil.MustFreeMiniPort(t, "S3")

 	bindIP := testutil.FindBindIP()
 	iamConfigPath, err := testutil.WriteIAMConfig(env.seaweedfsDataDir, env.accessKey, env.secretKey)
@@ -1,465 +0,0 @@
-package catalog
-
-import (
-	"context"
-	"encoding/json"
-	"fmt"
-	"io"
-	"net/http"
-	"net/url"
-	"os"
-	"os/exec"
-	"path/filepath"
-	"strings"
-	"testing"
-	"time"
-
-	"github.com/seaweedfs/seaweedfs/test/testutil"
-)
-
-// oauthTestEnv holds a weed mini instance started with IAM credentials
-// so that the OAuth token endpoint is functional.
-type oauthTestEnv struct {
-	seaweedDir     string
-	weedBinary     string
-	dataDir        string
-	bindIP         string
-	s3Port         int
-	s3GrpcPort     int
-	icebergPort    int
-	masterPort     int
-	masterGrpcPort int
-	filerPort      int
-	filerGrpcPort  int
-	volumePort     int
-	volumeGrpcPort int
-	webdavPort     int
-	weedProcess    *exec.Cmd
-	weedCancel     context.CancelFunc
-	accessKey      string
-	secretKey      string
-}
-
-func newOAuthTestEnv(t *testing.T) *oauthTestEnv {
-	t.Helper()
-
-	wd, err := os.Getwd()
-	if err != nil {
-		t.Fatalf("get working directory: %v", err)
-	}
-
-	seaweedDir := wd
-	for i := 0; i < 6; i++ {
-		if _, err := os.Stat(filepath.Join(seaweedDir, "go.mod")); err == nil {
-			break
-		}
-		seaweedDir = filepath.Dir(seaweedDir)
-	}
-
-	weedBinary := filepath.Join(seaweedDir, "weed", "weed")
-	if info, err := os.Stat(weedBinary); err != nil || info.IsDir() {
-		weedBinary = "weed"
-		if _, err := exec.LookPath(weedBinary); err != nil {
-			t.Skip("weed binary not found, skipping integration test")
-		}
-	}
-
-	dataDir, err := os.MkdirTemp("", "seaweed-oauth-test-*")
-	if err != nil {
-		t.Fatalf("create temp dir: %v", err)
-	}
-
-	bindIP := testutil.FindBindIP()
-	ports := testutil.MustAllocatePorts(t, 10)
-
-	return &oauthTestEnv{
-		seaweedDir:     seaweedDir,
-		weedBinary:     weedBinary,
-		dataDir:        dataDir,
-		bindIP:         bindIP,
-		masterPort:     ports[0],
-		masterGrpcPort: ports[1],
-		volumePort:     ports[2],
-		volumeGrpcPort: ports[3],
-		filerPort:      ports[4],
-		filerGrpcPort:  ports[5],
-		s3Port:         ports[6],
-		s3GrpcPort:     ports[7],
-		icebergPort:    ports[8],
-		webdavPort:     ports[9],
-		accessKey:      "AKIAIOSFODNN7EXAMPLE",
-		secretKey:      "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY",
-	}
-}
-
-func (env *oauthTestEnv) start(t *testing.T) {
-	t.Helper()
-
-	iamConfigPath, err := testutil.WriteIAMConfig(env.dataDir, env.accessKey, env.secretKey)
-	if err != nil {
-		t.Fatalf("write IAM config: %v", err)
-	}
-
-	securityToml := filepath.Join(env.dataDir, "security.toml")
-	if err := os.WriteFile(securityToml, []byte("# Empty security config for testing\n"), 0644); err != nil {
-		t.Fatalf("write security.toml: %v", err)
-	}
-
-	ctx, cancel := context.WithCancel(context.Background())
-	env.weedCancel = cancel
-
-	cmd := exec.CommandContext(ctx, env.weedBinary, "mini",
-		"-master.port", fmt.Sprintf("%d", env.masterPort),
-		"-master.port.grpc", fmt.Sprintf("%d", env.masterGrpcPort),
-		"-volume.port", fmt.Sprintf("%d", env.volumePort),
-		"-volume.port.grpc", fmt.Sprintf("%d", env.volumeGrpcPort),
-		"-filer.port", fmt.Sprintf("%d", env.filerPort),
-		"-filer.port.grpc", fmt.Sprintf("%d", env.filerGrpcPort),
-		"-s3.port", fmt.Sprintf("%d", env.s3Port),
-		"-s3.port.grpc", fmt.Sprintf("%d", env.s3GrpcPort),
-		"-s3.port.iceberg", fmt.Sprintf("%d", env.icebergPort),
-		"-webdav.port", fmt.Sprintf("%d", env.webdavPort),
-		"-s3.config", iamConfigPath,
-		"-ip", env.bindIP,
-		"-ip.bind", "0.0.0.0",
-		"-dir", env.dataDir,
-	)
-	cmd.Dir = env.dataDir
-	cmd.Stdout = os.Stdout
-	cmd.Stderr = os.Stderr
-	cmd.Env = append(os.Environ(),
-		"AWS_ACCESS_KEY_ID="+env.accessKey,
-		"AWS_SECRET_ACCESS_KEY="+env.secretKey,
-	)
-
-	if err := cmd.Start(); err != nil {
-		cancel()
-		t.Fatalf("start weed mini: %v", err)
-	}
-	env.weedProcess = cmd
-
-	icebergURL := fmt.Sprintf("http://%s:%d/v1/config", env.bindIP, env.icebergPort)
-	if !testutil.WaitForService(icebergURL, 30*time.Second) {
-		cancel()
-		cmd.Wait()
-		t.Fatalf("Iceberg REST API did not become ready at %s", icebergURL)
-	}
-}
-
-func (env *oauthTestEnv) cleanup(t *testing.T) {
-	t.Helper()
-	if env.weedCancel != nil {
-		env.weedCancel()
-	}
-	if env.weedProcess != nil {
-		env.weedProcess.Wait()
-	}
-	if env.dataDir != "" {
-		os.RemoveAll(env.dataDir)
-	}
-}
-
-func (env *oauthTestEnv) icebergURL() string {
-	return fmt.Sprintf("http://%s:%d", env.bindIP, env.icebergPort)
-}
-
-// TestOAuthTokenEndpoint tests the /v1/oauth/tokens endpoint directly via HTTP.
-func TestOAuthTokenEndpoint(t *testing.T) {
-	if testing.Short() {
-		t.Skip("Skipping integration test in short mode")
-	}
-
-	env := newOAuthTestEnv(t)
-	defer env.cleanup(t)
-	env.start(t)
-
-	t.Run("valid credentials", func(t *testing.T) {
-		token := requestOAuthToken(t, env, env.accessKey, env.secretKey)
-		if token == "" {
-			t.Fatal("expected non-empty token")
-		}
-	})
-
-	t.Run("invalid secret", func(t *testing.T) {
-		resp, err := http.PostForm(env.icebergURL()+"/v1/oauth/tokens", url.Values{
-			"grant_type":    {"client_credentials"},
-			"client_id":     {env.accessKey},
-			"client_secret": {"wrong-secret"},
-		})
-		if err != nil {
-			t.Fatalf("POST /v1/oauth/tokens: %v", err)
-		}
-		defer resp.Body.Close()
-
-		if resp.StatusCode != http.StatusUnauthorized {
-			body, _ := io.ReadAll(resp.Body)
-			t.Fatalf("expected 401, got %d: %s", resp.StatusCode, body)
-		}
-	})
-
-	t.Run("missing grant_type", func(t *testing.T) {
-		resp, err := http.PostForm(env.icebergURL()+"/v1/oauth/tokens", url.Values{
-			"client_id":     {env.accessKey},
-			"client_secret": {env.secretKey},
-		})
-		if err != nil {
-			t.Fatalf("POST /v1/oauth/tokens: %v", err)
-		}
-		defer resp.Body.Close()
-
-		if resp.StatusCode != http.StatusBadRequest {
-			body, _ := io.ReadAll(resp.Body)
-			t.Fatalf("expected 400, got %d: %s", resp.StatusCode, body)
-		}
-	})
-
-	t.Run("bearer token auth on catalog endpoint", func(t *testing.T) {
-		token := requestOAuthToken(t, env, env.accessKey, env.secretKey)
-
-		// Use the token to call the catalog
-		req, err := http.NewRequest(http.MethodGet, env.icebergURL()+"/v1/namespaces", nil)
-		if err != nil {
-			t.Fatalf("create request: %v", err)
-		}
-		req.Header.Set("Authorization", "Bearer "+token)
-
-		resp, err := http.DefaultClient.Do(req)
-		if err != nil {
-			t.Fatalf("GET /v1/namespaces with Bearer: %v", err)
-		}
-		defer resp.Body.Close()
-
-		// Auth should pass. We accept 200 (success) or 500 (missing warehouse bucket
-		// is an internal error, not an auth error). Reject 401/403/404/405.
-		body, _ := io.ReadAll(resp.Body)
-		switch resp.StatusCode {
-		case http.StatusOK, http.StatusInternalServerError:
-			t.Logf("Bearer token auth succeeded, status=%d", resp.StatusCode)
-		default:
-			t.Fatalf("Bearer auth failed unexpectedly: status=%d body=%s", resp.StatusCode, body)
-		}
-	})
-}
-
-// TestDuckDBOAuthIntegration tests that DuckDB can connect to the Iceberg REST
-// catalog using the OAuth2 client_credentials flow (CREATE SECRET with client_id
-// and client_secret). This is the scenario reported in issue #9015.
-func TestDuckDBOAuthIntegration(t *testing.T) {
-	if testing.Short() {
-		t.Skip("Skipping integration test in short mode")
-	}
-	if !testutil.HasDocker() {
-		t.Skip("Docker not available, skipping DuckDB OAuth integration test")
-	}
-
-	env := newOAuthTestEnv(t)
-	defer env.cleanup(t)
-	env.start(t)
-
-	// Create a table bucket and namespace so DuckDB has something to query
-	bucketName := "duckdb-oauth-" + randomSuffix()
-	createTableBucketViaShell(t, env, bucketName)
-
-	// Create a namespace via the Iceberg REST API using OAuth token
-	token := requestOAuthToken(t, env, env.accessKey, env.secretKey)
-	createNamespaceWithToken(t, env, token, bucketName, "testns")
-
-	sqlContent := fmt.Sprintf(`
-INSTALL iceberg;
-LOAD iceberg;
-
-CREATE SECRET iceberg_secret (
-    TYPE ICEBERG,
-    ENDPOINT 'http://host.docker.internal:%d',
-    CLIENT_ID '%s',
-    CLIENT_SECRET '%s',
-    SCOPE 's3://%s/'
-);
-
-CREATE SECRET s3_secret (
-    TYPE S3,
-    KEY_ID '%s',
-    SECRET '%s',
-    ENDPOINT 'host.docker.internal:%d',
-    URL_STYLE 'path',
-    USE_SSL false,
-    SCOPE 's3://%s/'
-);
-
-SELECT 'OAuth token obtained successfully' as status;
-
-- Try listing namespaces via the Iceberg catalog
-SELECT * FROM iceberg_scan('iceberg_secret', ALLOW_MOVED_PATHS => TRUE) LIMIT 0;
-`, env.icebergPort, env.accessKey, env.secretKey, bucketName,
-		env.accessKey, env.secretKey, env.s3Port, bucketName)
-
-	sqlFile := filepath.Join(env.dataDir, "duckdb_oauth_test.sql")
-	if err := os.WriteFile(sqlFile, []byte(sqlContent), 0644); err != nil {
-		t.Fatalf("write SQL file: %v", err)
-	}
-
-	// Run DuckDB in Docker.
-	// We use a simple test: get a token, create a secret, and verify the
-	// Iceberg extension can communicate with the catalog.
-	// The simpler fallback test just verifies CREATE SECRET succeeds (no 404).
-	fallbackSQL := fmt.Sprintf(`
-INSTALL iceberg;
-LOAD iceberg;
-
-CREATE SECRET (
-    TYPE ICEBERG,
-    ENDPOINT 'http://host.docker.internal:%d',
-    CLIENT_ID '%s',
-    CLIENT_SECRET '%s'
-);
-
-SELECT 'DuckDB Iceberg OAuth secret created successfully' as result;
-`, env.icebergPort, env.accessKey, env.secretKey)
-
-	fallbackFile := filepath.Join(env.dataDir, "duckdb_oauth_fallback.sql")
-	if err := os.WriteFile(fallbackFile, []byte(fallbackSQL), 0644); err != nil {
-		t.Fatalf("write fallback SQL file: %v", err)
-	}
-
-	// Try the full SQL script first (CREATE SECRET + catalog access).
-	// Fall back to the simple CREATE SECRET test if iceberg_scan isn't supported.
-	cmd := exec.Command("docker", "run", "--rm",
-		"-v", fmt.Sprintf("%s:/test", env.dataDir),
-		"--add-host", "host.docker.internal:host-gateway",
-		"--entrypoint", "duckdb",
-		"duckdb/duckdb:latest",
-		"-init", "/test/duckdb_oauth_test.sql",
-		"-c", "SELECT 1",
-	)
-
-	output, err := cmd.CombinedOutput()
-	outputStr := string(output)
-	t.Logf("DuckDB output:\n%s", outputStr)
-
-	if err != nil {
-		if strings.Contains(outputStr, "iceberg extension is not available") ||
-			strings.Contains(outputStr, "Failed to load") {
-			t.Skip("Skipping: Iceberg extension not available in DuckDB Docker image")
-		}
-		// The key check: the old error was "HTTP NotFound_404" on /v1/oauth/tokens.
-		// With our fix, this should no longer happen.
-		if strings.Contains(outputStr, "NotFound_404") && strings.Contains(outputStr, "/v1/oauth/tokens") {
-			t.Fatal("OAuth token endpoint returned 404 - the fix is not working")
-		}
-		// If iceberg_scan failed but CREATE SECRET worked, fall back to simpler test
-		if strings.Contains(outputStr, "OAuth token obtained successfully") {
-			t.Logf("Full SQL had partial success (token obtained), iceberg_scan may not be supported. Continuing.")
-		} else {
-			// Try the fallback script that only tests CREATE SECRET
-			t.Logf("Full SQL failed, trying fallback CREATE SECRET test...")
-			fallbackCmd := exec.Command("docker", "run", "--rm",
-				"-v", fmt.Sprintf("%s:/test", env.dataDir),
-				"--add-host", "host.docker.internal:host-gateway",
-				"--entrypoint", "duckdb",
-				"duckdb/duckdb:latest",
-				"-init", "/test/duckdb_oauth_fallback.sql",
-				"-c", "SELECT 1",
-			)
-			fallbackOutput, fallbackErr := fallbackCmd.CombinedOutput()
-			fallbackStr := string(fallbackOutput)
-			t.Logf("DuckDB fallback output:\n%s", fallbackStr)
-
-			if fallbackErr != nil {
-				if strings.Contains(fallbackStr, "NotFound_404") && strings.Contains(fallbackStr, "/v1/oauth/tokens") {
-					t.Fatal("OAuth token endpoint returned 404 - the fix is not working")
-				}
-				t.Fatalf("DuckDB fallback also failed: %v\nOutput: %s", fallbackErr, fallbackStr)
-			}
-			if !strings.Contains(fallbackStr, "DuckDB Iceberg OAuth secret created successfully") {
-				t.Errorf("expected success message in fallback output, got:\n%s", fallbackStr)
-			}
-			return
-		}
-	}
-
-	if strings.Contains(outputStr, "OAuth token obtained successfully") {
-		t.Logf("DuckDB OAuth CREATE SECRET succeeded")
-	} else {
-		t.Errorf("expected OAuth success message in output, got:\n%s", outputStr)
-	}
-}
-
-// requestOAuthToken obtains a bearer token from the OAuth endpoint.
-func requestOAuthToken(t *testing.T, env *oauthTestEnv, accessKey, secretKey string) string {
-	t.Helper()
-
-	resp, err := http.PostForm(env.icebergURL()+"/v1/oauth/tokens", url.Values{
-		"grant_type":    {"client_credentials"},
-		"client_id":     {accessKey},
-		"client_secret": {secretKey},
-	})
-	if err != nil {
-		t.Fatalf("POST /v1/oauth/tokens: %v", err)
-	}
-	defer resp.Body.Close()
-
-	body, _ := io.ReadAll(resp.Body)
-
-	if resp.StatusCode != http.StatusOK {
-		t.Fatalf("OAuth token request failed: status=%d body=%s", resp.StatusCode, body)
-	}
-
-	var tokenResp struct {
-		AccessToken string `json:"access_token"`
-		TokenType   string `json:"token_type"`
-		ExpiresIn   int    `json:"expires_in"`
-	}
-	if err := json.Unmarshal(body, &tokenResp); err != nil {
-		t.Fatalf("decode token response: %v", err)
-	}
-
-	if tokenResp.AccessToken == "" {
-		t.Fatal("got empty access_token")
-	}
-	if tokenResp.TokenType != "bearer" {
-		t.Errorf("expected token_type=bearer, got %s", tokenResp.TokenType)
-	}
-	return tokenResp.AccessToken
-}
-
-// createTableBucketViaShell creates a table bucket using weed shell,
-// which bypasses S3 auth. This is the same approach used by the Trino tests.
-func createTableBucketViaShell(t *testing.T, env *oauthTestEnv, bucketName string) {
-	t.Helper()
-
-	cmd := exec.Command(env.weedBinary, "shell",
-		fmt.Sprintf("-master=%s:%d.%d", env.bindIP, env.masterPort, env.masterGrpcPort),
-	)
-	cmd.Stdin = strings.NewReader(fmt.Sprintf("s3tables.bucket -create -name %s -account 000000000000\nexit\n", bucketName))
-	output, err := cmd.CombinedOutput()
-	if err != nil {
-		t.Fatalf("create table bucket %s via weed shell: %v\nOutput: %s", bucketName, err, output)
-	}
-	t.Logf("Created table bucket %s", bucketName)
-}
-
-// createNamespaceWithToken creates a namespace using a Bearer token.
-func createNamespaceWithToken(t *testing.T, env *oauthTestEnv, token, bucketName, namespace string) {
-	t.Helper()
-
-	path := fmt.Sprintf("/v1/%s/namespaces", bucketName)
-	body := fmt.Sprintf(`{"namespace":["%s"]}`, namespace)
-	req, err := http.NewRequest(http.MethodPost, env.icebergURL()+path, strings.NewReader(body))
-	if err != nil {
-		t.Fatalf("create request: %v", err)
-	}
-	req.Header.Set("Content-Type", "application/json")
-	req.Header.Set("Authorization", "Bearer "+token)
-
-	resp, err := http.DefaultClient.Do(req)
-	if err != nil {
-		t.Fatalf("create namespace: %v", err)
-	}
-	defer resp.Body.Close()
-
-	respBody, _ := io.ReadAll(resp.Body)
-	if resp.StatusCode != http.StatusOK && resp.StatusCode != http.StatusConflict {
-		t.Fatalf("create namespace failed: status=%d body=%s", resp.StatusCode, respBody)
-	}
-	t.Logf("Created namespace %s in bucket %s", namespace, bucketName)
-}
@@ -9,6 +9,7 @@ import (
 	"flag"
 	"fmt"
 	"io"
+	"net"
 	"net/http"
 	"os"
 	"os/exec"
@@ -16,8 +17,6 @@ import (
 	"strings"
 	"testing"
 	"time"
-
-	"github.com/seaweedfs/seaweedfs/test/testutil"
 )

 // sharedEnv is the single TestEnvironment shared across all tests in this package.
@@ -70,6 +69,23 @@ type TestEnvironment struct {
 	dockerAvailable bool
 }

+// hasDocker checks if Docker is available
+func hasDocker() bool {
+	cmd := exec.Command("docker", "version")
+	return cmd.Run() == nil
+}
+
+// getFreePort returns an available ephemeral port and its listener
+func getFreePort() (int, net.Listener, error) {
+	listener, err := net.Listen("tcp", "127.0.0.1:0")
+	if err != nil {
+		return 0, nil, err
+	}
+
+	addr := listener.Addr().(*net.TCPAddr)
+	return addr.Port, listener, nil
+}
+
 // newTestEnvironmentForMain creates a TestEnvironment without calling t.Fatalf so it
 // can be used from TestMain (which has no *testing.T).
 func newTestEnvironmentForMain() (*TestEnvironment, error) {
@@ -102,27 +118,95 @@ func newTestEnvironmentForMain() (*TestEnvironment, error) {
 		return nil, fmt.Errorf("create temp dir: %w", err)
 	}

-	// Allocate 9 unique ports atomically: s3, iceberg, s3Grpc, master, masterGrpc,
-	// filer, filerGrpc, volume, volumeGrpc
-	ports, err := testutil.AllocatePorts(9)
-	if err != nil {
-		return nil, fmt.Errorf("allocate ports: %w", err)
+	// Allocate free ephemeral ports for each service
+	var listeners []net.Listener
+	closeListeners := func() {
+		for _, l := range listeners {
+			l.Close()
+		}
 	}

+	var l net.Listener
+	s3Port, l, err := getFreePort()
+	if err != nil {
+		closeListeners()
+		return nil, fmt.Errorf("get free port for S3: %w", err)
+	}
+	listeners = append(listeners, l)
+
+	icebergPort, l, err := getFreePort()
+	if err != nil {
+		closeListeners()
+		return nil, fmt.Errorf("get free port for Iceberg: %w", err)
+	}
+	listeners = append(listeners, l)
+
+	s3GrpcPort, l, err := getFreePort()
+	if err != nil {
+		closeListeners()
+		return nil, fmt.Errorf("get free port for S3 gRPC: %w", err)
+	}
+	listeners = append(listeners, l)
+
+	masterPort, l, err := getFreePort()
+	if err != nil {
+		closeListeners()
+		return nil, fmt.Errorf("get free port for Master: %w", err)
+	}
+	listeners = append(listeners, l)
+
+	masterGrpcPort, l, err := getFreePort()
+	if err != nil {
+		closeListeners()
+		return nil, fmt.Errorf("get free port for Master gRPC: %w", err)
+	}
+	listeners = append(listeners, l)
+
+	filerPort, l, err := getFreePort()
+	if err != nil {
+		closeListeners()
+		return nil, fmt.Errorf("get free port for Filer: %w", err)
+	}
+	listeners = append(listeners, l)
+
+	filerGrpcPort, l, err := getFreePort()
+	if err != nil {
+		closeListeners()
+		return nil, fmt.Errorf("get free port for Filer gRPC: %w", err)
+	}
+	listeners = append(listeners, l)
+
+	volumePort, l, err := getFreePort()
+	if err != nil {
+		closeListeners()
+		return nil, fmt.Errorf("get free port for Volume: %w", err)
+	}
+	listeners = append(listeners, l)
+
+	volumeGrpcPort, l, err := getFreePort()
+	if err != nil {
+		closeListeners()
+		return nil, fmt.Errorf("get free port for Volume gRPC: %w", err)
+	}
+	listeners = append(listeners, l)
+
+	// Release the port reservations so weed mini can bind to them
+	closeListeners()
+
 	return &TestEnvironment{
 		seaweedDir:      seaweedDir,
 		weedBinary:      weedBinary,
 		dataDir:         dataDir,
-		s3Port:          ports[0],
-		s3GrpcPort:      ports[1],
-		icebergPort:     ports[2],
-		masterPort:      ports[3],
-		masterGrpcPort:  ports[4],
-		filerPort:       ports[5],
-		filerGrpcPort:   ports[6],
-		volumePort:      ports[7],
-		volumeGrpcPort:  ports[8],
-		dockerAvailable: testutil.HasDocker(),
+		s3Port:          s3Port,
+		s3GrpcPort:      s3GrpcPort,
+		icebergPort:     icebergPort,
+		masterPort:      masterPort,
+		masterGrpcPort:  masterGrpcPort,
+		filerPort:       filerPort,
+		filerGrpcPort:   filerGrpcPort,
+		volumePort:      volumePort,
+		volumeGrpcPort:  volumeGrpcPort,
+		dockerAvailable: hasDocker(),
 	}, nil
 }

@@ -18,7 +18,7 @@ import (

 	v4 "github.com/aws/aws-sdk-go-v2/aws/signer/v4"
 	"github.com/aws/aws-sdk-go-v2/credentials"
-	"github.com/seaweedfs/seaweedfs/test/testutil"
+	"github.com/seaweedfs/seaweedfs/test/s3tables/testutil"
 )

 var (
@@ -114,12 +114,11 @@ func (env *TestEnvironment) StartSeaweedFS(t *testing.T) {
 		t.Fatalf("failed to create temp directory: %v", err)
 	}

-	ports := testutil.MustFreeMiniPorts(t, []string{"Master", "Filer", "S3", "Iceberg", "RisingWave"})
-	env.masterPort = ports[0]
-	env.filerPort = ports[1]
-	env.s3Port = ports[2]
-	env.icebergRestPort = ports[3]
-	env.risingwavePort = ports[4]
+	env.masterPort = testutil.MustFreeMiniPort(t, "Master")
+	env.filerPort = testutil.MustFreeMiniPort(t, "Filer")
+	env.s3Port = testutil.MustFreeMiniPort(t, "S3")
+	env.icebergRestPort = testutil.MustFreeMiniPort(t, "Iceberg")
+	env.risingwavePort = testutil.MustFreeMiniPort(t, "RisingWave")

 	env.bindIP = testutil.FindBindIP()

@@ -16,7 +16,7 @@ import (
 	"github.com/aws/aws-sdk-go-v2/aws"
 	"github.com/aws/aws-sdk-go-v2/credentials"
 	"github.com/aws/aws-sdk-go-v2/service/s3"
-	"github.com/seaweedfs/seaweedfs/test/testutil"
+	"github.com/seaweedfs/seaweedfs/test/s3tables/testutil"
 	"github.com/testcontainers/testcontainers-go"
 )

@@ -90,11 +90,10 @@ func (env *TestEnvironment) StartSeaweedFS(t *testing.T) {
 		t.Fatalf("failed to create temp directory: %v", err)
 	}

-	ports := testutil.MustFreeMiniPorts(t, []string{"Master", "Filer", "S3", "Iceberg"})
-	env.masterPort = ports[0]
-	env.filerPort = ports[1]
-	env.s3Port = ports[2]
-	env.icebergRestPort = ports[3]
+	env.masterPort = testutil.MustFreeMiniPort(t, "Master")
+	env.filerPort = testutil.MustFreeMiniPort(t, "Filer")
+	env.s3Port = testutil.MustFreeMiniPort(t, "S3")
+	env.icebergRestPort = testutil.MustFreeMiniPort(t, "Iceberg")

 	bindIP := testutil.FindBindIP()

@@ -277,80 +277,3 @@ print(f"Count at snapshot: {count}")

 	t.Logf(">>> Time travel test passed")
 }
-
-// TestSparkMultiLevelNamespace tests that multi-level namespaces produce correct
-// S3 paths (dot-separated) so that Spark can read back the data it writes.
-// Regression test for https://github.com/seaweedfs/seaweedfs/issues/8959
-func TestSparkMultiLevelNamespace(t *testing.T) {
-	if testing.Short() {
-		t.Skip("Skipping integration test in short mode")
-	}
-
-	env, _, _ := setupSparkTestEnv(t)
-
-	// Use a two-level namespace like "analytics.daily"
-	nsLevel1 := "analytics_" + randomString(4)
-	nsLevel2 := "daily_" + randomString(4)
-	multiNs := fmt.Sprintf("%s.%s", nsLevel1, nsLevel2)
-	tableName := "events_" + randomString(4)
-
-	// Create multi-level namespace
-	t.Logf(">>> Creating multi-level namespace: %s", multiNs)
-	createNsSQL := fmt.Sprintf(`
-spark.sql("CREATE NAMESPACE iceberg.%s")
-print("Namespace created")
-`, multiNs)
-	output := runSparkPySQL(t, env.sparkContainer, createNsSQL, env.icebergRestPort, env.s3Port)
-	if !strings.Contains(output, "Namespace created") {
-		t.Fatalf("multi-level namespace creation failed, output: %s", output)
-	}
-
-	// Create table under multi-level namespace
-	t.Logf(">>> Creating table under multi-level namespace")
-	createTableSQL := fmt.Sprintf(`
-spark.sql("""
-CREATE TABLE iceberg.%s.%s (
-    id INT,
-    event STRING,
-    ts TIMESTAMP
-)
-USING iceberg
-""")
-print("Table created")
-`, multiNs, tableName)
-	output = runSparkPySQL(t, env.sparkContainer, createTableSQL, env.icebergRestPort, env.s3Port)
-	if !strings.Contains(output, "Table created") {
-		t.Fatalf("table creation under multi-level namespace failed, output: %s", output)
-	}
-
-	// Insert data
-	t.Logf(">>> Inserting data into multi-level namespace table")
-	insertSQL := fmt.Sprintf(`
-spark.sql("""
-INSERT INTO iceberg.%s.%s VALUES
-    (1, 'click', TIMESTAMP '2025-01-01 00:00:00'),
-    (2, 'view',  TIMESTAMP '2025-01-01 01:00:00'),
-    (3, 'click', TIMESTAMP '2025-01-02 00:00:00')
-""")
-print("Data inserted")
-`, multiNs, tableName)
-	output = runSparkPySQL(t, env.sparkContainer, insertSQL, env.icebergRestPort, env.s3Port)
-	if !strings.Contains(output, "Data inserted") {
-		t.Fatalf("data insertion failed, output: %s", output)
-	}
-
-	// Query data back — this is the key test: if the namespace path separator
-	// was wrong (\x1F instead of "."), Spark would not find the data files.
-	t.Logf(">>> Querying data from multi-level namespace table")
-	querySQL := fmt.Sprintf(`
-result = spark.sql("SELECT COUNT(*) as count FROM iceberg.%s.%s")
-count = result.collect()[0]['count']
-print(f"Row count: {count}")
-`, multiNs, tableName)
-	output = runSparkPySQL(t, env.sparkContainer, querySQL, env.icebergRestPort, env.s3Port)
-	if !strings.Contains(output, "Row count: 3") {
-		t.Errorf("expected row count 3 from multi-level namespace table, got output: %s", output)
-	}
-
-	t.Logf(">>> Multi-level namespace test passed")
-}
--- a/Show More
+++ b/Show More