operation: fold extra dial options into WithVolumeServerClient (#11392)

WithVolumeServerClientOptions duplicated the existing helper only to
append extra dial options. Trail the extras as a variadic parameter on
WithVolumeServerClient instead, keeping the (dialOption, fn) argument
order so all existing callers keep working. TailVolumeFromSource gets
the same treatment.

.github/dependabot.yml

@@ -10,5 +10,3 @@ updates:
   directory: "/"
   schedule:
     interval: weekly
-  ignore:
-    - dependency-name: "github.com/seaweedfs/goexif"

.github/scripts/helm_jwt_keys.py

@@ -1,240 +0,0 @@
-#!/usr/bin/env python3
-"""Check JWT extraction and, with --context, real Helm upgrade persistence."""
-
-import argparse
-import base64
-import json
-from pathlib import Path
-import shutil
-import subprocess
-import sys
-import tempfile
-import uuid
-
-try:
-    import tomllib
-except ModuleNotFoundError:  # CI also exercises Python 3.10.
-    import tomli as tomllib
-
-
-ROOT = Path(__file__).resolve().parents[2]
-CHART = ROOT / "k8s/charts/seaweedfs"
-SECTIONS = ("jwt.signing", "jwt.signing.read", "jwt.filer_signing", "jwt.filer_signing.read")
-KEYS = {section: f"active-{index}" for index, section in enumerate(SECTIONS)}
-ESCAPED_HEADER = '["jw\\u0074".signing]\nkey = "existing"'
-
-
-def run(*args):
-    return subprocess.run(args, check=True, text=True, capture_output=True).stdout
-
-
-def keys(raw):
-    document = tomllib.loads(raw)
-    result = {}
-    for section in SECTIONS:
-        table = document
-        for part in section.split("."):
-            table = table.get(part, {})
-        if "key" in table:
-            result[section] = table["key"]
-    return result
-
-
-def fixtures():
-    canonical = "\n".join(f'[{section}]\nkey = "{value}"' for section, value in KEYS.items())
-    yield "canonical / final line without newline", canonical
-    yield "commented stale keys", canonical.replace("key =", '# key = "stale"\nkey =')
-    yield "commented headers / mixed line endings", "\n".join(
-        f'# [{section}]\r\n# key = "stale"\r\n[{section}]\nkey = "{value}"'
-        for section, value in KEYS.items()
-    )
-    yield "indented headers and keys / trailing comments", "\n".join(
-        f' \t[ {section} ] \t# header [note]\n \tkey \t= \t"{value}" # key comment'
-        for section, value in KEYS.items()
-    )
-    yield "CRLF", canonical.replace("\n", "\r\n")
-    yield "quoted and spaced section names", "\n".join(
-        f'["{section.split(".")[0]}" . \'{section.split(".")[1]}\''
-        + (f' . "{section.split(".")[2]}"' if section.count(".") == 2 else "")
-        + f'] # original table\nkey = "{value}"'
-        for section, value in KEYS.items()
-    )
-    yield "unrelated quoted header before JWT keys", '["custom section"]\nkey = "other"\n' + canonical
-    yield "brackets in comments", canonical.replace("key =", "# consult [notes]\nkey =")
-    yield "quoted values and quoted key names", "\n".join((
-        '[jwt.signing]\n"key" = "brackets[inside]#value"',
-        "[jwt.signing.read]\n'key' = 'literal\\path[#value]'",
-        r'[jwt.filer_signing]' + '\n' + r'key = "escaped\"quote\\slash\u0041"',
-        '[jwt.filer_signing.read]\nkey = ""',
-    ))
-    yield "absent keys and sections / unrelated key", '\n'.join((
-        '[jwt.signing]\nexpires_after_seconds = 10',
-        '[jwt.signing.read]\nkey = "read-only"',
-        '[unrelated]\nkey = "not-a-jwt-key"',
-        '# [jwt.filer_signing]\n# key = "not-active"',
-    ))
-    yield "no existing security.toml", ""
-
-
-def check_generated(value):
-    decoded = base64.b64decode(value, validate=True).decode("ascii")
-    assert len(decoded) == 10 and decoded.isascii() and decoded.isalnum(), "invalid generated JWT key"
-
-
-def check_helpers(helm, reference_helm):
-    # Exercise the real helper, not a second implementation of its matching rules.
-    with tempfile.TemporaryDirectory(prefix="helm-jwt-helper-") as directory:
-        chart = Path(directory)
-        (chart / "templates").mkdir()
-        (chart / "Chart.yaml").write_text("apiVersion: v2\nname: jwt-regression\nversion: 0.0.0\n")
-        shutil.copyfile(CHART / "templates/shared/_helpers.tpl", chart / "templates/_helpers.tpl")
-        entries = [
-            json.dumps(section) + ': {{ include "seaweedfs.existingTomlKey" (list '
-            + json.dumps(section) + ' .Values.raw) | toJson }}'
-            for section in SECTIONS
-        ]
-        template = chart / "templates/keys.yaml"
-        prefix = '{"apiVersion":"v1","kind":"ConfigMap","metadata":{"name":"keys"},"data":{'
-        helper_template = prefix + ",".join(entries) + "}}"
-        reference_entries = [
-            json.dumps(section) + ': {{ dig '
-            + " ".join(json.dumps(part) for part in section.split("."))
-            + ' "key" "__ABSENT__" (fromToml .Values.raw) | toJson }}'
-            for section in SECTIONS
-        ]
-        reference_template = prefix + ",".join(reference_entries) + "}}"
-
-        def render(binary, source, raw):
-            template.write_text(source)
-            values = chart / "input.json"
-            values.write_text(json.dumps({"raw": raw}))
-            output = run(binary, "template", "keys", str(chart), "-f", str(values))
-            return json.loads(output[output.index("{"):])["data"]
-
-        for name, raw in fixtures():
-            expected = keys(raw)
-            tokens = render(helm, helper_template, raw)
-            actual = {section: tomllib.loads("key = " + token)["key"]
-                      for section, token in tokens.items() if token != ""}
-            assert actual == expected, f"{name}: extracted keys differ from stored TOML"
-            if reference_helm:
-                reference = render(reference_helm, reference_template, raw)
-                reference = {section: value for section, value in reference.items() if value != "__ABSENT__"}
-                assert actual == reference, f"{name}: keys differ from fromToml/dig"
-            print(f"PASS helper: {name}")
-
-        # A present but unsupported value must not silently become a fresh key.
-        try:
-            render(helm, helper_template, '[jwt.signing]\nkey = """multi\nline"""')
-        except subprocess.CalledProcessError as error:
-            assert "refusing to replace an existing key" in error.stderr, error.stderr
-        else:
-            raise AssertionError("multiline existing key was silently accepted or replaced")
-        print("PASS helper: unsupported existing value fails without rotation")
-
-        try:
-            render(helm, helper_template, ESCAPED_HEADER)
-        except subprocess.CalledProcessError as error:
-            assert "unsupported quoted section header" in error.stderr, error.stderr
-        else:
-            raise AssertionError("unsupported quoted header silently rotated its key")
-        print("PASS helper: unsupported quoted header fails without rotation")
-
-
-def check_upgrades(helm, context):
-    namespace = "jwt-key-persist-" + uuid.uuid4().hex[:8]
-    current = "jk-seaweedfs-security-config"
-    legacy = "seaweedfs-security-config"
-    kubectl = ["kubectl", "--context", context, "-n", namespace]
-    release_args = ["jk", str(CHART), "--kube-context", context, "-n", namespace]
-    # No workload is needed to exercise Helm's real ConfigMap lookup and update.
-    for setting in (
-        "master.enabled=false", "volume.enabled=false", "filer.enabled=false",
-        "global.seaweedfs.createClusterRole=false",
-        "global.seaweedfs.securityConfig.jwtSigning.volumeWrite=true",
-        "global.seaweedfs.securityConfig.jwtSigning.volumeRead=true",
-        "global.seaweedfs.securityConfig.jwtSigning.filerWrite=true",
-        "global.seaweedfs.securityConfig.jwtSigning.filerRead=true",
-    ):
-        release_args += ["--set", setting]
-
-    def stored():
-        cm = json.loads(run(*kubectl, "get", "configmap", current, "-o", "json"))
-        return keys(cm["data"]["security.toml"])
-
-    def upgrade():
-        run(helm, "upgrade", *release_args)
-        return stored()
-
-    def patch(raw):
-        # Seed previous-release content without taking Helm 4's SSA ownership.
-        run(*kubectl, "patch", "configmap", current, "--type=merge", "--field-manager=helm", "-p",
-            json.dumps({"data": {"security.toml": raw}}))
-
-    run(*kubectl, "create", "namespace", namespace)
-    try:
-        run(helm, "install", *release_args)
-        initial = stored()
-        assert set(initial) == set(SECTIONS), "install omitted a JWT section"
-        for value in initial.values():
-            check_generated(value)
-        assert upgrade() == initial, "no-op upgrade changed an existing key"
-        print("PASS upgrade: all four generated keys persist")
-
-        for name, raw in fixtures():
-            patch(raw)
-            actual = upgrade()
-            expected = keys(raw)
-            assert set(actual) == set(SECTIONS), f"{name}: upgrade omitted a JWT section"
-            for section in SECTIONS:
-                if section in expected:
-                    assert actual[section] == expected[section], f"{name}: changed {section}"
-                else:
-                    check_generated(actual[section])
-            assert upgrade() == actual, f"{name}: subsequent upgrade changed a key"
-            print(f"PASS upgrade: {name}")
-
-        # Migration from the old chart name, followed by precedence of the current name.
-        legacy_raw = "\n".join(f'[{section}]\nkey = "legacy-{index}"'
-                               for index, section in enumerate(SECTIONS))
-        run(*kubectl, "create", "configmap", legacy, "--from-literal=security.toml=" + legacy_raw)
-        run(*kubectl, "delete", "configmap", current)
-        assert upgrade() == keys(legacy_raw), "legacy ConfigMap keys were not preserved"
-        print("PASS upgrade: legacy ConfigMap migration")
-        current_raw = next(fixtures())[1]
-        patch(current_raw)
-        assert upgrade() == keys(current_raw), "legacy ConfigMap overrode current ConfigMap"
-        print("PASS upgrade: current ConfigMap takes precedence")
-
-        patch(ESCAPED_HEADER)
-        try:
-            upgrade()
-        except subprocess.CalledProcessError as error:
-            assert "unsupported quoted section header" in error.stderr, error.stderr
-        else:
-            raise AssertionError("unsupported quoted header silently rotated its key")
-        assert keys(run(*kubectl, "get", "configmap", current, "-o",
-                        "jsonpath={.data.security\\.toml}"))["jwt.signing"] == "existing"
-        print("PASS upgrade: unsupported quoted header leaves stored key untouched")
-    finally:
-        run(*kubectl, "delete", "namespace", namespace, "--wait=false")
-
-
-def main():
-    parser = argparse.ArgumentParser(description=__doc__)
-    parser.add_argument("--helm", default="helm")
-    parser.add_argument("--reference-helm", help="Helm >=3.17 binary for differential checks")
-    parser.add_argument("--context", help="explicit disposable Kubernetes context for live upgrade checks")
-    args = parser.parse_args()
-    print(run(args.helm, "version", "--short").strip())
-    check_helpers(args.helm, args.reference_helm)
-    if args.context:
-        check_upgrades(args.helm, args.context)
-
-
-if __name__ == "__main__":
-    try:
-        main()
-    except subprocess.CalledProcessError as error:
-        print(error.stderr, file=sys.stderr)
-        sys.exit(error.returncode)

.github/workflows/codeql.yml

@@ -27,7 +27,7 @@ jobs:
 
       # Initializes the CodeQL tools for scanning.
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@v4.39.0
+        uses: github/codeql-action/init@v4.38.0
         # Override language selection by uncommenting this and choosing your languages
         with:
           languages: go
@@ -35,7 +35,7 @@ jobs:
       # Autobuild attempts to build any compiled languages (C/C++, C#, or Java).
       # If this step fails, then you should remove it and run the build manually (see below).
       - name: Autobuild
-        uses: github/codeql-action/autobuild@v4.39.0
+        uses: github/codeql-action/autobuild@v4.38.0
 
       # ℹ️ Command-line programs to run using the OS shell.
       # 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun
@@ -49,4 +49,4 @@ jobs:
       #     make release
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@v4.39.0
+        uses: github/codeql-action/analyze@v4.38.0

.github/workflows/container_dev.yml

@@ -6,7 +6,6 @@ on:
     paths:
       - 'weed/**'
       - 'seaweed-volume/**'
-      - 'seaweed-common/**'
       - 'seaweed-worker/**'
       - 'docker/**'
       - 'go.mod'
@@ -153,7 +152,7 @@ jobs:
             org.opencontainers.image.vendor=Chris Lu
 
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@v4.4.0
+        uses: docker/setup-qemu-action@v4.3.0
 
       - name: Create BuildKit config
         run: |

.github/workflows/container_foundationdb_version.yml

@@ -129,7 +129,7 @@ jobs:
           echo "seaweedfs_ref=$seaweed" >> "$GITHUB_OUTPUT"
 
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@v4.4.0
+        uses: docker/setup-qemu-action@v4.3.0
 
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v4

.github/workflows/container_latest.yml

@@ -156,7 +156,7 @@ jobs:
     runs-on: ubuntu-latest
     strategy:
       matrix:
-        platform: [amd64, arm64, arm, 386, ppc64le, s390x]
+        platform: [amd64, arm64, arm, 386]
         variant: ${{ fromJSON(needs.setup.outputs.variants) }}
 
     steps:
@@ -236,7 +236,7 @@ jobs:
             org.opencontainers.image.vendor=Chris Lu
       - name: Set up QEMU
         if: matrix.platform != 'amd64'
-        uses: docker/setup-qemu-action@v4.4.0
+        uses: docker/setup-qemu-action@v4.3.0
       - name: Create BuildKit config
         run: |
           cat > /tmp/buildkitd.toml <<EOF
@@ -405,7 +405,7 @@ jobs:
           output: trivy-results.sarif
           exit-code: '0'
       - name: Upload Trivy scan results to GitHub Security
-        uses: github/codeql-action/upload-sarif@v4.39.0
+        uses: github/codeql-action/upload-sarif@v4.38.0
         if: always()
         with:
           sarif_file: trivy-results.sarif
@@ -505,9 +505,7 @@ jobs:
             ghcr.io/chrislusf/seaweedfs:${BASE_TAG}${SUFFIX}-amd64 \
             ghcr.io/chrislusf/seaweedfs:${BASE_TAG}${SUFFIX}-arm64 \
             ghcr.io/chrislusf/seaweedfs:${BASE_TAG}${SUFFIX}-arm \
-            ghcr.io/chrislusf/seaweedfs:${BASE_TAG}${SUFFIX}-386 \
-            ghcr.io/chrislusf/seaweedfs:${BASE_TAG}${SUFFIX}-ppc64le \
-            ghcr.io/chrislusf/seaweedfs:${BASE_TAG}${SUFFIX}-s390x
+            ghcr.io/chrislusf/seaweedfs:${BASE_TAG}${SUFFIX}-386
           # The copy and the signature below use the digest this run pushed, not whatever the tag points at by then.
           DIGEST=$(jq -er '."containerimage.descriptor".digest' /tmp/manifest.json)
           echo "digest=${DIGEST}" >> "$GITHUB_OUTPUT"
@@ -551,15 +549,13 @@ jobs:
             echo "Using skopeo to copy..."
             retry_with_backoff skopeo copy --all docker://ghcr.io/chrislusf/seaweedfs@${DIGEST} docker://chrislusf/seaweedfs:${BASE_TAG}${SUFFIX}
           else
-            echo "Using docker buildx imagetools (pulling 6 images from Docker Hub)..."
+            echo "Using docker buildx imagetools (pulling 4 images from Docker Hub)..."
             # Fallback: create manifest directly on Docker Hub (pulls from Docker Hub - rate limited)
             retry_with_backoff docker buildx imagetools create -t chrislusf/seaweedfs:${BASE_TAG}${SUFFIX} \
               ghcr.io/chrislusf/seaweedfs:${BASE_TAG}${SUFFIX}-amd64 \
               ghcr.io/chrislusf/seaweedfs:${BASE_TAG}${SUFFIX}-arm64 \
               ghcr.io/chrislusf/seaweedfs:${BASE_TAG}${SUFFIX}-arm \
-              ghcr.io/chrislusf/seaweedfs:${BASE_TAG}${SUFFIX}-386 \
-              ghcr.io/chrislusf/seaweedfs:${BASE_TAG}${SUFFIX}-ppc64le \
-              ghcr.io/chrislusf/seaweedfs:${BASE_TAG}${SUFFIX}-s390x
+              ghcr.io/chrislusf/seaweedfs:${BASE_TAG}${SUFFIX}-386
           fi
 
       - name: Sign

.github/workflows/container_release_foundationdb.yml

@@ -46,7 +46,7 @@ jobs:
             org.opencontainers.image.vendor=Chris Lu
       -
         name: Set up QEMU
-        uses: docker/setup-qemu-action@v4.4.0
+        uses: docker/setup-qemu-action@v4.3.0
       -
         name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v4

.github/workflows/container_release_unified.yml

@@ -149,16 +149,12 @@ jobs:
           - { variant: normal, tag_suffix: "",             dockerfile: ./docker/Dockerfile.go_build, build_args: "",               rust_variant: normal,     platform: linux/arm64,  arch: arm64, runner: ubuntu-24.04-arm, qemu: false }
           - { variant: normal, tag_suffix: "",             dockerfile: ./docker/Dockerfile.go_build, build_args: "",               rust_variant: normal,     platform: linux/arm/v7, arch: armv7, runner: ubuntu-latest,    qemu: true }
           - { variant: normal, tag_suffix: "",             dockerfile: ./docker/Dockerfile.go_build, build_args: "",               rust_variant: normal,     platform: linux/386,    arch: i386,  runner: ubuntu-latest,    qemu: false }
-          - { variant: normal, tag_suffix: "",             dockerfile: ./docker/Dockerfile.go_build, build_args: "",               rust_variant: normal,     platform: linux/ppc64le, arch: ppc64le, runner: ubuntu-latest,  qemu: true }
-          - { variant: normal, tag_suffix: "",             dockerfile: ./docker/Dockerfile.go_build, build_args: "",               rust_variant: normal,     platform: linux/s390x,   arch: s390x, runner: ubuntu-latest,    qemu: true }
 
           # Large disk - multi-arch
           - { variant: large_disk, tag_suffix: _large_disk, dockerfile: ./docker/Dockerfile.go_build, build_args: TAGS=5BytesOffset, rust_variant: large-disk, platform: linux/amd64,  arch: amd64, runner: ubuntu-latest,    qemu: false }
           - { variant: large_disk, tag_suffix: _large_disk, dockerfile: ./docker/Dockerfile.go_build, build_args: TAGS=5BytesOffset, rust_variant: large-disk, platform: linux/arm64,  arch: arm64, runner: ubuntu-24.04-arm, qemu: false }
           - { variant: large_disk, tag_suffix: _large_disk, dockerfile: ./docker/Dockerfile.go_build, build_args: TAGS=5BytesOffset, rust_variant: large-disk, platform: linux/arm/v7, arch: armv7, runner: ubuntu-latest,    qemu: true }
           - { variant: large_disk, tag_suffix: _large_disk, dockerfile: ./docker/Dockerfile.go_build, build_args: TAGS=5BytesOffset, rust_variant: large-disk, platform: linux/386,    arch: i386,  runner: ubuntu-latest,    qemu: false }
-          - { variant: large_disk, tag_suffix: _large_disk, dockerfile: ./docker/Dockerfile.go_build, build_args: TAGS=5BytesOffset, rust_variant: large-disk, platform: linux/ppc64le, arch: ppc64le, runner: ubuntu-latest,  qemu: true }
-          - { variant: large_disk, tag_suffix: _large_disk, dockerfile: ./docker/Dockerfile.go_build, build_args: TAGS=5BytesOffset, rust_variant: large-disk, platform: linux/s390x,   arch: s390x, runner: ubuntu-latest,    qemu: true }
 
           # Full tags - multi-arch
           - { variant: full, tag_suffix: _full, dockerfile: ./docker/Dockerfile.go_build, build_args: "TAGS=elastic,gocdk,rclone,sqlite,tarantool,tikv,ydb", rust_variant: normal, platform: linux/amd64, arch: amd64, runner: ubuntu-latest,    qemu: false }
@@ -235,7 +231,7 @@ jobs:
 
       - name: Set up QEMU
         if: (github.event_name != 'workflow_dispatch' || github.event.inputs.variant == 'all' || github.event.inputs.variant == matrix.variant) && matrix.qemu
-        uses: docker/setup-qemu-action@v4.4.0
+        uses: docker/setup-qemu-action@v4.3.0
 
       - name: Create BuildKit config
         if: github.event_name != 'workflow_dispatch' || github.event.inputs.variant == 'all' || github.event.inputs.variant == matrix.variant
@@ -460,7 +456,7 @@ jobs:
 
       - name: Upload Trivy scan results to GitHub Security
         if: always()
-        uses: github/codeql-action/upload-sarif@v4.39.0
+        uses: github/codeql-action/upload-sarif@v4.38.0
         with:
           sarif_file: trivy-results.sarif
           category: trivy-${{ matrix.variant }}

.github/workflows/container_rocksdb_version.yml

@@ -85,7 +85,7 @@ jobs:
           echo "seaweedfs_ref=$seaweed" >> "$GITHUB_OUTPUT"
 
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@99012661954931238ded8c8b007157a8430204e1 # v1
+        uses: docker/setup-qemu-action@1f40c72289eff860ee54a304f1438e3cff362e0a # v1
 
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v1

.github/workflows/go.yml

@@ -148,21 +148,3 @@ jobs:
     # -short skips the e2e suites already covered on amd64.
     - name: Test linux/386
       run: cd weed; GOOS=linux GOARCH=386 go test -short ./...
-
-  build-azurekms:
-    name: Build and test with azurekms tag
-    runs-on: ubuntu-latest
-    steps:
-    - name: Check out code into the Go module directory
-      uses: actions/checkout@v7
-    - name: Set up Go
-      uses: actions/setup-go@v7
-      with:
-        go-version-file: 'go.mod'
-    # weed/kms/azure is excluded from every default build, so without this
-    # nothing compiles it and tag-gated code silently rots.
-    - name: Build and test with azurekms
-      run: |
-        cd weed
-        go build -tags azurekms ./...
-        go test -tags azurekms ./kms/...

.github/workflows/helm_ci.yml

@@ -3,10 +3,10 @@ name: "helm: lint and test charts"
 on:
   push:
     branches: [ master ]
-    paths: ['k8s/**', '.github/workflows/helm_ci.yml', '.github/scripts/helm_jwt_keys.py']
+    paths: ['k8s/**', '.github/workflows/helm_ci.yml']
   pull_request:
     branches: [ master ]
-    paths: ['k8s/**', '.github/workflows/helm_ci.yml', '.github/scripts/helm_jwt_keys.py']
+    paths: ['k8s/**', '.github/workflows/helm_ci.yml']
 
 permissions:
   contents: read
@@ -20,14 +20,6 @@ jobs:
         with:
           fetch-depth: 0
 
-      - name: Set up Helm before fromToml was available
-        uses: azure/setup-helm@v5
-        with:
-          version: v3.16.3
-
-      - name: Record legacy Helm binary
-        run: echo "HELM_LEGACY=$(command -v helm)" >> "$GITHUB_ENV"
-
       - name: Set up Helm
         uses: azure/setup-helm@v5
         with:
@@ -39,7 +31,7 @@ jobs:
           check-latest: true
 
       - name: Set up chart-testing
-        uses: helm/chart-testing-action@v2.9.0
+        uses: helm/chart-testing-action@v2.8.0
 
       - name: Run chart-testing (list-changed)
         id: list-changed
@@ -52,17 +44,6 @@ jobs:
       - name: Run chart-testing (lint)
         run: ct lint --target-branch ${{ github.event.repository.default_branch }} --all --validate-maintainers=false --chart-dirs k8s/charts
 
-      - name: Verify legacy Helm rendering
-        run: |
-          "$HELM_LEGACY" lint k8s/charts/seaweedfs
-          "$HELM_LEGACY" template test k8s/charts/seaweedfs > "$RUNNER_TEMP/legacy-default.yaml"
-          "$HELM_LEGACY" template test k8s/charts/seaweedfs \
-            --set global.seaweedfs.securityConfig.jwtSigning.volumeRead=true \
-            --set global.seaweedfs.securityConfig.jwtSigning.filerWrite=true \
-            --set global.seaweedfs.securityConfig.jwtSigning.filerRead=true \
-            > "$RUNNER_TEMP/legacy-jwt.yaml"
-
-
       - name: Verify template rendering
         run: |
           set -e
@@ -76,60 +57,7 @@ jobs:
           helm template test $CHART_DIR --set s3.enabled=true > /tmp/s3.yaml
           grep -q "kind: Deployment" /tmp/s3.yaml && grep -q "seaweedfs-s3" /tmp/s3.yaml
           echo "S3 deployment renders correctly"
-
-          echo "=== Testing S3 rollout settings ==="
-          helm template test $CHART_DIR --show-only templates/s3/s3-deployment.yaml \
-            --set s3.enabled=true > /tmp/s3-rollout-defaults.yaml
-          grep -q "terminationGracePeriodSeconds: 10$" /tmp/s3-rollout-defaults.yaml
-          test "$(grep -cE '^  strategy:|^ +lifecycle:' /tmp/s3-rollout-defaults.yaml)" -eq 0
-          helm template test $CHART_DIR --show-only templates/s3/s3-deployment.yaml \
-            --set s3.enabled=true \
-            --set s3.terminationGracePeriodSeconds=30 \
-            --set s3.updateStrategy.type=RollingUpdate \
-            --set s3.updateStrategy.rollingUpdate.maxUnavailable=0 \
-            --set-string 's3.lifecycle.preStop.exec.command={sleep,5}' \
-            > /tmp/s3-rollout.yaml
-          grep -q "terminationGracePeriodSeconds: 30$" /tmp/s3-rollout.yaml
-          grep -A 4 "^  strategy:" /tmp/s3-rollout.yaml | grep -q "maxUnavailable: 0"
-          grep -A 4 "^  strategy:" /tmp/s3-rollout.yaml | grep -q "type: RollingUpdate"
-          grep -A 5 "^          lifecycle:" /tmp/s3-rollout.yaml | grep -q -- "- sleep"
-          echo "S3 rollout settings render correctly"
-
-          echo "=== Testing the S3 config checksum is stable across renders ==="
-          # s3-secret.yaml keeps its generated keys with lookup. Hashing the rendered
-          # Secret drew new keys for the checksum whenever lookup found nothing (on
-          # install), so the first upgrade changed the checksum and restarted the
-          # filer and S3 pods although nothing had changed.
-          s3_checksum() {  # <template> <helm args...>: the checksum/s3config of one workload
-            local template=$1; shift
-            local sum
-            sum=$(helm template test $CHART_DIR --show-only "$template" "$@" \
-              | grep 'checksum/s3config:' | awk '{print $2}')
-            test -n "$sum" || { echo "no checksum/s3config in $template" >&2; return 1; }
-            echo "$sum"
-          }
-          s3_auth_args=(--set s3.enabled=true --set s3.enableAuth=true)
-          s3_sum=$(s3_checksum templates/s3/s3-deployment.yaml "${s3_auth_args[@]}")
-          filer_sum=$(s3_checksum templates/filer/filer-statefulset.yaml "${s3_auth_args[@]}")
-          test "$s3_sum" = "$filer_sum"   # one Secret, one checksum
-          test "$s3_sum" = "$(s3_checksum templates/s3/s3-deployment.yaml "${s3_auth_args[@]}")"
-          s3_creds_sum=$(s3_checksum templates/s3/s3-deployment.yaml "${s3_auth_args[@]}" \
-            --set s3.credentials.admin.accessKey=a --set s3.credentials.admin.secretKey=b)
-          test "$s3_sum" != "$s3_creds_sum"
-          filer_audit_sum=$(s3_checksum templates/filer/filer-statefulset.yaml "${s3_auth_args[@]}" \
-            --set-json 'filer.s3.auditLogConfig={"fluent_port":24224}')
-          test "$filer_sum" != "$filer_audit_sum"
-          # Settings the Secret does not read must not restart the S3 and filer pods.
-          test "$filer_sum" = "$(s3_checksum templates/filer/filer-statefulset.yaml "${s3_auth_args[@]}" \
-            --set s3.replicas=3 --set s3.resources.limits.cpu=1)"
-          all_in_one_args=(--set allInOne.enabled=true --set allInOne.s3.enabled=true --set allInOne.s3.enableAuth=true)
-          aio_sum=$(s3_checksum templates/all-in-one/all-in-one-deployment.yaml "${all_in_one_args[@]}")
-          test "$aio_sum" = "$(s3_checksum templates/all-in-one/all-in-one-deployment.yaml "${all_in_one_args[@]}")"
-          aio_creds_sum=$(s3_checksum templates/all-in-one/all-in-one-deployment.yaml "${all_in_one_args[@]}" \
-            --set s3.credentials.admin.accessKey=a --set s3.credentials.admin.secretKey=b)
-          test "$aio_sum" != "$aio_creds_sum"
-          echo "S3 config checksum is stable and follows only what the S3 Secret reads"
-
+          
           echo "=== Testing S3 credentials from an existing secret ==="
           credential_args=(
             --set s3.credentials.admin.existingSecret=minio-root
@@ -168,23 +96,6 @@ jobs:
           grep -A 12 "^kind: Ingress" /tmp/s3-ingress-labels.yaml | grep -q "^    external-dns: s3"
           echo "S3 ingress renders custom labels"
 
-          echo "=== Testing HTTPRoute ==="
-          helm template test $CHART_DIR --show-only templates/s3/s3-httproute.yaml \
-            --set s3.enabled=true,s3.httpRoute.enabled=true \
-            --set 's3.httpRoute.parentRefs[0].name=gateway' > /tmp/s3-httproute.yaml
-          grep -q "^kind: HTTPRoute" /tmp/s3-httproute.yaml
-          grep -A 4 -- '- group: ""' /tmp/s3-httproute.yaml | grep -q "name: test-seaweedfs-s3$"
-          grep -A 4 -- '- group: ""' /tmp/s3-httproute.yaml | grep -q "port: 8333$"
-          echo "S3 HTTPRoute routes to the s3 service by default"
-          helm template test $CHART_DIR --show-only templates/s3/s3-httproute.yaml \
-            --set filer.s3.enabled=true,filer.s3.port=8334,s3.httpRoute.enabled=true > /tmp/filer-s3-httproute.yaml
-          grep -A 4 -- '- group: ""' /tmp/filer-s3-httproute.yaml | grep -q "port: 8334$"
-          echo "S3 on filer HTTPRoute uses filer.s3.port"
-          helm template test $CHART_DIR --show-only templates/master/master-httproute.yaml \
-            --set allInOne.enabled=true,master.enabled=false,master.httpRoute.enabled=true > /tmp/allinone-master-httproute.yaml
-          grep -A 4 -- '- group: ""' /tmp/allinone-master-httproute.yaml | grep -q "name: test-seaweedfs-all-in-one$"
-          echo "All-in-one master HTTPRoute routes to the all-in-one service"
-
           echo "=== Testing with all-in-one mode ==="
           helm template test $CHART_DIR --set allInOne.enabled=true > /tmp/allinone.yaml
           grep -q "seaweedfs-all-in-one" /tmp/allinone.yaml
@@ -205,35 +116,6 @@ jobs:
           grep -q "security-config" /tmp/security.yaml
           echo "Security configuration renders correctly"
 
-          echo "=== Testing secure bucket-creation hook certificate mounts ==="
-          helm template test $CHART_DIR \
-            --show-only templates/shared/post-install-bucket-hook.yaml \
-            --set s3.enabled=true \
-            --set 's3.createBuckets[0].name=data' \
-            --set global.seaweedfs.enableSecurity=true \
-            > /tmp/security-bucket-hook.yaml
-          test "$(grep -cE '^[[:space:]]*- name: ca-cert$' /tmp/security-bucket-hook.yaml)" -eq 2
-          test "$(grep -cE '^[[:space:]]*- name: client-cert$' /tmp/security-bucket-hook.yaml)" -eq 2
-          grep -q 'mountPath: /usr/local/share/ca-certificates/ca/' /tmp/security-bucket-hook.yaml
-          grep -q 'mountPath: /usr/local/share/ca-certificates/client/' /tmp/security-bucket-hook.yaml
-          grep -q 'secretName: test-seaweedfs-ca-cert' /tmp/security-bucket-hook.yaml
-          grep -q 'secretName: test-seaweedfs-client-cert' /tmp/security-bucket-hook.yaml
-          echo "Secure bucket-creation hook mounts its CA and client certificate"
-
-          echo ""
-          echo "=== Testing admin.allowInsecureBind satisfies the admin auth render guard ==="
-          helm template test $CHART_DIR --set admin.enabled=true --set admin.allowInsecureBind=true \
-            > /tmp/admin-allow-insecure-bind.yaml
-          grep -q -- "-allowInsecureBind" /tmp/admin-allow-insecure-bind.yaml
-          echo "admin.allowInsecureBind renders -allowInsecureBind and passes the render guard"
-
-          if helm template test $CHART_DIR --set admin.enabled=true > /tmp/admin-no-auth.yaml 2>/tmp/admin-no-auth.err; then
-            echo "FAIL: admin.enabled=true with no auth configured should fail to render"
-            exit 1
-          fi
-          grep -q "admin.allowInsecureBind" /tmp/admin-no-auth.err
-          echo "admin with no auth configured still fails the render guard, and the guard mentions admin.allowInsecureBind"
-
           echo ""
           echo "=== Testing JWT expiration overrides ==="
           helm template test $CHART_DIR \
@@ -822,168 +704,6 @@ jobs:
           helm template test $CHART_DIR --set cosi.enabled=true > /tmp/cosi.yaml
           grep -q "seaweedfs-cosi" /tmp/cosi.yaml
           echo "COSI driver renders correctly"
-
-          echo ""
-          echo "=== Testing configurable pod and container security contexts ==="
-          helm template test $CHART_DIR > /tmp/security-context-defaults.yaml
-
-          security_context_args=()
-          for component in master volume filer s3 sftp admin worker allInOne cosi; do
-            security_context_args+=(
-              --set "$component.podSecurityContext.enabled=true"
-              --set "$component.podSecurityContext.seccompProfile.type=RuntimeDefault"
-              --set "$component.containerSecurityContext.enabled=true"
-              --set "$component.containerSecurityContext.privileged=false"
-              --set "$component.containerSecurityContext.allowPrivilegeEscalation=false"
-              --set "$component.containerSecurityContext.readOnlyRootFilesystem=true"
-              --set "$component.containerSecurityContext.capabilities.drop[0]=ALL"
-              --set "$component.containerSecurityContext.seccompProfile.type=RuntimeDefault"
-            )
-          done
-
-          helm template test $CHART_DIR \
-            "${security_context_args[@]}" \
-            --set s3.enabled=true \
-            --set s3.createBuckets[0].name=test \
-            --set sftp.enabled=true \
-            --set admin.enabled=true \
-            --set admin.secret.adminPassword=ci-admin-password \
-            --set worker.enabled=true \
-            --set volume.idx.type=hostPath \
-            --set volume.idx.hostPathPrefix=/tmp \
-            --set cosi.enabled=true \
-            --set global.seaweedfs.tmpDir.sizeLimit=64Mi > /tmp/security-contexts.yaml
-          helm template test $CHART_DIR \
-            "${security_context_args[@]}" \
-            --set allInOne.enabled=true \
-            --set master.enabled=false \
-            --set volume.enabled=false \
-            --set filer.enabled=false \
-            --set global.seaweedfs.tmpDir.sizeLimit=64Mi > /tmp/security-contexts-aio.yaml
-          python3 - /tmp/security-context-defaults.yaml /tmp/security-contexts.yaml /tmp/security-contexts-aio.yaml <<'PYEOF'
-          import sys
-
-          import yaml
-
-          errors = []
-          workloads = 0
-          containers = 0
-          chart_managed_init_containers = 0
-          components = set()
-
-          def validate_container(workload_name, container):
-              context = container.get("securityContext", {})
-              prefix = f"{workload_name}/{container['name']}"
-              if "enabled" in context:
-                  errors.append(f"{prefix}: internal enabled flag leaked into container securityContext")
-              if context.get("privileged") is not False:
-                  errors.append(f"{prefix}: privileged is not false")
-              if context.get("allowPrivilegeEscalation") is not False:
-                  errors.append(f"{prefix}: allowPrivilegeEscalation is not false")
-              if context.get("readOnlyRootFilesystem") is not True:
-                  errors.append(f"{prefix}: readOnlyRootFilesystem is not true")
-              if context.get("capabilities", {}).get("drop") != ["ALL"]:
-                  errors.append(f"{prefix}: capabilities.drop is not exactly [ALL]")
-              if context.get("seccompProfile", {}).get("type") != "RuntimeDefault":
-                  errors.append(f"{prefix}: seccompProfile is not RuntimeDefault")
-              mounts = {mount["name"]: mount for mount in container.get("volumeMounts", [])}
-              if mounts.get("seaweedfs-tmp", {}).get("mountPath") != "/tmp":
-                  errors.append(f"{prefix}: writable temporary volume is not mounted at /tmp")
-
-          with open(sys.argv[1]) as stream:
-              default_documents = [document for document in yaml.safe_load_all(stream) if document]
-          for document in default_documents:
-              if document.get("kind") not in ("Deployment", "StatefulSet", "Job"):
-                  continue
-              name = document["metadata"]["name"]
-              pod = document["spec"]["template"]["spec"]
-              if "securityContext" in pod:
-                  errors.append(f"{name}: pod securityContext should be absent by default")
-              if any(volume["name"] == "seaweedfs-tmp" for volume in pod.get("volumes", [])):
-                  errors.append(f"{name}: writable /tmp volume should be absent by default")
-              for container in pod.get("containers", []):
-                  if "securityContext" in container:
-                      errors.append(
-                          f"{name}/{container['name']}: container securityContext "
-                          f"should be absent by default"
-                      )
-                  if any(
-                      mount["name"] == "seaweedfs-tmp"
-                      for mount in container.get("volumeMounts", [])
-                  ):
-                      errors.append(
-                          f"{name}/{container['name']}: writable /tmp mount "
-                          f"should be absent by default"
-                      )
-
-          for path in sys.argv[2:]:
-              with open(path) as stream:
-                  documents = [document for document in yaml.safe_load_all(stream) if document]
-              for document in documents:
-                  if document.get("kind") not in ("Deployment", "StatefulSet", "Job"):
-                      continue
-                  workloads += 1
-                  name = document["metadata"]["name"]
-                  pod = document["spec"]["template"]["spec"]
-                  volumes = {volume["name"]: volume for volume in pod.get("volumes", [])}
-                  temporary = volumes.get("seaweedfs-tmp", {}).get("emptyDir")
-                  if temporary is None:
-                      errors.append(f"{name}: writable /tmp emptyDir is missing")
-                  elif temporary.get("sizeLimit") != "64Mi":
-                      errors.append(f"{name}: temporary volume sizeLimit is not 64Mi")
-                  component = document["spec"]["template"]["metadata"]["labels"].get("app.kubernetes.io/component")
-                  if component:
-                      components.add(component)
-                  else:
-                      errors.append(f"{name}: app.kubernetes.io/component label is missing")
-                  pod_context = pod.get("securityContext", {})
-                  if "enabled" in pod_context:
-                      errors.append(f"{name}: internal enabled flag leaked into pod securityContext")
-                  if pod_context.get("seccompProfile", {}).get("type") != "RuntimeDefault":
-                      errors.append(f"{name}: pod seccompProfile is not RuntimeDefault")
-                  for container in pod.get("containers", []):
-                      containers += 1
-                      validate_container(name, container)
-                  for container in pod.get("initContainers", []):
-                      if container["name"] != "seaweedfs-vol-move-idx":
-                          continue
-                      chart_managed_init_containers += 1
-                      validate_container(name, container)
-
-          expected_components = {
-              "master", "volume", "filer", "s3", "sftp", "admin", "worker",
-              "objectstorage-provisioner", "bucket-hook", "seaweedfs-all-in-one",
-          }
-          if components != expected_components:
-              errors.append(
-                  f"security context workload coverage is incomplete: "
-                  f"expected {sorted(expected_components)}, got {sorted(components)}"
-              )
-          if workloads != 10 or containers != 12:
-              errors.append(
-                  f"expected 10 workloads and 12 containers, got "
-                  f"{workloads} workloads and {containers} containers"
-              )
-          if chart_managed_init_containers != 1:
-              errors.append(
-                  f"expected one chart-managed seaweedfs-vol-move-idx init container, "
-                  f"got {chart_managed_init_containers}"
-              )
-
-          if errors:
-              print("\n".join(f"FAIL: {error}" for error in errors), file=sys.stderr)
-              sys.exit(1)
-          print(f"Validated security contexts on {workloads} workloads and {containers} containers")
-          PYEOF
-
-          # The resize hook depends on lookup finding a live StatefulSet and
-          # therefore cannot render during helm template. Keep static coverage
-          # for both security-context blocks.
-          grep -Fqx '      securityContext: {{- omit .Values.volume.podSecurityContext "enabled" | toYaml | nindent 8 }}' \
-            "$CHART_DIR/templates/volume/volume-resize-hook.yaml"
-          grep -Fqx '          securityContext: {{- omit .Values.volume.containerSecurityContext "enabled" | toYaml | nindent 12 }}' \
-            "$CHART_DIR/templates/volume/volume-resize-hook.yaml"
-          echo "Volume resize hook security contexts are covered"
           
           echo ""
           echo "=== Testing long release name: service names match DNS references ==="
@@ -1869,79 +1589,7 @@ jobs:
           echo "IMAGE_TAG=$TAG" >> $GITHUB_ENV
 
       - name: Create kind cluster
-        uses: helm/kind-action@v1.15.1
-
-      - name: Verify volume resize hook security contexts
-        run: |
-          set -e
-          CHART_DIR="k8s/charts/seaweedfs"
-          NS="resize-hook-security"
-          kubectl create namespace "$NS"
-          kubectl apply -n "$NS" -f - <<'EOF'
-          apiVersion: v1
-          kind: PersistentVolumeClaim
-          metadata:
-            name: data1-resize-seaweedfs-volume-0
-          spec:
-            accessModes:
-              - ReadWriteOnce
-            resources:
-              requests:
-                storage: 1Gi
-          EOF
-
-          helm template resize "$CHART_DIR" -n "$NS" --dry-run=server \
-            --set volume.dataDirs[0].name=data1 \
-            --set volume.dataDirs[0].type=persistentVolumeClaim \
-            --set volume.dataDirs[0].size=2Gi \
-            --set volume.podSecurityContext.enabled=true \
-            --set volume.podSecurityContext.seccompProfile.type=RuntimeDefault \
-            --set volume.containerSecurityContext.enabled=true \
-            --set volume.containerSecurityContext.privileged=false \
-            --set volume.containerSecurityContext.allowPrivilegeEscalation=false \
-            --set volume.containerSecurityContext.readOnlyRootFilesystem=true \
-            --set volume.containerSecurityContext.capabilities.drop[0]=ALL \
-            --set volume.containerSecurityContext.seccompProfile.type=RuntimeDefault \
-            --set global.seaweedfs.tmpDir.sizeLimit=64Mi \
-            > /tmp/security-context-resize-hook.yaml
-
-          python3 - /tmp/security-context-resize-hook.yaml <<'PYEOF'
-          import sys
-
-          import yaml
-
-          with open(sys.argv[1]) as stream:
-              documents = [document for document in yaml.safe_load_all(stream) if document]
-
-          jobs = [
-              document for document in documents
-              if document.get("kind") == "Job"
-              and document["metadata"]["name"].endswith("-volume-resize-hook")
-          ]
-          if len(jobs) != 1:
-              raise AssertionError(f"expected one volume resize hook Job, got {len(jobs)}")
-
-          pod = jobs[0]["spec"]["template"]["spec"]
-          assert pod["securityContext"] == {
-              "seccompProfile": {"type": "RuntimeDefault"},
-          }
-          assert len(pod["containers"]) == 1
-          assert pod["containers"][0]["securityContext"] == {
-              "allowPrivilegeEscalation": False,
-              "capabilities": {"drop": ["ALL"]},
-              "privileged": False,
-              "readOnlyRootFilesystem": True,
-              "seccompProfile": {"type": "RuntimeDefault"},
-          }
-          assert pod["containers"][0]["volumeMounts"] == [
-              {"mountPath": "/tmp", "name": "seaweedfs-tmp"},
-          ]
-          assert pod["volumes"] == [
-              {"emptyDir": {"sizeLimit": "64Mi"}, "name": "seaweedfs-tmp"},
-          ]
-          PYEOF
-          kubectl delete namespace "$NS"
-          echo "Volume resize hook security contexts render correctly"
+        uses: helm/kind-action@v1.15.0
 
       - name: Run chart-testing (install)
         run: |
@@ -1993,16 +1641,6 @@ jobs:
           kubectl delete namespace "$NS"
           echo "SFTP host key lifecycle tests passed"
 
-      - name: Verify JWT signing key persistence across upgrades
-        run: |
-          # chart-testing puts its pip-less venv first on PATH; use setup-python.
-          PYTHON="$pythonLocation/bin/python3"
-          "$PYTHON" -m pip install tomli==2.2.1
-          CONTEXT=$(kubectl config current-context)
-          "$PYTHON" .github/scripts/helm_jwt_keys.py --context "$CONTEXT"
-          "$PYTHON" .github/scripts/helm_jwt_keys.py --helm "$HELM_LEGACY" \
-            --reference-helm helm --context "$CONTEXT"
-
       - name: Verify install into a default-deny namespace
         run: |
           set -e

.github/workflows/performance.yml

@@ -8,7 +8,6 @@ on:
       - 'go.mod'
       - 'go.sum'
       - 'seaweed-volume/**'
-      - 'seaweed-common/**'
       - 'test/perf/**'
       - '.github/workflows/performance.yml'
   workflow_dispatch:

.github/workflows/rust-volume-server-tests.yml

@@ -5,7 +5,6 @@ on:
     branches: [ master ]
     paths:
       - 'seaweed-volume/**'
-      - 'seaweed-common/**'
       - 'test/volume_server/**'
       - 'weed/pb/volume_server.proto'
       - 'weed/pb/volume_server_pb/**'
@@ -14,7 +13,6 @@ on:
     branches: [ master, main ]
     paths:
       - 'seaweed-volume/**'
-      - 'seaweed-common/**'
       - 'test/volume_server/**'
       - 'weed/pb/volume_server.proto'
       - 'weed/pb/volume_server_pb/**'
@@ -45,7 +43,7 @@ jobs:
 
       - name: Filter changed paths
         id: filter
-        uses: dorny/paths-filter@v4
+        uses: dorny/paths-filter@v3
         with:
           filters: |
             rust:
@@ -77,7 +75,7 @@ jobs:
             ~/.cargo/registry
             ~/.cargo/git
             seaweed-volume/target
-          key: rust-${{ steps.toolchain.outputs.fingerprint }}-${{ hashFiles('seaweed-volume/Cargo.lock', 'seaweed-common/Cargo.lock') }}
+          key: rust-${{ steps.toolchain.outputs.fingerprint }}-${{ hashFiles('seaweed-volume/Cargo.lock') }}
           restore-keys: |
             rust-${{ steps.toolchain.outputs.fingerprint }}-
 
@@ -95,16 +93,6 @@ jobs:
       # - name: Check formatting
       #   run: cd seaweed-volume && cargo fmt --check
 
-      # seaweed-common is a path dependency of this crate, not a member of its
-      # workspace, so the run below does not reach its own tests. It builds into
-      # this job's cached target directory, and the cache key above covers the
-      # shared crate's lock, so the aws-lc-sys that rustls pulls in is restored
-      # with the cache instead of compiled from scratch on every run.
-      - name: Run shared-crate unit tests
-        env:
-          CARGO_TARGET_DIR: ${{ github.workspace }}/seaweed-volume/target
-        run: cd seaweed-common && cargo test
-
       - name: Run Rust unit tests
         run: cd seaweed-volume && cargo test
 
@@ -180,7 +168,7 @@ jobs:
             ~/.cargo/registry
             ~/.cargo/git
             seaweed-volume/target
-          key: rust-${{ steps.toolchain.outputs.fingerprint }}-${{ hashFiles('seaweed-volume/Cargo.lock', 'seaweed-common/Cargo.lock') }}
+          key: rust-${{ steps.toolchain.outputs.fingerprint }}-${{ hashFiles('seaweed-volume/Cargo.lock') }}
           restore-keys: |
             rust-${{ steps.toolchain.outputs.fingerprint }}-
 
@@ -262,7 +250,7 @@ jobs:
             ~/.cargo/registry
             ~/.cargo/git
             seaweed-volume/target
-          key: rust-${{ steps.toolchain.outputs.fingerprint }}-${{ hashFiles('seaweed-volume/Cargo.lock', 'seaweed-common/Cargo.lock') }}
+          key: rust-${{ steps.toolchain.outputs.fingerprint }}-${{ hashFiles('seaweed-volume/Cargo.lock') }}
           restore-keys: |
             rust-${{ steps.toolchain.outputs.fingerprint }}-
 

.github/workflows/rust-worker-tests.yml

@@ -5,14 +5,12 @@ on:
     branches: [ master ]
     paths:
       - 'seaweed-worker/**'
-      - 'seaweed-common/**'
       - 'weed/pb/plugin.proto'
       - '.github/workflows/rust-worker-tests.yml'
   push:
     branches: [ master, main ]
     paths:
       - 'seaweed-worker/**'
-      - 'seaweed-common/**'
       - 'weed/pb/plugin.proto'
       - '.github/workflows/rust-worker-tests.yml'
 
@@ -51,7 +49,7 @@ jobs:
             ~/.cargo/registry
             ~/.cargo/git
             seaweed-worker/target/release
-          key: rust-worker-${{ steps.toolchain.outputs.fingerprint }}-${{ hashFiles('seaweed-worker/Cargo.lock', 'seaweed-common/Cargo.lock') }}
+          key: rust-worker-${{ steps.toolchain.outputs.fingerprint }}-${{ hashFiles('seaweed-worker/Cargo.lock') }}
           restore-keys: |
             rust-worker-${{ steps.toolchain.outputs.fingerprint }}-
 
@@ -86,17 +84,6 @@ jobs:
       # - name: Check formatting
       #   run: cd seaweed-worker && cargo fmt --all --check
 
-      # seaweed-common is a path dependency of core and lance, not a member of
-      # this workspace, so `--workspace` below does not reach its own tests.
-      # Release and this job's cached target directory, and the cache key above
-      # covers the shared crate's lock. That lock pins the same rustls and
-      # aws-lc-sys this workspace resolves, so the release build above has
-      # already paid for them.
-      - name: Run shared-crate unit tests
-        env:
-          CARGO_TARGET_DIR: ${{ github.workspace }}/seaweed-worker/target
-        run: cd seaweed-common && cargo test --release
-
       # The tests that need a live gateway skip themselves without one, the way
       # the Go integration tests skip without Docker; the lifecycle suite in
       # test/s3tables/lifecycle is what runs them against a real cluster.

.github/workflows/rust_binaries_dev.yml

@@ -5,7 +5,6 @@ on:
     branches: [ master ]
     paths:
       - 'seaweed-volume/**'
-      - 'seaweed-common/**'
       - '.github/workflows/rust_binaries_dev.yml'
 
 permissions:

.github/workflows/s3-parquet-tests.yml

@@ -139,8 +139,7 @@ jobs:
   unit-tests:
     name: Go Unit Tests (Implicit Directory)
     runs-on: ubuntu-latest
-    # Leave time for setup and the focused run before the nine-minute suite.
-    timeout-minutes: 20
+    timeout-minutes: 10
     
     steps:
       - name: Checkout code
@@ -160,5 +159,5 @@ jobs:
       - name: Run all S3 API tests
         run: |
           cd weed/s3api
-          go test -v -timeout 9m
+          go test -v -timeout 5m
 

.github/workflows/s3-snowflake-tests.yml

@@ -1,106 +0,0 @@
-name: "Snowflake S3Compat API tests"
-
-on:
-  push:
-    branches: [ master ]
-    paths:
-      - 'weed/s3api/**'
-      - 'weed/filer/**'
-      - 'weed/server/**'
-      - 'weed/iam/**'
-      - 'weed/command/**'
-      - 'weed/storage/**'
-      - 'weed/operation/**'
-      - 'weed/wdclient/**'
-      - 'weed/cluster/**'
-      - 'weed/pb/**'
-      - 'test/s3/snowflake/**'
-      - 'go.mod'
-      - 'go.sum'
-      - '.github/workflows/s3-snowflake-tests.yml'
-  pull_request:
-    branches: [ master ]
-    paths:
-      - 'weed/s3api/**'
-      - 'weed/filer/**'
-      - 'weed/server/**'
-      - 'weed/iam/**'
-      - 'weed/command/**'
-      - 'weed/storage/**'
-      - 'weed/operation/**'
-      - 'weed/wdclient/**'
-      - 'weed/cluster/**'
-      - 'weed/pb/**'
-      - 'test/s3/snowflake/**'
-      - 'go.mod'
-      - 'go.sum'
-      - '.github/workflows/s3-snowflake-tests.yml'
-
-concurrency:
-  group: ${{ github.event.pull_request.number || github.ref }}/s3-snowflake-tests
-  cancel-in-progress: true
-
-permissions:
-  contents: read
-
-jobs:
-  snowflake-s3compat-tests:
-    name: Snowflake S3Compat API tests
-    runs-on: ubuntu-22.04
-    timeout-minutes: 30
-    env:
-      WORK_DIR: /tmp/seaweedfs-snowflake-tests
-    steps:
-      - name: Check out code
-        uses: actions/checkout@v7
-        with:
-          persist-credentials: false
-
-      - name: Set up Go
-        uses: actions/setup-go@v7
-        with:
-          go-version-file: 'go.mod'
-        id: go
-
-      - name: Set up Java
-        uses: actions/setup-java@v6
-        with:
-          java-version: '17'
-          distribution: 'temurin'
-          cache: 'maven'
-
-      - name: Install SeaweedFS
-        run: |
-          cd weed
-          go install -buildvcs=false
-          weed version
-
-      - name: Run Snowflake S3Compat API tests
-        timeout-minutes: 20
-        run: |
-          # Starts weed server, creates the buckets/objects the suite needs,
-          # clones the upstream suite, and runs mvn -Dtest=S3CompatApiTest.
-          bash test/s3/snowflake/run.sh
-
-      - name: Show logs on failure
-        if: failure()
-        run: |
-          echo "=== SeaweedFS Server Log ==="
-          tail -200 "$WORK_DIR/weed.log" || echo "No server log"
-          echo ""
-          echo "=== Surefire results ==="
-          cat "$WORK_DIR"/snowflake-s3compat-api-test-suite/s3compatapi/target/surefire-reports/*.txt 2>/dev/null || echo "No surefire reports"
-
-      - name: Upload test results
-        if: always()
-        uses: actions/upload-artifact@v7
-        with:
-          name: snowflake-s3compat-surefire-reports
-          path: /tmp/seaweedfs-snowflake-tests/snowflake-s3compat-api-test-suite/s3compatapi/target/surefire-reports/
-          retention-days: 14
-
-      - name: Cleanup
-        if: always()
-        run: |
-          pkill -9 -f "weed server" || true
-          rm -rf "$WORK_DIR" || true

.github/workflows/s3-tables-tests.yml

@@ -439,117 +439,6 @@ jobs:
           path: test/s3tables/catalog_clickhouse/test-output.log
           retention-days: 3
 
-  olake-iceberg-catalog-tests:
-    name: OLake Iceberg Catalog Integration Tests (${{ matrix.tag }})
-    runs-on: ubuntu-22.04
-    timeout-minutes: 30
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          # Pinned baseline, and latest so new OLake releases are exercised
-          # without a code change. OLake's Iceberg writer is a Java sidecar
-          # whose Iceberg version moves independently of the Go release, so
-          # the latest leg is the one that catches library drift.
-          - olake-image: olakego/source-postgres:v0.10.1
-            tag: "v0.10.1"
-          - olake-image: olakego/source-postgres:latest
-            tag: latest
-
-    steps:
-      - name: Check out code
-        uses: actions/checkout@v7
-
-      - name: Set up Go
-        uses: actions/setup-go@v7
-        with:
-          go-version-file: 'go.mod'
-        id: go
-
-      - name: Configure Docker Hub mirror
-        run: |
-          echo '{"registry-mirrors": ["https://mirror.gcr.io"]}' | sudo tee /etc/docker/daemon.json
-          sudo systemctl restart docker
-
-      - name: Pre-pull images
-        run: |
-          pull() { for i in 1 2 3; do docker pull "$1" && return 0; sleep 15; done; return 1; }
-          pull ${{ matrix.olake-image }}
-          pull postgres:16
-          pull python:3.11-slim
-
-      - name: Run go mod tidy
-        run: go mod tidy
-
-      - name: Install SeaweedFS
-        run: |
-          go install -buildvcs=false ./weed
-
-      - name: Run OLake Iceberg Catalog Integration Tests
-        timeout-minutes: 25
-        working-directory: test/s3tables/catalog_olake
-        env:
-          OLAKE_IMAGE: ${{ matrix.olake-image }}
-        run: |
-          set -x
-          set -o pipefail
-          echo "=== System Information ==="
-          uname -a
-          free -h
-          df -h
-          docker info
-          echo "=== Starting OLake Iceberg Catalog Tests ==="
-
-          go test -v -timeout 20m . 2>&1 | tee test-output.log || {
-            echo "OLake Iceberg catalog integration tests failed"
-            exit 1
-          }
-
-      # The suite skips itself when Docker is unavailable, so a green job is not
-      # by itself evidence that anything ran. Assert execution explicitly.
-      - name: Assert the suite actually ran
-        working-directory: test/s3tables/catalog_olake
-        run: |
-          log=test-output.log
-          if [ ! -f "$log" ]; then
-            echo "::error::no test-output.log; the suite did not run"
-            exit 1
-          fi
-          passes=$(grep -c '^--- PASS' "$log" || true)
-          skips=$(grep -c '^--- SKIP' "$log" || true)
-          echo "top-level PASS=$passes SKIP=$skips"
-          if [ "$skips" -gt 0 ]; then
-            echo "::error::the OLake suite skipped $skips top-level test(s); the environment it needs was not provisioned, so this job proves nothing"
-            grep '^--- SKIP' "$log" | head -20
-            exit 1
-          fi
-          if [ "$passes" -lt 1 ]; then
-            echo "::error::the OLake suite recorded no passing top-level test"
-            exit 1
-          fi
-
-      - name: Show test output on failure
-        if: failure()
-        working-directory: test/s3tables/catalog_olake
-        run: |
-          echo "=== Test Output ==="
-          if [ -f test-output.log ]; then
-            tail -200 test-output.log
-          fi
-
-          echo "=== Process information ==="
-          ps aux | grep -E "(weed|test|docker|olake|postgres)" || true
-          echo "=== Containers ==="
-          docker ps -a | head -30 || true
-
-      - name: Upload test logs on failure
-        if: failure()
-        uses: actions/upload-artifact@v7
-        with:
-          name: olake-iceberg-catalog-test-logs-${{ matrix.tag }}
-          path: test/s3tables/catalog_olake/test-output.log
-          retention-days: 3
-
   polaris-integration-tests:
     name: Polaris Integration Tests
     runs-on: ubuntu-22.04

.github/workflows/s3tests.yml

@@ -289,11 +289,6 @@ jobs:
           s3tests/functional/test_s3.py::test_object_write_check_etag \
           s3tests/functional/test_s3.py::test_object_write_cache_control \
           s3tests/functional/test_s3.py::test_object_write_expires \
-          s3tests/functional/test_s3.py::test_put_obj_enc_conflict_c_s3 \
-          s3tests/functional/test_s3.py::test_put_obj_enc_conflict_c_kms \
-          s3tests/functional/test_s3.py::test_put_obj_enc_conflict_s3_kms \
-          s3tests/functional/test_s3.py::test_put_obj_enc_conflict_bad_enc_kms \
-          s3tests/functional/test_s3.py::test_object_content_encoding_aws_chunked \
           s3tests/functional/test_s3.py::test_object_write_read_update_read_delete \
           s3tests/functional/test_s3.py::test_object_metadata_replaced_on_put \
           s3tests/functional/test_s3.py::test_object_write_file \
@@ -316,7 +311,6 @@ jobs:
           s3tests/functional/test_s3.py::test_get_object_ifmodifiedsince_good \
           s3tests/functional/test_s3.py::test_get_object_ifmodifiedsince_failed \
           s3tests/functional/test_s3.py::test_get_object_ifunmodifiedsince_failed \
-          s3tests/functional/test_s3.py::test_get_checksum_object_attributes \
           s3tests/functional/test_s3.py::test_bucket_head \
           s3tests/functional/test_s3.py::test_bucket_head_notexist \
           s3tests/functional/test_s3.py::test_object_raw_authenticated \
@@ -1155,11 +1149,6 @@ jobs:
           s3tests/functional/test_s3.py::test_object_write_check_etag \
           s3tests/functional/test_s3.py::test_object_write_cache_control \
           s3tests/functional/test_s3.py::test_object_write_expires \
-          s3tests/functional/test_s3.py::test_put_obj_enc_conflict_c_s3 \
-          s3tests/functional/test_s3.py::test_put_obj_enc_conflict_c_kms \
-          s3tests/functional/test_s3.py::test_put_obj_enc_conflict_s3_kms \
-          s3tests/functional/test_s3.py::test_put_obj_enc_conflict_bad_enc_kms \
-          s3tests/functional/test_s3.py::test_object_content_encoding_aws_chunked \
           s3tests/functional/test_s3.py::test_object_write_read_update_read_delete \
           s3tests/functional/test_s3.py::test_object_metadata_replaced_on_put \
           s3tests/functional/test_s3.py::test_object_write_file \
@@ -1182,7 +1171,6 @@ jobs:
           s3tests/functional/test_s3.py::test_get_object_ifmodifiedsince_good \
           s3tests/functional/test_s3.py::test_get_object_ifmodifiedsince_failed \
           s3tests/functional/test_s3.py::test_get_object_ifunmodifiedsince_failed \
-          s3tests/functional/test_s3.py::test_get_checksum_object_attributes \
           s3tests/functional/test_s3.py::test_bucket_head \
           s3tests/functional/test_s3.py::test_bucket_head_notexist \
           s3tests/functional/test_s3.py::test_object_raw_authenticated \

.github/workflows/test-s3-over-https-using-awscli.yml

@@ -86,11 +86,7 @@ jobs:
           set -e
           dd if=/dev/urandom of=generated bs=1M count=32
           aws --no-verify-ssl s3 cp --no-progress generated s3://bucket/test-multipart
-          for i in 1 2 3 4 5; do
-            aws --no-verify-ssl s3 cp --no-progress s3://bucket/test-multipart downloaded && break
-            if [ "$i" -eq 5 ]; then exit 1; fi
-            sleep 2
-          done
+          aws --no-verify-ssl s3 cp --no-progress s3://bucket/test-multipart downloaded
           diff -q generated downloaded
           rm -f generated downloaded
 

README.md

@@ -21,7 +21,6 @@ One `weed` binary serves an S3 object store, a POSIX file system, and a lakehous
 
 - [Download Binaries for different platforms](https://github.com/seaweedfs/seaweedfs/releases/latest)
 - [Wiki Documentation](https://github.com/seaweedfs/seaweedfs/wiki)
-- [HTTP REST API](REST_API.md) for the filer, master, and volume servers
 - Community: [Slack](https://join.slack.com/t/seaweedfs/shared_invite/enQtMzI4MTMwMjU2MzA3LTEyYzZmZWYzOGQ3MDJlZWMzYmI0OTE4OTJiZjJjODBmMzUxNmYwODg0YjY3MTNlMjBmZDQ1NzQ5NDJhZWI2ZmY), [Twitter](https://twitter.com/SeaweedFS), [Telegram](https://t.me/Seaweedfs), [Reddit](https://www.reddit.com/r/SeaweedFS/), [Mailing List](https://groups.google.com/d/forum/seaweedfs)
 - [SeaweedFS White Paper](https://github.com/seaweedfs/seaweedfs/wiki/SeaweedFS_Architecture.pdf) and introduction slides: [2025.5](https://docs.google.com/presentation/d/1tdkp45J01oRV68dIm4yoTXKJDof-EhainlA0LMXexQE/edit?usp=sharing), [2021.5](https://docs.google.com/presentation/d/1DcxKWlINc-HNCjhYeERkpGXXm6nTCES8mi2W5G0Z4Ts/edit?usp=sharing), [2019.3](https://www.slideshare.net/chrislusf/seaweedfs-introduction)
 
@@ -82,8 +81,6 @@ AWS_ACCESS_KEY_ID=admin AWS_SECRET_ACCESS_KEY=secret \
 
 The same process also runs the master, a volume server, the filer, WebDAV, the Iceberg REST catalog, and the Admin UI. Add `S3_TABLE_BUCKET=warehouse` to also create an Iceberg table bucket, or `warehouse:LANCE` for a Lance one. Drop the AWS keys to run without authentication for development.
 
-Without Admin authentication or mTLS, `weed mini` binds the Admin UI/API and its worker gRPC control plane to loopback rather than `-ip.bind`. Set `WEED_ADMIN_PASSWORD` or configure `https.admin` mTLS to keep the network bind. Remote workers must opt in with `-admin.worker.ip=<address>` and should configure `grpc.admin` mTLS. `-admin.allowInsecureBind` restores the legacy unauthenticated network bind and should only be used on an isolated network.
-
 > macOS: if the binary is quarantined, run `xattr -d com.apple.quarantine ./weed` first.
 
 `weed mini` is auto-tuned for one node and is fine for single-node production, such as an S3 gateway that issues presigned URLs. See [Quick Start with weed mini][WeedMini].
@@ -225,7 +222,7 @@ The full operation list is in [Amazon S3 API][AmazonS3API], and [Supported APIs
 
 SeaweedFS is a lakehouse in one system. [S3 Table Buckets][S3TableBucket] hold Apache Iceberg tables by default, or [Lance][LanceCatalog] tables for vectors and multimodal data, and the built-in [Iceberg REST Catalog][IcebergCatalog] and Lance namespace serve them directly. There is no Hive Metastore, Glue, or separate catalog service to deploy, secure, and back up.
 
-* Query engines operate on the same tables at the same time: [Spark][SparkIceberg], [Trino][TrinoIceberg], [Dremio][DremioIceberg], [DuckDB][DuckDBIceberg], [Apache Doris][DorisIceberg], [RisingWave][RisingWaveIceberg], ClickHouse, and [LanceDB][LanceDB]. Catalog commits are atomic compare-and-swap, so concurrent writers are safe. [Lakekeeper][Lakekeeper] can front the same storage with STS-vended credentials. [OLake][OLake] replicates PostgreSQL, MySQL, and MongoDB into the same tables with change data capture.
+* Query engines operate on the same tables at the same time: [Spark][SparkIceberg], [Trino][TrinoIceberg], [Dremio][DremioIceberg], [DuckDB][DuckDBIceberg], [Apache Doris][DorisIceberg], [RisingWave][RisingWaveIceberg], ClickHouse, and [LanceDB][LanceDB]. Catalog commits are atomic compare-and-swap, so concurrent writers are safe. [Lakekeeper][Lakekeeper] can front the same storage with STS-vended credentials.
 * [Automated table maintenance][IcebergMaintenance]: compaction, snapshot expiration, orphan file removal, and manifest rewriting, configured per bucket or table through the S3 Tables maintenance APIs, and the same for [Lance][LanceMaintenance].
 * IAM at the bucket, namespace, and table level with standard bucket policies, see [S3 Tables Security][S3TablesSecurity].
 * A [Hadoop compatible file system][Hadoop] for Spark, Flink, and HBase.
@@ -487,7 +484,6 @@ Your support will be really appreciated by me and other supporters!
 [RisingWaveIceberg]: https://github.com/seaweedfs/seaweedfs/wiki/RisingWave-Iceberg-Integration
 [LanceDB]: https://github.com/seaweedfs/seaweedfs/wiki/LanceDB-Integration
 [Lakekeeper]: https://github.com/seaweedfs/seaweedfs/wiki/Lakekeeper-Iceberg-Integration
-[OLake]: https://github.com/seaweedfs/seaweedfs/wiki/OLake-Iceberg-Integration
 [IcebergMaintenance]: https://github.com/seaweedfs/seaweedfs/wiki/Iceberg-Table-Maintenance
 [LanceMaintenance]: https://github.com/seaweedfs/seaweedfs/wiki/Lance-Maintenance-Worker
 [S3TablesSecurity]: https://github.com/seaweedfs/seaweedfs/wiki/S3-Tables-Security

REST_API.md

@@ -1,344 +0,0 @@
-# SeaweedFS HTTP REST API
-
-SeaweedFS exposes three HTTP surfaces:
-
-| Service | Default port | Addressing |
-|---------|--------------|------------|
-| Filer | 8888 | File system paths (`/dir/name`) |
-| Master | 9333 | File id assignment and cluster topology |
-| Volume server | 8080 | File content by file id (`vid,fid`) |
-
-Most clients only need the filer API (paths) or the S3 API. The master and
-volume APIs are the lower-level blob store interface.
-
-Conventions applying to all three:
-
-- Responses are JSON unless noted otherwise. Append `&pretty=y` to pretty-print.
-- A file id (`fid`) has the form `volumeId,fileKeyCookie`, e.g. `3,01637037d6`.
-  An optional suffix selects a reserved id from a `count` assignment
-  (`3,01637037d6_1`, `_2`, ...), and an optional extension
-  (`3,01637037d6.jpg`) sets the content type on reads.
-- `replication` is a 3-digit replica placement `xyz`: `x` copies in other
-  data centers, `y` on other racks in the same data center, `z` on other
-  volume servers on the same rack. `000` = no replication, `001` = one copy
-  on the same rack, `010` = one copy on a different rack, `100` = one copy in
-  another data center, `200` = two copies in two other data centers, `110` =
-  one copy in another data center plus one on another rack.
-- `ttl` units: `m` minute, `h` hour, `d` day, `w` week, `M` month, `y` year.
-
-## Filer API (port 8888)
-
-The filer presents a POSIX-like namespace over the volume servers.
-
-### Upload a file
-
-```bash
-# PUT the raw body to the target path
-curl -T /home/chris/myphoto.jpg "http://localhost:8888/dir/myphoto.jpg"
-
-# or POST as multipart form (the part filename becomes the entry name)
-curl -F file=@/home/chris/myphoto.jpg "http://localhost:8888/dir/"
-```
-
-Response `201 Created`:
-
-```json
-{"name":"myphoto.jpg","size":43234,"eTag":"0x6c656...","mtime":"...","chunks":[...]}
-```
-
-Query parameters:
-
-| Parameter | Description | Default |
-|-----------|-------------|---------|
-| `collection` | collection name | empty |
-| `replication` | replica placement code | filer default |
-| `ttl` | file expiration, e.g. `3d` | never |
-| `disk` | disk type to store on | filer default |
-| `fsync` | `true` fsyncs on the volume server | false |
-| `dataCenter` | preferred data center | empty |
-| `rack` | preferred rack | empty |
-| `dataNode` | preferred volume server | empty |
-| `saveInside` | store small content inside the metadata instead of a volume | false |
-| `maxMB` | split the upload into chunks of this many MB | filer `-maxMB` |
-| `mode` | unix permission bits, e.g. `0644` | `0660` |
-| `op` | `append` appends to an existing file | overwrite |
-| `skipCheckParentDir` | `true` skips the parent-directory existence check | false |
-
-### Create a directory
-
-```bash
-curl -X POST "http://localhost:8888/dir/newdir/"
-```
-
-A POST to a path ending in `/` with no content creates the directory,
-including missing parents.
-
-### Read a file
-
-```bash
-curl "http://localhost:8888/dir/myphoto.jpg"
-```
-
-Supports `Range` requests (`Accept-Ranges: bytes`), `ETag`, and the
-`If-None-Match` / `If-Modified-Since` conditional headers. `HEAD` returns
-headers only. Entry headers stored as extended attributes are echoed back,
-minus internal `Seaweed-` and `xattr-` keys.
-
-Entry metadata instead of content:
-
-```bash
-curl "http://localhost:8888/dir/myphoto.jpg?metadata=true"
-```
-
-`metadata=true&resolveManifest=true` additionally resolves chunked-manifest
-entries into their real chunk list.
-
-### List a directory
-
-```bash
-curl -H "Accept: application/json" "http://localhost:8888/dir/?limit=10&lastFileName=a.jpg"
-```
-
-| Parameter | Description | Default |
-|-----------|-------------|---------|
-| `limit` | max entries per page | filer `-dirListLimit` |
-| `lastFileName` | resume listing after this entry name | empty |
-| `namePattern` | include only names matching the wildcard | empty |
-| `namePatternExclude` | exclude names matching the wildcard | empty |
-
-The JSON response carries `Path`, `Entries`, `Limit`, `LastFileName`,
-`ShouldDisplayLoadMore`, and `EmptyFolder`. Without the `Accept` header the
-filer renders its HTML browser.
-
-### Move and copy
-
-```bash
-curl -X POST "http://localhost:8888/dir/newname.jpg?mv.from=/dir/myphoto.jpg"
-curl -X POST "http://localhost:8888/dir/copy.jpg?cp.from=/dir/myphoto.jpg"
-```
-
-`mv.from` renames or moves the source to the request path (`204 No Content`).
-`cp.from` copies it.
-
-### Append
-
-```bash
-curl -T chunk2.bin "http://localhost:8888/dir/file.bin?op=append"
-```
-
-### Delete
-
-```bash
-curl -X DELETE "http://localhost:8888/dir/myphoto.jpg"
-curl -X DELETE "http://localhost:8888/dir/?recursive=true"
-```
-
-| Parameter | Description | Default |
-|-----------|-------------|---------|
-| `recursive` | delete a non-empty directory tree | false; when the filer runs with `filer.options.recursive_delete=true`, deletes are recursive unless `recursive=false` |
-| `ignoreRecursiveError` | keep deleting remaining entries after an error | false |
-| `skipChunkDeletion` | remove only the metadata, keep volume data | false |
-
-### Tagging
-
-Tags are carried as `Seaweed-`-prefixed request headers, not query
-parameters; `?tagging` selects the tagging handler and `?tagging=K1,K2`
-lists the keys to remove. Header names are canonicalized on write
-(`Seaweed-k1` is stored as `Seaweed-K1`), and the delete list is matched
-case-sensitively against the stored names.
-
-```bash
-curl -X PUT -H "Seaweed-k1: v1" -H "Seaweed-k2: v2" "http://localhost:8888/dir/file.jpg?tagging"
-curl -X DELETE "http://localhost:8888/dir/file.jpg?tagging=K1,K2"
-```
-
-### Read by file id
-
-```bash
-curl "http://localhost:8888/?proxyChunkId=3,01637037d6"
-```
-
-The filer proxies the chunk read to the right volume server, so only the
-filer port needs to be exposed.
-
-### Resumable uploads
-
-The filer serves the [TUS protocol](https://tus.io/) for resumable uploads
-(`POST`, `PATCH`, `HEAD` on upload URLs). It is enabled by default at
-`/.tus`; `-tusBasePath` changes the endpoint base path.
-
-### Health
-
-`GET /healthz` and `GET /readyz` return `200 OK`.
-
-## Master API (port 9333)
-
-Write-affecting endpoints are automatically proxied to the current leader, so
-any master in the quorum can serve them.
-
-### Assign a file id
-
-```bash
-curl "http://localhost:9333/dir/assign?count=1&replication=001&collection=turbo&dataCenter=dc1&ttl=3d&disk=ssd"
-{"count":1,"fid":"3,01637037d6","url":"127.0.0.1:8080","publicUrl":"localhost:8080"}
-```
-
-Upload the file content to `http://<url>/<fid>` afterwards. With `count>1`,
-use `<fid>_1`, `<fid>_2`, ... for the additional ids.
-
-| Parameter | Description | Default |
-|-----------|-------------|---------|
-| `count` | file ids to reserve | 1 |
-| `collection` | collection name | empty |
-| `dataCenter` | preferred data center | empty |
-| `rack` | preferred rack | empty |
-| `dataNode` | preferred volume server | empty |
-| `replication` | replica placement | master `-defaultReplication` |
-| `ttl` | file expiration, e.g. `3d` | never |
-| `disk` | disk type | empty |
-| `dataSize` | expected file size in bytes | 0 |
-| `preallocate` | bytes to preallocate for new volumes | master `-volumePreallocate` |
-| `writableVolumeCount` | grow this many volumes when none are writable | master default |
-| `memoryMapMaxSizeMb` | memory-mapped file size (Windows) | 0 |
-
-### Look up a volume or file id
-
-```bash
-curl "http://localhost:9333/dir/lookup?volumeId=3"
-{"locations":[{"url":"localhost:8080","publicUrl":"localhost:8080"}]}
-```
-
-| Parameter | Description | Default |
-|-----------|-------------|---------|
-| `volumeId` | volume id; a full `vid,fid` is accepted too | required |
-| `fileId` | like `volumeId`, but also returns a write JWT when security is on | empty |
-| `collection` | speeds up the lookup | empty |
-| `read` | `yes` generates a read JWT instead of a write JWT | empty |
-
-### Store a file in one call
-
-```bash
-curl -F file=@/home/chris/report.pdf "http://localhost:9333/submit?collection=turbo&replication=001"
-{"fileName":"report.pdf","fid":"3,01637037d6","fileUrl":"localhost:8080/3,01637037d6","size":43234,"eTag":"0x6c656..."}
-```
-
-`POST /submit` accepts multipart file data plus the `dir/assign` placement
-parameters (`count`, `collection`, `dataCenter`, `rack`, `replication`,
-`ttl`, `disk`), assigns a file id, uploads to the volume server, and returns
-the result.
-
-### Redirect to a file
-
-```bash
-curl -v "http://localhost:9333/3,01637037d6"
-```
-
-`GET /{fileId}` answers `308 Permanent Redirect` to a volume server holding
-the file, preserving the query string (e.g. image-resize parameters).
-
-### Cluster status
-
-```bash
-curl "http://localhost:9333/dir/status?pretty=y"   # full topology tree
-curl "http://localhost:9333/vol/status?pretty=y"   # every volume on every node
-curl "http://localhost:9333/collection/info?collection=turbo"
-curl "http://localhost:9333/collection/info?collection=turbo&detail=true"
-```
-
-`collection/info` returns aggregated `TotalSize`, `FileCount`, `UsedSize`,
-`VolumeCount`; `detail=true` splits them per volume layout.
-
-### Grow volumes
-
-```bash
-curl "http://localhost:9333/vol/grow?count=4&replication=001&collection=turbo&ttl=5d&disk=ssd&dataCenter=dc1&rack=rack1"
-{"count":4}
-```
-
-`count` is required; the placement parameters match `dir/assign`. One volume
-serves one write at a time, so pre-allocated volumes raise write concurrency.
-
-### Vacuum deleted space
-
-```bash
-curl "http://localhost:9333/vol/vacuum?garbageThreshold=0.4"
-```
-
-| Parameter | Description | Default |
-|-----------|-------------|---------|
-| `garbageThreshold` | minimum deleted-bytes ratio before a volume is compacted | master `-garbageThreshold` (0.3) |
-
-Vacuuming makes a volume read-only, copies live needles to a new volume, and
-swaps it in.
-
-### Delete a collection
-
-```bash
-curl "http://localhost:9333/col/delete?collection=benchmark"
-```
-
-Deletes all volumes of the collection, including erasure-coded shards.
-`204 No Content` on success.
-
-### Health
-
-```bash
-curl -I "http://localhost:9333/healthz"     # liveness
-curl -I "http://localhost:9333/readyz"      # readiness
-curl "http://localhost:9333/"               # web UI
-```
-
-## Volume server API (port 8080)
-
-The volume server stores file content by file id. Clients normally get the
-volume URL from `dir/assign` or `dir/lookup`.
-
-### Upload
-
-```bash
-curl -F file=@/home/chris/myphoto.jpg "http://127.0.0.1:8080/3,01637037d6"
-{"name":"myphoto.jpg","size":43234,"eTag":"0x6c656...","mime":"image/jpeg","contentMd5":"..."}
-```
-
-PUT or POST the body (or a multipart `file` part) to `/{vid},{fid}`.
-`204 No Content` is returned when the content is unchanged. `?ts=<unix>`
-sets the stored modification time.
-
-### Read
-
-```bash
-curl "http://127.0.0.1:8080/3,01637037d6"
-curl "http://127.0.0.1:8080/3,01637037d6.jpg"        # sets Content-Type from the extension
-```
-
-Supports `Range` and `HEAD`. Image files can be resized server-side:
-
-| Parameter | Description |
-|-----------|-------------|
-| `width`, `height` | resize bounds in pixels |
-| `mode` | `fit` (contain) or `fill` (cover); omitted resizes to `width`/`height` |
-| `crop_x1`, `crop_y1`, `crop_x2`, `crop_y2` | explicit crop rectangle |
-| `cm` | `false` returns the chunk-manifest blob instead of resolving it |
-| `readDeleted` | `true` reads soft-deleted needles |
-| `collection` | passed through redirects for the right volume |
-
-### Delete
-
-```bash
-curl -X DELETE "http://127.0.0.1:8080/3,01637037d6"
-{"size":43234}
-```
-
-`?ts=<unix>` sets the deletion timestamp. Replicated volumes propagate the
-delete to every replica.
-
-### Status
-
-```bash
-curl "http://localhost:8080/status?pretty=y"  # disk and volume inventory
-curl -I "http://localhost:8080/healthz"       # liveness/readiness
-```
-
-`OPTIONS` preflights answer CORS headers. When `-port.public` differs from
-`-port`, the volume server opens a separate read-only public listener on
-that port; `-publicUrl` sets the address it advertises to clients.

VOLUME_SERVER_RUST_PLAN.md

@@ -169,7 +169,6 @@ seaweed-volume/
    - `--memprofile`
    - `--compactionMBps` (default 0)
    - `--maintenanceMBps` (default 0)
-   - `--compactionMaxParallelCommits` (default 0)
    - `--fileSizeLimitMB` (default 256)
    - `--concurrentUploadLimitMB` (default 0)
    - `--concurrentDownloadLimitMB` (default 0)

design-lance-catalog.md

@@ -543,7 +543,7 @@ a language-agnostic gRPC stream that external maintenance workers connect on: th
 opens `WorkerStream`, sends `WorkerHello` with the job types it can `detect` and `execute`,
 answers `RequestConfigSchema` with a `JobTypeDescriptor`, replies to `RunDetectionRequest`
 with `JobProposal`s and to `ExecuteJobRequest` with `JobProgressUpdate`s and `JobCompleted`.
-`weed worker -admin=host:12535` is the Go reference implementation of exactly that contract,
+`weed worker -admin=host:23646` is the Go reference implementation of exactly that contract,
 from outside the admin process.
 
 Nothing in it is Go-specific, and the Rust toolchain is already in the tree.

docker/Dockerfile.go_build

@@ -14,9 +14,6 @@ RUN cd /go/src/github.com/seaweedfs/seaweedfs && \
       git checkout $BRANCH) || \
      (echo "ERROR: Branch/commit $BRANCH not found in repository" && \
       echo "Available branches:" && git branch -a && exit 1))
-# seaweed-common only exists on revisions that have it; a BRANCH predating it
-# still needs the directory so the COPY into rust_builder below never fails.
-RUN mkdir -p /go/src/github.com/seaweedfs/seaweedfs/seaweed-common
 ARG TARGETOS TARGETARCH TARGETVARIANT
 RUN cd /go/src/github.com/seaweedfs/seaweedfs/weed \
   && export LDFLAGS="-X github.com/seaweedfs/seaweedfs/weed/util/version.COMMIT=$(git rev-parse --short HEAD)" \
@@ -34,9 +31,6 @@ ARG TAGS
 COPY weed-volume-prebuilt/ /prebuilt/
 COPY weed-worker-prebuilt/ /prebuilt-worker/
 COPY --from=builder /go/src/github.com/seaweedfs/seaweedfs/seaweed-volume /build/seaweed-volume
-# seaweed-common is a path dependency of seaweed-volume that lives beside it,
-# so the source build below needs it in the same relative position.
-COPY --from=builder /go/src/github.com/seaweedfs/seaweedfs/seaweed-common /build/seaweed-common
 COPY --from=builder /go/src/github.com/seaweedfs/seaweedfs/weed /build/weed
 WORKDIR /build/seaweed-volume
 RUN if [ -f "/prebuilt/weed-volume-${TARGETARCH}" ]; then \

docker/admin_integration/EC-TESTING-README.md

@@ -21,7 +21,7 @@ The testing environment uses **official SeaweedFS commands** and includes:
 - **1 Master Server** (port 9333) - Coordinates the cluster with 50MB volume size limit
 - **6 Volume Servers** (ports 8080-8085) - Distributed across 2 data centers and 3 racks for diversity  
 - **1 Filer** (port 8888) - Provides file system interface
-- **1 Admin Server** (port 12535) - Detects volumes needing EC and manages workers using official `admin` command
+- **1 Admin Server** (port 23646) - Detects volumes needing EC and manages workers using official `admin` command
 - **3 EC Workers** - Execute erasure coding tasks using official `worker` command with task-specific working directories
 - **1 Load Generator** - Continuously writes and deletes files using SeaweedFS shell commands
 - **1 Monitor** - Tracks cluster health and EC progress using shell scripts
@@ -47,7 +47,7 @@ This provides:
 - Docker and Docker Compose installed
 - GNU Make installed
 - At least 4GB RAM available for containers
-- Ports 8080-8085, 8888, 9333, 12535 available
+- Ports 8080-8085, 8888, 9333, 23646 available
 
 ### Start the Environment
 
@@ -127,7 +127,7 @@ Run `make help` to see all available targets:
 |---------|-----|-------------|
 | Master UI | http://localhost:9333 | Cluster status and topology |
 | Filer | http://localhost:8888 | File operations |
-| Admin Server | http://localhost:12535/ | Task management |
+| Admin Server | http://localhost:23646/ | Task management |
 | Monitor | http://localhost:9999/status | Complete cluster monitoring |
 | Volume Servers | http://localhost:8080-8085/status | Individual volume server stats |
 

docker/admin_integration/Makefile

@@ -26,7 +26,7 @@ build-and-restart: build ## Build with latest changes and restart services
 	@echo "2️⃣ Recreating workers to reconnect..."
 	@docker-compose -f $(COMPOSE_FILE) up -d worker1 worker2 worker3
 	@echo "✅ All services recreated with latest changes!"
-	@echo "🌐 Admin UI: http://localhost:12535/"
+	@echo "🌐 Admin UI: http://localhost:23646/"
 	@echo "💡 Workers will reconnect to the new admin server"
 
 restart-workers: ## Restart all workers to reconnect to admin server
@@ -64,7 +64,7 @@ start: ## Start the complete SeaweedFS cluster with admin and workers
 	@echo "✅ Cluster started!"
 	@echo ""
 	@echo "📊 Access points:"
-	@echo "  • Admin UI:      http://localhost:12535/"
+	@echo "  • Admin UI:      http://localhost:23646/"
 	@echo "  • Master UI:     http://localhost:9333/"
 	@echo "  • Filer:         http://localhost:8888/"
 	@echo ""
@@ -107,7 +107,7 @@ start-staged: ## Start services in proper order with delays
 	@echo "✅ All services started!"
 	@echo ""
 	@echo "📊 Access points:"
-	@echo "  • Admin UI:      http://localhost:12535/"
+	@echo "  • Admin UI:      http://localhost:23646/"
 	@echo "  • Master UI:     http://localhost:9333/"
 	@echo "  • Filer:         http://localhost:8888/"
 	@echo ""
@@ -136,7 +136,7 @@ status: ## Check the status of all services
 	@echo "Master:"
 	@curl -s http://localhost:9333/cluster/status | jq '.IsLeader' 2>/dev/null || echo "  ❌ Master not ready"
 	@echo "Admin:"
-	@curl -s http://localhost:12535/ | grep -q "Admin" && echo "  ✅ Admin ready" || echo "  ❌ Admin not ready"
+	@curl -s http://localhost:23646/ | grep -q "Admin" && echo "  ✅ Admin ready" || echo "  ❌ Admin not ready"
 
 logs: ## Show logs from all services
 	@echo "📜 Following logs from all services..."
@@ -157,7 +157,7 @@ master-logs: ## Show logs from master server
 
 admin-ui: ## Open admin UI in browser (macOS)
 	@echo "🌐 Opening admin UI in browser..."
-	@open http://localhost:12535/ || echo "💡 Manually open: http://localhost:12535/"
+	@open http://localhost:23646/ || echo "💡 Manually open: http://localhost:23646/"
 
 test: ## Run integration test to verify task assignment and completion
 	@echo "🧪 Running Admin-Worker Integration Test"
@@ -166,11 +166,11 @@ test: ## Run integration test to verify task assignment and completion
 	@echo "1️⃣ Checking cluster health..."
 	@sleep 5
 	@curl -s http://localhost:9333/cluster/status | jq '.IsLeader' > /dev/null && echo "✅ Master healthy" || echo "❌ Master not ready"
-	@curl -s http://localhost:12535/ | grep -q "Admin" && echo "✅ Admin healthy" || echo "❌ Admin not ready"
+	@curl -s http://localhost:23646/ | grep -q "Admin" && echo "✅ Admin healthy" || echo "❌ Admin not ready"
 	@echo ""
 	@echo "2️⃣ Checking worker registration..."
 	@sleep 10
-	@echo "💡 Check admin UI for connected workers: http://localhost:12535/"
+	@echo "💡 Check admin UI for connected workers: http://localhost:23646/"
 	@echo ""
 	@echo "3️⃣ Generating load to trigger EC tasks..."
 	@echo "📝 Creating test files to fill volumes..."
@@ -193,13 +193,13 @@ test: ## Run integration test to verify task assignment and completion
 	@echo "   • EC shards being distributed"
 	@echo ""
 	@echo "✅ Integration test setup complete!"
-	@echo "📊 Monitor progress at: http://localhost:12535/"
+	@echo "📊 Monitor progress at: http://localhost:23646/"
 
 quick-test: ## Quick verification that core services are running
 	@echo "⚡ Quick Health Check"
 	@echo "===================="
 	@echo "Master:  $$(curl -s http://localhost:9333/cluster/status | jq -r '.IsLeader // "not ready"')"
-	@echo "Admin:   $$(curl -s http://localhost:12535/ | grep -q "Admin" && echo "ready" || echo "not ready")"
+	@echo "Admin:   $$(curl -s http://localhost:23646/ | grep -q "Admin" && echo "ready" || echo "not ready")"
 	@echo "Workers: $$(docker-compose -f $(COMPOSE_FILE) ps worker1 worker2 worker3 | grep -c Up) running"
 
 validate: ## Validate integration test configuration
@@ -223,7 +223,7 @@ demo: start ## Start cluster and run demonstration
 	@echo "  • Load generator (creates files continuously)"
 	@echo ""
 	@echo "📊 Watch the process:"
-	@echo "  1. Visit: http://localhost:12535/"
+	@echo "  1. Visit: http://localhost:23646/"
 	@echo "  2. Observe workers connecting"
 	@echo "  3. Watch tasks being created and assigned"
 	@echo "  4. See tasks progress from pending → completed"
@@ -244,13 +244,13 @@ vacuum-test: ## Create test data with garbage and verify vacuum detection
 	@echo ""
 	@echo "1️⃣ Checking cluster health..."
 	@curl -s http://localhost:9333/cluster/status | jq '.IsLeader' > /dev/null && echo "✅ Master ready" || (echo "❌ Master not ready. Run 'make start' first." && exit 1)
-	@curl -s http://localhost:12535/ | grep -q "Admin" && echo "✅ Admin ready" || (echo "❌ Admin not ready. Run 'make start' first." && exit 1)
+	@curl -s http://localhost:23646/ | grep -q "Admin" && echo "✅ Admin ready" || (echo "❌ Admin not ready. Run 'make start' first." && exit 1)
 	@echo ""
 	@echo "2️⃣ Creating test data with garbage..."
 	@docker-compose -f $(COMPOSE_FILE) exec vacuum-tester go run create_vacuum_test_data.go -files=25 -delete=0.5 -size=200
 	@echo ""
 	@echo "3️⃣ Configuration Instructions:"
-	@echo "   Visit: http://localhost:12535/maintenance/config/vacuum"
+	@echo "   Visit: http://localhost:23646/maintenance/config/vacuum"
 	@echo "   Set for testing:"
 	@echo "     • Enable Vacuum Tasks: ✅ Checked"
 	@echo "     • Garbage Threshold: 0.20 (20%)"
@@ -258,7 +258,7 @@ vacuum-test: ## Create test data with garbage and verify vacuum detection
 	@echo "     • Min Volume Age: [0] [Minutes]"
 	@echo "     • Max Concurrent: 2"
 	@echo ""
-	@echo "4️⃣ Monitor vacuum tasks at: http://localhost:12535/maintenance"
+	@echo "4️⃣ Monitor vacuum tasks at: http://localhost:23646/maintenance"
 	@echo ""
 	@echo "💡 Use 'make vacuum-status' to check volume garbage ratios"
 
@@ -335,8 +335,8 @@ vacuum-help: ## Show vacuum testing help and examples
 	@echo "  make vacuum-demo           # Full guided demonstration"
 	@echo ""
 	@echo "Configuration:"
-	@echo "  Visit: http://localhost:12535/maintenance/config/vacuum"
-	@echo "  Monitor: http://localhost:12535/maintenance"
+	@echo "  Visit: http://localhost:23646/maintenance/config/vacuum"
+	@echo "  Monitor: http://localhost:23646/maintenance"
 	@echo ""
 	@echo "Custom Parameters:"
 	@echo "  make vacuum-data FILES=50 DELETE=0.8 SIZE=200"

docker/admin_integration/create_vacuum_test_data.go

@@ -243,7 +243,7 @@ func printTestingInstructions() {
 	fmt.Println("🧪 Testing Instructions:")
 	fmt.Println()
 	fmt.Println("1. Configure Vacuum for Testing:")
-	fmt.Println("   Visit: http://localhost:12535/maintenance/config/vacuum")
+	fmt.Println("   Visit: http://localhost:23646/maintenance/config/vacuum")
 	fmt.Println("   Set:")
 	fmt.Printf("   - Garbage Percentage Threshold: 20 (20%% - lower than default 30)\n")
 	fmt.Printf("   - Scan Interval: [30] [Seconds] (faster than default)\n")
@@ -253,7 +253,7 @@ func printTestingInstructions() {
 	fmt.Println()
 
 	fmt.Println("2. Monitor Vacuum Tasks:")
-	fmt.Println("   Visit: http://localhost:12535/maintenance")
+	fmt.Println("   Visit: http://localhost:23646/maintenance")
 	fmt.Println("   Watch for vacuum tasks to appear in the queue")
 	fmt.Println()
 

docker/admin_integration/demo_vacuum_testing.sh

@@ -7,7 +7,7 @@ echo ""
 # Check if SeaweedFS is running
 echo "📋 Checking SeaweedFS status..."
 MASTER_URL="${MASTER_HOST:-master:9333}"
-ADMIN_URL="${ADMIN_HOST:-admin:12535}"
+ADMIN_URL="${ADMIN_HOST:-admin:23646}"
 
 if ! curl -s http://$MASTER_URL/cluster/status > /dev/null; then
     echo "❌ SeaweedFS master not running at $MASTER_URL"
@@ -42,7 +42,7 @@ echo ""
 
 # Phase 3: Configure vacuum
 echo "⚙️  Phase 3: Vacuum configuration instructions..."
-echo "   1. Visit: http://localhost:12535/maintenance/config/vacuum"
+echo "   1. Visit: http://localhost:23646/maintenance/config/vacuum"
 echo "   2. Set these values for testing:"
 echo "      - Enable Vacuum Tasks: ✅ Checked"
 echo "      - Garbage Threshold: 0.30"
@@ -57,7 +57,7 @@ echo ""
 
 # Phase 4: Monitor tasks
 echo "🎯 Phase 4: Monitoring vacuum tasks..."
-echo "   Visit: http://localhost:12535/maintenance"
+echo "   Visit: http://localhost:23646/maintenance"
 echo "   You should see vacuum tasks appear within 30 seconds"
 echo ""
 
@@ -93,9 +93,9 @@ echo ""
 echo "🎉 Demo Complete!"
 echo ""
 echo "🔍 Things to check:"
-echo "   1. Maintenance Queue: http://localhost:12535/maintenance"
+echo "   1. Maintenance Queue: http://localhost:23646/maintenance"
 echo "   2. Volume Status: http://localhost:9333/vol/status"
-echo "   3. Admin Dashboard: http://localhost:12535"
+echo "   3. Admin Dashboard: http://localhost:23646"
 echo ""
 echo "💡 Next Steps:"
 echo "   - Try different garbage thresholds (0.10, 0.50, 0.80)"

docker/admin_integration/docker-compose-ec-test.yml

@@ -114,9 +114,9 @@ services:
   admin:
     image: chrislusf/seaweedfs:local
     ports:
-      - "12535:12535"      # HTTP admin interface (default port)
-      - "22535:22535"      # gRPC worker communication (12535 + 10000)
-    command: "-v=2 admin -port=12535 -masters=master:9333 -dataDir=/data"
+      - "23646:23646"      # HTTP admin interface (default port)
+      - "33646:33646"      # gRPC worker communication (23646 + 10000)
+    command: "-v=2 admin -port=23646 -masters=master:9333 -dataDir=/data"
     depends_on:
       - master
       - filer
@@ -127,7 +127,7 @@ services:
 
   worker1:
     image: chrislusf/seaweedfs:local
-    command: "-v=2 worker -admin=admin:12535 -capabilities=erasure_coding,vacuum -maxConcurrent=2"
+    command: "-v=2 worker -admin=admin:23646 -capabilities=erasure_coding,vacuum -maxConcurrent=2"
     depends_on:
       - admin
     volumes:
@@ -139,7 +139,7 @@ services:
 
   worker2:
     image: chrislusf/seaweedfs:local
-    command: "-v=2 worker -admin=admin:12535 -capabilities=erasure_coding,vacuum -maxConcurrent=2"
+    command: "-v=2 worker -admin=admin:23646 -capabilities=erasure_coding,vacuum -maxConcurrent=2"
     depends_on:
       - admin
     volumes:
@@ -151,7 +151,7 @@ services:
 
   worker3:
     image: chrislusf/seaweedfs:local
-    command: "-v=2 worker -admin=admin:12535 -capabilities=erasure_coding,vacuum -maxConcurrent=2"
+    command: "-v=2 worker -admin=admin:23646 -capabilities=erasure_coding,vacuum -maxConcurrent=2"
     depends_on:
       - admin
     volumes:
@@ -199,7 +199,7 @@ services:
         curl -s http://master:9333/cluster/status | jq '.IsLeader, .Peers' || echo 'Master not ready';
         echo;
         echo 'Admin status:';
-        curl -s http://admin:12535/ | grep -o 'Admin.*Interface' || echo 'Admin not ready';
+        curl -s http://admin:23646/ | grep -o 'Admin.*Interface' || echo 'Admin not ready';
         echo;
         echo 'Volume count by server:';
         curl -s http://master:9333/vol/status | jq '.Volumes | length' || echo 'Volumes not ready';
@@ -237,4 +237,4 @@ services:
       - seaweed_net
     environment:
       - MASTER_HOST=master:9333
-      - ADMIN_HOST=admin:12535 
+      - ADMIN_HOST=admin:23646 

docker/admin_integration/test-integration.sh

@@ -23,7 +23,7 @@ else
 fi
 
 echo -e "${BLUE}2. Checking if required ports are available...${NC}"
-for port in 9333 8080 8081 8082 8083 8084 8085 8888 12535; do
+for port in 9333 8080 8081 8082 8083 8084 8085 8888 23646; do
     if lsof -i :$port > /dev/null 2>&1; then
         echo -e "${YELLOW}⚠️  Port $port is in use${NC}"
     else
@@ -41,7 +41,7 @@ else
 fi
 
 echo -e "${BLUE}4. Verifying admin server configuration...${NC}"
-if docker-compose -f docker-compose-ec-test.yml config | grep -q "admin:12535"; then
+if docker-compose -f docker-compose-ec-test.yml config | grep -q "admin:23646"; then
     echo -e "${GREEN}✅ Admin server port configuration is correct${NC}"
 else
     echo -e "${RED}❌ Admin server port configuration is incorrect${NC}"

docker/seaweedfs-dev-compose.yml

@@ -45,7 +45,7 @@ services:
   admin:
     image: chrislusf/seaweedfs:dev # use a remote dev image
     ports:
-      - 12535:12535
+      - 23646:23646
     command: 'admin -master=master:9333'
     depends_on:
       - master

go.mod

@@ -14,7 +14,7 @@ require (
 	github.com/coreos/go-semver v0.3.1 // indirect
 	github.com/coreos/go-systemd/v22 v22.7.0 // indirect
 	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
-	github.com/dustin/go-humanize v1.1.0
+	github.com/dustin/go-humanize v1.0.1
 	github.com/eapache/go-resiliency v1.6.0 // indirect
 	github.com/eapache/go-xerial-snappy v0.0.0-20230731223053-c322873962e3 // indirect
 	github.com/eapache/queue v1.1.0 // indirect
@@ -23,8 +23,8 @@ require (
 	github.com/facebookgo/stack v0.0.0-20160209184415-751773369052 // indirect
 	github.com/facebookgo/stats v0.0.0-20151006221625-1b76add642e4
 	github.com/facebookgo/subset v0.0.0-20200203212716-c811ad88dec4 // indirect
-	github.com/fsnotify/fsnotify v1.10.1 // indirect
-	github.com/go-redsync/redsync/v4 v4.18.0
+	github.com/fsnotify/fsnotify v1.9.0 // indirect
+	github.com/go-redsync/redsync/v4 v4.17.0
 	github.com/go-sql-driver/mysql v1.10.1
 	github.com/go-zookeeper/zk v1.0.4 // indirect
 	github.com/golang/protobuf v1.5.4
@@ -32,7 +32,7 @@ require (
 	github.com/google/btree v1.1.3
 	github.com/google/uuid v1.6.0
 	github.com/google/wire v0.7.0 // indirect
-	github.com/googleapis/gax-go/v2 v2.24.1 // indirect
+	github.com/googleapis/gax-go/v2 v2.24.0 // indirect
 	github.com/gorilla/mux v1.8.1
 	github.com/hashicorp/errwrap v1.1.0 // indirect
 	github.com/hashicorp/go-multierror v1.1.1 // indirect
@@ -44,10 +44,10 @@ require (
 	github.com/jmespath/go-jmespath v0.4.0 // indirect
 	github.com/json-iterator/go v1.1.12
 	github.com/karlseguin/ccache/v2 v2.0.8
-	github.com/klauspost/compress v1.20.3
+	github.com/klauspost/compress v1.19.2
 	github.com/klauspost/reedsolomon v1.14.2
 	github.com/kurin/blazer v0.5.3
-	github.com/linxGnu/grocksdb v1.11.1
+	github.com/linxGnu/grocksdb v1.10.8
 	github.com/mailru/easyjson v0.9.2 // indirect
 	github.com/mattn/go-isatty v0.0.24 // indirect
 	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
@@ -60,20 +60,20 @@ require (
 	github.com/pquerna/cachecontrol v0.2.0
 	github.com/prometheus/client_golang v1.24.1
 	github.com/prometheus/client_model v0.6.3
-	github.com/prometheus/common v0.71.0 // indirect
+	github.com/prometheus/common v0.70.1 // indirect
 	github.com/prometheus/procfs v0.22.0
 	github.com/rcrowley/go-metrics v0.0.0-20201227073835-cf1acfcdf475 // indirect
 	github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec // indirect
-	github.com/seaweedfs/goexif v1.0.3
-	github.com/seaweedfs/raft v1.2.2
+	github.com/seaweedfs/goexif v2.0.0+incompatible
+	github.com/seaweedfs/raft v1.2.1
 	github.com/sirupsen/logrus v1.9.4 // indirect
 	github.com/spf13/afero v1.15.0 // indirect
 	github.com/spf13/cast v1.10.0 // indirect
 	github.com/spf13/viper v1.21.0
-	github.com/stretchr/testify v1.12.1
+	github.com/stretchr/testify v1.11.1
 	github.com/stvp/tempredis v0.0.0-20181119212430-b82af8480203
 	github.com/syndtr/goleveldb v1.0.1-0.20190318030020-c3a204f8e965
-	github.com/tidwall/gjson v1.20.0
+	github.com/tidwall/gjson v1.18.0
 	github.com/tidwall/match v1.2.0
 	github.com/tidwall/pretty v1.2.0 // indirect
 	github.com/tsuna/gohbase v0.0.0-20201125011725-348991136365
@@ -87,45 +87,45 @@ require (
 	go.etcd.io/etcd/client/v3 v3.7.1
 	go.mongodb.org/mongo-driver v1.17.9
 	go.opencensus.io v0.24.0 // indirect
-	gocloud.dev v0.47.0
+	gocloud.dev v0.46.0
 	gocloud.dev/pubsub/natspubsub v0.46.0
-	gocloud.dev/pubsub/rabbitpubsub v0.47.0
-	golang.org/x/crypto v0.58.0
-	golang.org/x/exp v0.0.0-20260813180055-c1d0aacb2297
+	gocloud.dev/pubsub/rabbitpubsub v0.46.0
+	golang.org/x/crypto v0.56.0
+	golang.org/x/exp v0.0.0-20260709172345-9ea1abe57597
 	golang.org/x/image v0.46.0
-	golang.org/x/net v0.61.0
-	golang.org/x/oauth2 v0.37.0
-	golang.org/x/sys v0.49.0
-	golang.org/x/text v0.43.0 // indirect
-	golang.org/x/tools v0.51.0 // indirect
+	golang.org/x/net v0.58.0
+	golang.org/x/oauth2 v0.36.0
+	golang.org/x/sys v0.48.0
+	golang.org/x/text v0.42.0 // indirect
+	golang.org/x/tools v0.49.0 // indirect
 	golang.org/x/xerrors v0.0.0-20240903120638-7835f813f4da // indirect
 	google.golang.org/api v0.297.0
-	google.golang.org/genproto v0.0.0-20260904194346-d0f1323225a4 // indirect
+	google.golang.org/genproto v0.0.0-20260715232425-e75dac1f907d // indirect
 	google.golang.org/grpc v1.85.0-dev.0.20260915183914-4e49413dcab7
 	google.golang.org/protobuf v1.36.12
 	gopkg.in/inf.v0 v0.9.1 // indirect
 	modernc.org/b v1.0.0 // indirect
 	modernc.org/mathutil v1.7.1 // indirect
-	modernc.org/memory v1.12.1 // indirect
-	modernc.org/sqlite v1.60.1
+	modernc.org/memory v1.11.0 // indirect
+	modernc.org/sqlite v1.57.0
 )
 
 require (
-	cloud.google.com/go/kms v1.35.0
+	cloud.google.com/go/kms v1.33.0
 	github.com/Azure/azure-sdk-for-go/sdk/keyvault/azkeys v0.10.0
 	github.com/DATA-DOG/go-sqlmock v1.5.2
 	github.com/Jille/raft-grpc-transport v1.6.1
 	github.com/ThreeDotsLabs/watermill v1.5.2
-	github.com/a-h/templ v0.3.1070
+	github.com/a-h/templ v0.3.1020
 	github.com/apache/cassandra-gocql-driver/v2 v2.1.2
-	github.com/apache/iceberg-go v0.7.0
+	github.com/apache/iceberg-go v0.6.1-0.20260817192109-c2105090c9e2
 	github.com/apple/foundationdb/bindings/go v0.0.0-20250911184653-27f7192f47c3
 	github.com/arangodb/go-driver v1.6.9
 	github.com/armon/go-metrics v0.4.1
-	github.com/aws/aws-sdk-go-v2 v1.47.3
-	github.com/aws/aws-sdk-go-v2/config v1.33.6
-	github.com/aws/aws-sdk-go-v2/credentials v1.20.6
-	github.com/aws/aws-sdk-go-v2/service/s3 v1.114.1
+	github.com/aws/aws-sdk-go-v2 v1.47.0
+	github.com/aws/aws-sdk-go-v2/config v1.32.35
+	github.com/aws/aws-sdk-go-v2/credentials v1.20.4
+	github.com/aws/aws-sdk-go-v2/service/s3 v1.107.3
 	github.com/cespare/xxhash/v2 v2.3.0
 	github.com/cognusion/imaging v1.0.4
 	github.com/fluent/fluent-logger-golang v1.10.1
@@ -134,16 +134,16 @@ require (
 	github.com/golang-jwt/jwt/v5 v5.3.1
 	github.com/google/flatbuffers/go v0.0.0-20230108230133-3b8644d32c50
 	github.com/hashicorp/golang-lru/v2 v2.0.7
-	github.com/hashicorp/raft v1.8.0
-	github.com/hashicorp/raft-boltdb/v2 v2.4.2
+	github.com/hashicorp/raft v1.7.3
+	github.com/hashicorp/raft-boltdb/v2 v2.3.1
 	github.com/hashicorp/vault/api v1.23.0
-	github.com/jhump/protoreflect v1.18.1
+	github.com/jhump/protoreflect v1.18.0
 	github.com/linkedin/goavro/v2 v2.15.0
 	github.com/minio/crc64nvme v1.1.1
 	github.com/orcaman/concurrent-map/v2 v2.0.1
 	github.com/parquet-go/parquet-go v0.32.0
 	github.com/pkg/sftp v1.13.11
-	github.com/rabbitmq/amqp091-go v1.15.0
+	github.com/rabbitmq/amqp091-go v1.14.0
 	github.com/rclone/rclone v1.75.1
 	github.com/rdleal/intervalst v1.5.0
 	github.com/redis/go-redis/v9 v9.22.0
@@ -151,16 +151,16 @@ require (
 	github.com/seaweedfs/go-fuse/v2 v2.9.4
 	github.com/shirou/gopsutil/v4 v4.26.7
 	github.com/tarantool/go-option v1.1.0
-	github.com/tarantool/go-tarantool/v3 v3.0.2
+	github.com/tarantool/go-tarantool/v3 v3.0.1
 	github.com/testcontainers/testcontainers-go v0.44.0
 	github.com/tikv/client-go/v2 v2.0.7
-	github.com/twmb/avro v1.9.0
+	github.com/twmb/avro v1.8.0
 	github.com/xeipuuv/gojsonschema v1.2.0
-	github.com/ydb-platform/ydb-go-sdk-auth-environ v0.5.3
-	github.com/ydb-platform/ydb-go-sdk/v3 v3.155.1
+	github.com/ydb-platform/ydb-go-sdk-auth-environ v0.5.2
+	github.com/ydb-platform/ydb-go-sdk/v3 v3.151.1
 	go.etcd.io/etcd/client/pkg/v3 v3.7.1
-	go.uber.org/atomic v1.12.0
-	golang.org/x/sync v0.24.0
+	go.uber.org/atomic v1.11.0
+	golang.org/x/sync v0.23.0
 	golang.org/x/tools/godoc v0.1.0-deprecated
 	google.golang.org/grpc/security/advancedtls v1.0.0
 )
@@ -168,22 +168,24 @@ require (
 require github.com/k0kubun/colorstring v0.0.0-20150214042306-9440f1994b88 // indirect
 
 require (
+	atomicgo.dev/cursor v0.2.0 // indirect
+	atomicgo.dev/keyboard v0.2.9 // indirect
+	atomicgo.dev/schedule v0.1.0 // indirect
 	cloud.google.com/go/longrunning v1.2.0 // indirect
-	cloud.google.com/go/pubsub/v2 v2.7.0 // indirect
+	cloud.google.com/go/pubsub/v2 v2.6.0 // indirect
 	dario.cat/mergo v1.0.2 // indirect
 	github.com/Azure/azure-sdk-for-go/sdk/keyvault/internal v0.7.1 // indirect
-	github.com/Azure/azure-sdk-for-go/sdk/storage/internal v0.1.0 // indirect
 	github.com/Azure/go-ansiterm v0.0.0-20250102033503-faa5f7b0171c // indirect
 	github.com/FilenCloudDienste/filen-sdk-go v0.0.39 // indirect
 	github.com/ProtonMail/gopenpgp/v3 v3.4.1 // indirect
-	github.com/RoaringBitmap/roaring/v2 v2.26.0 // indirect
+	github.com/RoaringBitmap/roaring/v2 v2.24.0 // indirect
 	github.com/a1ex3/zstd-seekable-format-go/pkg v0.10.0 // indirect
 	github.com/adrg/xdg v0.5.3 // indirect
 	github.com/anchore/go-lzo v0.1.1 // indirect
 	github.com/antlr4-go/antlr/v4 v4.13.1 // indirect
-	github.com/apache/arrow-go/v18 v18.8.0 // indirect
+	github.com/apache/arrow-go/v18 v18.7.0 // indirect
 	github.com/apache/thrift v0.24.0 // indirect
-	github.com/aws/aws-sdk-go-v2/service/signin v1.10.1 // indirect
+	github.com/aws/aws-sdk-go-v2/service/signin v1.10.0 // indirect
 	github.com/bahlo/generic-list-go v0.2.0 // indirect
 	github.com/bazelbuild/rules_go v0.46.0 // indirect
 	github.com/biogo/store v0.0.0-20201120204734-aad293a2328f // indirect
@@ -198,6 +200,7 @@ require (
 	github.com/cockroachdb/logtags v0.0.0-20241215232642-bb51bb14a506 // indirect
 	github.com/cockroachdb/redact v1.1.5 // indirect
 	github.com/cockroachdb/version v0.0.0-20250314144055-3860cd14adf2 // indirect
+	github.com/containerd/console v1.0.5 // indirect
 	github.com/containerd/errdefs v1.0.0 // indirect
 	github.com/containerd/errdefs/pkg v0.3.0 // indirect
 	github.com/containerd/log v0.1.0 // indirect
@@ -216,6 +219,7 @@ require (
 	github.com/goccy/go-yaml v1.18.0 // indirect
 	github.com/golang/geo v0.0.0-20210211234256-740aa86cb551 // indirect
 	github.com/google/go-cmp v0.7.0 // indirect
+	github.com/gookit/color v1.6.0 // indirect
 	github.com/gopherjs/gopherjs v1.17.2 // indirect
 	github.com/grpc-ecosystem/grpc-gateway v1.16.0 // indirect
 	github.com/hashicorp/go-rootcerts v1.0.2 // indirect
@@ -232,7 +236,8 @@ require (
 	github.com/jtolds/gls v4.20.0+incompatible // indirect
 	github.com/kr/pretty v0.3.1 // indirect
 	github.com/kr/text v0.2.0 // indirect
-	github.com/lib/pq v1.12.3 // indirect
+	github.com/lib/pq v1.12.0 // indirect
+	github.com/lithammer/fuzzysearch v1.1.8 // indirect
 	github.com/lithammer/shortuuid/v3 v3.0.7 // indirect
 	github.com/lpar/calendar v0.2.0 // indirect
 	github.com/magiconair/properties v1.8.10 // indirect
@@ -255,10 +260,12 @@ require (
 	github.com/petermattis/goid v0.0.0-20260113132338-7c7de50cc741 // indirect
 	github.com/pierrre/geohash v1.0.0 // indirect
 	github.com/pquerna/otp v1.5.0 // indirect
+	github.com/pterm/pterm v0.12.83 // indirect
 	github.com/quic-go/qpack v0.6.0 // indirect
 	github.com/rclone/Proton-API-Bridge v1.0.5 // indirect
 	github.com/rclone/go-proton-api v1.0.4 // indirect
 	github.com/rogpeppe/go-internal v1.15.0 // indirect
+	github.com/rwcarlsen/goexif v0.0.0-20190401172101-9e8deecbddbd // indirect
 	github.com/ryanuber/go-glob v1.0.0 // indirect
 	github.com/sasha-s/go-deadlock v0.3.1 // indirect
 	github.com/smarty/assertions v1.15.0 // indirect
@@ -274,14 +281,15 @@ require (
 	github.com/wk8/go-ordered-map/v2 v2.1.8 // indirect
 	github.com/xeipuuv/gojsonpointer v0.0.0-20190905194746-02993c407bfb // indirect
 	github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415 // indirect
+	github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e // indirect
 	github.com/zeebo/xxh3 v1.1.0 // indirect
-	go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.46.0 // indirect
-	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.46.0 // indirect
+	go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.45.0 // indirect
+	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.45.0 // indirect
 	go.opentelemetry.io/otel/exporters/zipkin v1.45.0 // indirect
 	go.opentelemetry.io/proto/otlp v1.11.0 // indirect
 	go.uber.org/mock v0.5.2 // indirect
 	go.yaml.in/yaml/v2 v2.4.4 // indirect
-	go.yaml.in/yaml/v3 v3.0.5 // indirect
+	go.yaml.in/yaml/v3 v3.0.4 // indirect
 	golang.org/x/mod v0.41.0 // indirect
 	gonum.org/v1/gonum v0.17.0 // indirect
 )
@@ -291,20 +299,20 @@ require (
 	cloud.google.com/go/auth v0.23.2 // indirect
 	cloud.google.com/go/auth/oauth2adapt v0.2.8 // indirect
 	cloud.google.com/go/compute/metadata v0.9.0 // indirect
-	cloud.google.com/go/iam v1.13.0 // indirect
+	cloud.google.com/go/iam v1.12.0 // indirect
 	cloud.google.com/go/monitoring v1.30.0 // indirect
 	filippo.io/edwards25519 v1.2.0 // indirect
-	github.com/Azure/azure-sdk-for-go/sdk/azcore v1.23.2
-	github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.14.1
+	github.com/Azure/azure-sdk-for-go/sdk/azcore v1.22.0
+	github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.14.0
 	github.com/Azure/azure-sdk-for-go/sdk/internal v1.12.0 // indirect
-	github.com/Azure/azure-sdk-for-go/sdk/storage/azblob v1.8.2
+	github.com/Azure/azure-sdk-for-go/sdk/storage/azblob v1.8.0
 	github.com/Azure/azure-sdk-for-go/sdk/storage/azfile v1.7.0 // indirect
 	github.com/Azure/go-ntlmssp v0.1.1 // indirect
-	github.com/AzureAD/microsoft-authentication-library-for-go v1.9.0 // indirect
+	github.com/AzureAD/microsoft-authentication-library-for-go v1.7.2 // indirect
 	github.com/Files-com/files-sdk-go/v3 v3.3.194 // indirect
-	github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.37.0 // indirect
-	github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/metric v0.61.0 // indirect
-	github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/resourcemapping v0.61.0 // indirect
+	github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.35.0 // indirect
+	github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/metric v0.57.0 // indirect
+	github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/resourcemapping v0.57.0 // indirect
 	github.com/IBM/go-sdk-core/v5 v5.23.1 // indirect
 	github.com/Max-Sum/base32768 v0.0.0-20230304063302-18e6ce5945fd // indirect
 	github.com/Microsoft/go-winio v0.6.3-0.20251027160822-ad3df93bed29 // indirect
@@ -314,26 +322,26 @@ require (
 	github.com/ProtonMail/go-srp v0.0.7 // indirect
 	github.com/PuerkitoBio/goquery v1.12.0 // indirect
 	github.com/abbot/go-http-auth v0.4.0 // indirect
-	github.com/andybalholm/brotli v1.2.6 // indirect
+	github.com/andybalholm/brotli v1.2.2 // indirect
 	github.com/andybalholm/cascadia v1.3.4 // indirect
 	github.com/appscode/go-querystring v0.0.0-20170504095604-0126cfb3f1dc // indirect
 	github.com/arangodb/go-velocypack v0.0.0-20200318135517-5af53c29c67e // indirect
-	github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.20 // indirect
-	github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.20.1 // indirect
+	github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.18 // indirect
+	github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.20.0 // indirect
 	github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.22.34 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/configsources v1.5.4 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.8.4 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/v4a v1.5.4 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/configsources v1.5.3 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.8.3 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/v4a v1.5.3 // indirect
 	github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.19 // indirect
-	github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.11.5 // indirect
-	github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.14.4 // indirect
-	github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.20.4 // indirect
-	github.com/aws/aws-sdk-go-v2/service/sns v1.46.0 // indirect
-	github.com/aws/aws-sdk-go-v2/service/sqs v1.51.0 // indirect
-	github.com/aws/aws-sdk-go-v2/service/sso v1.38.1 // indirect
-	github.com/aws/aws-sdk-go-v2/service/ssooidc v1.43.1 // indirect
-	github.com/aws/aws-sdk-go-v2/service/sts v1.51.1
-	github.com/aws/smithy-go v1.28.5
+	github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.9.31 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.14.3 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.19.39 // indirect
+	github.com/aws/aws-sdk-go-v2/service/sns v1.39.14 // indirect
+	github.com/aws/aws-sdk-go-v2/service/sqs v1.42.24 // indirect
+	github.com/aws/aws-sdk-go-v2/service/sso v1.38.0 // indirect
+	github.com/aws/aws-sdk-go-v2/service/ssooidc v1.43.0 // indirect
+	github.com/aws/aws-sdk-go-v2/service/sts v1.50.0
+	github.com/aws/smithy-go v1.28.1
 	github.com/boltdb/bolt v1.3.1 // indirect
 	github.com/bradenaw/juniper v0.15.3 // indirect
 	github.com/buengese/sgzip v0.1.1 // indirect
@@ -357,14 +365,14 @@ require (
 	github.com/emersion/go-vcard v0.0.0-20260618161152-d854b7e0e2d3 // indirect
 	github.com/envoyproxy/go-control-plane/envoy v1.39.1-0.20260819172001-e6e3fd93e4be // indirect
 	github.com/envoyproxy/protoc-gen-validate v1.3.3 // indirect
-	github.com/fatih/color v1.19.0 // indirect
+	github.com/fatih/color v1.18.0 // indirect
 	github.com/felixge/httpsnoop v1.1.0 // indirect
 	github.com/flynn/noise v1.1.0 // indirect
 	github.com/gabriel-vasile/mimetype v1.4.13 // indirect
 	github.com/geoffgarside/ber v1.2.0 // indirect
 	github.com/go-chi/chi/v5 v5.3.1 // indirect
 	github.com/go-darwin/apfs v0.0.0-20211011131704-f84b94dbf348 // indirect
-	github.com/go-jose/go-jose/v4 v4.1.5 // indirect
+	github.com/go-jose/go-jose/v4 v4.1.4 // indirect
 	github.com/go-logr/logr v1.4.4 // indirect
 	github.com/go-logr/stdr v1.2.2 // indirect
 	github.com/go-ole/go-ole v1.3.0 // indirect
@@ -385,14 +393,14 @@ require (
 	github.com/gorilla/securecookie v1.1.2 // indirect
 	github.com/gorilla/sessions v1.4.0
 	github.com/grpc-ecosystem/go-grpc-middleware v1.4.0 // indirect
-	github.com/grpc-ecosystem/grpc-gateway/v2 v2.30.0 // indirect
+	github.com/grpc-ecosystem/grpc-gateway/v2 v2.29.0 // indirect
 	github.com/hashicorp/go-cleanhttp v0.5.2 // indirect
 	github.com/hashicorp/go-hclog v1.6.3 // indirect
 	github.com/hashicorp/go-immutable-radix v1.3.1 // indirect
-	github.com/hashicorp/go-metrics v0.7.0 // indirect
-	github.com/hashicorp/go-msgpack/v2 v2.1.5 // indirect
+	github.com/hashicorp/go-metrics v0.5.4 // indirect
+	github.com/hashicorp/go-msgpack/v2 v2.1.2 // indirect
 	github.com/hashicorp/go-retryablehttp v0.7.8 // indirect
-	github.com/hashicorp/golang-lru v1.0.2 // indirect
+	github.com/hashicorp/golang-lru v0.6.0 // indirect
 	github.com/jcmturner/aescts/v2 v2.0.0 // indirect
 	github.com/jcmturner/dnsutils/v2 v2.0.0 // indirect
 	github.com/jcmturner/goidentity/v6 v6.0.1 // indirect
@@ -470,10 +478,10 @@ require (
 	github.com/vmihailenco/tagparser/v2 v2.0.0 // indirect
 	github.com/winfsp/cgofuse v1.6.1-0.20260126094232-f2c4fccdb286
 	github.com/xanzy/ssh-agent v0.3.3 // indirect
-	github.com/yandex-cloud/go-genproto v0.0.0-20240819112322-98a264d392f6 // indirect
+	github.com/yandex-cloud/go-genproto v0.0.0-20211115083454-9ca41db5ed9e // indirect
 	github.com/ydb-platform/ydb-go-genproto v0.0.0-20260810122915-65bfd5c4b705 // indirect
-	github.com/ydb-platform/ydb-go-yc v0.12.5 // indirect
-	github.com/ydb-platform/ydb-go-yc-metadata v0.6.2 // indirect
+	github.com/ydb-platform/ydb-go-yc v0.12.1 // indirect
+	github.com/ydb-platform/ydb-go-yc-metadata v0.6.1 // indirect
 	github.com/yunify/qingstor-sdk-go/v3 v3.2.0 // indirect
 	github.com/yusufpapurcu/wmi v1.2.4 // indirect
 	github.com/zeebo/blake3 v0.2.4 // indirect
@@ -481,25 +489,25 @@ require (
 	go.etcd.io/bbolt v1.5.0 // indirect
 	go.etcd.io/etcd/api/v3 v3.7.1 // indirect
 	go.opentelemetry.io/auto/sdk v1.2.1 // indirect
-	go.opentelemetry.io/contrib/detectors/gcp v1.46.0 // indirect
-	go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.71.0 // indirect
-	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.71.0 // indirect
-	go.opentelemetry.io/otel v1.46.0 // indirect
-	go.opentelemetry.io/otel/metric v1.46.0 // indirect
-	go.opentelemetry.io/otel/sdk v1.46.0 // indirect
-	go.opentelemetry.io/otel/sdk/metric v1.46.0 // indirect
-	go.opentelemetry.io/otel/trace v1.46.0 // indirect
+	go.opentelemetry.io/contrib/detectors/gcp v1.45.0 // indirect
+	go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.69.0 // indirect
+	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.70.0 // indirect
+	go.opentelemetry.io/otel v1.45.0 // indirect
+	go.opentelemetry.io/otel/metric v1.45.0 // indirect
+	go.opentelemetry.io/otel/sdk v1.45.0 // indirect
+	go.opentelemetry.io/otel/sdk/metric v1.45.0 // indirect
+	go.opentelemetry.io/otel/trace v1.45.0 // indirect
 	go.uber.org/multierr v1.11.0 // indirect
-	go.uber.org/zap v1.28.0 // indirect
-	golang.org/x/term v0.47.0
-	golang.org/x/time v0.16.0
-	google.golang.org/genproto/googleapis/api v0.0.0-20260904194346-d0f1323225a4 // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20260904194346-d0f1323225a4 // indirect
+	go.uber.org/zap v1.27.1 // indirect
+	golang.org/x/term v0.45.0
+	golang.org/x/time v0.15.0
+	google.golang.org/genproto/googleapis/api v0.0.0-20260817212433-ac3dfec99bb1 // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20260819154853-08b0e4226688 // indirect
 	gopkg.in/natefinch/lumberjack.v2 v2.2.1 // indirect
 	gopkg.in/validator.v2 v2.0.1 // indirect
 	gopkg.in/yaml.v2 v2.4.0 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
-	modernc.org/libc v1.77.1 // indirect
+	modernc.org/libc v1.74.4 // indirect
 	moul.io/http2curl/v2 v2.3.0 // indirect
 	sigs.k8s.io/yaml v1.6.0 // indirect
 	storj.io/common v0.0.0-20260629224719-ba1bff0a7846 // indirect

install.sh

@@ -350,7 +350,7 @@ main() {
     info "  weed volume -mserver=localhost:9333   # Start Go volume server"
     info "  weed-volume -mserver localhost:9333 # Start Rust volume server"
     if [ "$WORKER_INSTALLED" = true ]; then
-        info "  weed-worker --admin localhost:12535  # Start the Rust maintenance worker"
+        info "  weed-worker --admin localhost:23646  # Start the Rust maintenance worker"
     fi
 }
 

k8s/charts/seaweedfs/Chart.yaml

@@ -1,6 +1,6 @@
 apiVersion: v1
 description: SeaweedFS
 name: seaweedfs
-appVersion: "4.48"
+appVersion: "4.47"
 # Dev note: Trigger a helm chart release by `git tag -a helm-<version>`
-version: 4.48.2
+version: 4.47.1

k8s/charts/seaweedfs/README.md

@@ -27,19 +27,6 @@ so your deployment will be spread/HA.
 * cert config exists and can be enabled, but not been tested, requires cert-manager to be installed.
 
 ## Prerequisites
-
-The chart's templates render with Helm 3.16.3 and newer versions tested in CI.
-Earlier Helm versions are not covered by this chart's compatibility checks.
-When JWT signing is enabled, a live upgrade reuses keys from the existing
-security ConfigMap (including the legacy ConfigMap name); a key absent from
-that ConfigMap is generated. Plain `helm template` does not read cluster state;
-use an install and upgrade against a cluster to check key persistence.
-
-The key reader supports single-line quoted TOML strings in JWT sections,
-including indented assignments, quoted key names, and bare or simply quoted
-section-name segments. An unsupported value or quoted header fails the upgrade
-rather than silently rotating a key.
-
 ### Database
 
 leveldb is the default database, this supports multiple filer replicas that will [sync automatically](https://github.com/seaweedfs/seaweedfs/wiki/Filer-Store-Replication), with some [limitations](https://github.com/seaweedfs/seaweedfs/wiki/Filer-Store-Replication#limitation).
@@ -345,9 +332,8 @@ To enable the admin interface, add the following to your values.yaml:
 ```yaml
 admin:
   enabled: true
-  port: 12535
-  grpcPort: 22535  # For worker connections
-  legacyPort: 23646  # Compat: also serve http + gRPC (+10000) for pre-12535 clients
+  port: 23646
+  grpcPort: 33646  # For worker connections
   secret:
     adminUser: "admin"
     adminPassword: "your-secure-password"  # Leave empty to disable auth
@@ -365,9 +351,7 @@ admin:
     className: "nginx"
 ```
 
-The admin interface will be available at `http://<admin-service>:12535` (or via ingress). Workers connect to the admin server via gRPC on port `22535`.
-
-For backward compatibility with older clients and workers, admin also serves the previous default ports: HTTP on `23646` and gRPC on `33646` (legacyPort + 10000). The Service and NetworkPolicy expose both. Set `admin.legacyPort: 0` to disable.
+The admin interface will be available at `http://<admin-service>:23646` (or via ingress). Workers connect to the admin server via gRPC on port `33646`.
 
 ### Admin Authentication
 
@@ -392,10 +376,7 @@ start on a non-loopback address without `-adminPassword`, so the chart fails at
 render time if `admin.ip` is non-loopback and authentication is not configured via
 `admin.secret.adminPassword`, `admin.secret.existingSecret`, or
 `WEED_ADMIN_PASSWORD` supplied through `admin.extraEnvironmentVars` /
-`admin.secretExtraEnvironmentVars`. Setting `admin.allowInsecureBind` renders
-`-allowInsecureBind` and bypasses this guard; it leaves the admin API
-unauthenticated on the network, so use it only when access is otherwise
-restricted (e.g. network policies). The whole `127.0.0.0/8` range and `::1` are
+`admin.secretExtraEnvironmentVars`. The whole `127.0.0.0/8` range and `::1` are
 treated as loopback (matching `weed admin`); `localhost` is treated as
 non-loopback. Set `admin.ip` to a loopback address only if you also replace the
 httpGet probes (e.g. with an `exec` probe that checks `127.0.0.1`).
@@ -439,7 +420,7 @@ worker:
   # Auto-discovery only works if the admin is in the same namespace and same Helm release.
   # For cross-namespace or separate release scenarios, explicitly set this value.
   # Example: If main SeaweedFS is deployed in "production" namespace:
-  #   adminServer: "seaweedfs-admin.production.svc:22535"
+  #   adminServer: "seaweedfs-admin.production.svc:33646"
   adminServer: ""
   
   # Workers need storage for task execution
@@ -505,8 +486,8 @@ worker:
   # REQUIRED: Point to the admin service of your main SeaweedFS release
   # Replace <namespace> with the namespace where your main seaweedfs is deployed
   # Example: If deploying in namespace "production":
-  #   adminServer: "seaweedfs-admin.production.svc:22535"
-  adminServer: "seaweedfs-admin.<namespace>.svc:22535"
+  #   adminServer: "seaweedfs-admin.production.svc:33646"
+  adminServer: "seaweedfs-admin.<namespace>.svc:33646"
 ```
 
 **values-worker-balance.yaml** (for balance operations):
@@ -531,8 +512,8 @@ worker:
   # REQUIRED: Point to the admin service of your main SeaweedFS release
   # Replace <namespace> with the namespace where your main seaweedfs is deployed
   # Example: If deploying in namespace "production":
-  #   adminServer: "seaweedfs-admin.production.svc:22535"
-  adminServer: "seaweedfs-admin.<namespace>.svc:22535"
+  #   adminServer: "seaweedfs-admin.production.svc:33646"
+  adminServer: "seaweedfs-admin.<namespace>.svc:33646"
 ```
 
 Deploy the specialized workers as separate releases:
@@ -545,26 +526,6 @@ helm install seaweedfs-worker-vacuum seaweedfs/seaweedfs -f values-worker-vacuum
 helm install seaweedfs-worker-balance seaweedfs/seaweedfs -f values-worker-balance.yaml
 ```
 
-## Gateway API
-
-Every component with an `ingress` block (master, volume, filer, s3 and admin) can also be exposed through a [Gateway API](https://gateway-api.sigs.k8s.io/) `HTTPRoute`, for clusters that route through a Gateway instead of an Ingress controller. `<component>.httpRoute` sits next to `<component>.ingress` and is disabled by default. The chart does not create the Gateway, so point `parentRefs` at one that already exists, and the `gateway.networking.k8s.io/v1` CRDs must be installed.
-
-```yaml
-s3:
-  httpRoute:
-    enabled: true
-    parentRefs:
-      - group: gateway.networking.k8s.io
-        kind: Gateway
-        name: my-gateway
-        namespace: gateway-system
-        sectionName: https
-    hostnames:
-      - s3.example.com
-```
-
-With `rules` left empty the route sends all traffic to the component's own Service and port. A rule may set `matches`, `filters`, `timeouts` and `backendRefs`, and a rule without `backendRefs` still routes to that Service. In all-in-one mode the master, volume, filer and s3 routes target the all-in-one Service. When S3 runs only on the filer (`filer.s3.enabled` without `s3.enabled`), the s3 route uses `filer.s3.port`.
-
 ## Network Policies
 
 In a namespace with a default-deny policy the install hangs: the components cannot resolve each other, and the post-install bucket hook waits on the master and filer until it gives up. `networkPolicy.enabled` renders one `NetworkPolicy` per component, selecting its pods by the standard `app.kubernetes.io/{name,instance,component}` labels and admitting traffic from the other pods of the release on the ports that component listens on.
@@ -606,23 +567,6 @@ Two things worth knowing before you turn this on:
 
 The DNS selectors default to CoreDNS as kubeadm, kind and the managed offerings from AWS, Google and Azure install it. On OpenShift, override `egress.dnsNamespaceSelector` and `egress.dnsPodSelector` to match `openshift-dns`; see the comment in `values.yaml`.
 
-## Pod and container security contexts
-
-Pod and container security contexts are configurable independently for every built-in workload and remain empty by default for backwards compatibility. The examples in `values.yaml` show how to enable a `RuntimeDefault` seccomp profile, disable privilege escalation and privileged mode, drop all Linux capabilities, and use a read-only root filesystem.
-
-SeaweedFS uses `/tmp` for Unix sockets, temporary uploads, worker task files, and other runtime data. When `readOnlyRootFilesystem` is enabled for a built-in component, the chart mounts a writable `emptyDir` at `/tmp` for its chart-managed containers. Its optional size limit can be configured globally:
-
-```yaml
-global:
-  seaweedfs:
-    tmpDir:
-      sizeLimit: 1Gi
-```
-
-The chart does not enable `runAsNonRoot` by default because its default `hostPath` storage may be owned by root. To enforce the Kubernetes `restricted` Pod Security Standard, use storage that is writable by a non-root user and configure `runAsNonRoot` or use the OpenShift overrides below.
-
-Security contexts configured for a component also apply to the chart-managed helper containers for that component. User-provided init containers and sidecars must define their own container security context and writable mounts.
-
 ## OpenShift Support
 
 SeaweedFS can be deployed on OpenShift or any cluster enforcing the Kubernetes "restricted" Pod Security Standard. By default, OpenShift blocks containers that run as root or use `hostPath` volumes.
@@ -631,7 +575,6 @@ To deploy on OpenShift, use the provided `openshift-values.yaml` which overrides
 1. Use `PersistentVolumeClaims` instead of `hostPath`.
 2. Enable `runAsNonRoot` and omit hardcoded UIDs to allow OpenShift to assign valid UIDs automatically.
 3. Apply appropriate `seccompProfile` and drop capabilities.
-4. Use a read-only root filesystem with writable temporary storage at `/tmp`.
 
 Usage:
 ```bash

k8s/charts/seaweedfs/openshift-values.yaml

@@ -15,7 +15,6 @@
 #      automatically assign a valid UID from the namespace's allocated range.
 #   3. Dropping all Linux capabilities and setting allowPrivilegeEscalation: false
 #   4. Enabling RuntimeDefault seccompProfile
-#   5. Using a read-only root filesystem with writable temporary storage
 #
 # Usage:
 #   helm install seaweedfs seaweedfs/seaweedfs \
@@ -50,7 +49,6 @@ master:
   containerSecurityContext:
     enabled: true
     allowPrivilegeEscalation: false
-    readOnlyRootFilesystem: true
     capabilities:
       drop: ["ALL"]
     runAsNonRoot: true
@@ -78,7 +76,6 @@ volume:
   containerSecurityContext:
     enabled: true
     allowPrivilegeEscalation: false
-    readOnlyRootFilesystem: true
     capabilities:
       drop: ["ALL"]
     runAsNonRoot: true
@@ -104,7 +101,6 @@ filer:
   containerSecurityContext:
     enabled: true
     allowPrivilegeEscalation: false
-    readOnlyRootFilesystem: true
     capabilities:
       drop: ["ALL"]
     runAsNonRoot: true
@@ -129,7 +125,6 @@ s3:
   containerSecurityContext:
     enabled: true
     allowPrivilegeEscalation: false
-    readOnlyRootFilesystem: true
     capabilities:
       drop: ["ALL"]
     runAsNonRoot: true

k8s/charts/seaweedfs/templates/admin/admin-httproute.yaml

@@ -1,55 +0,0 @@
-{{- if and .Values.admin.enabled .Values.admin.httpRoute.enabled }}
-apiVersion: gateway.networking.k8s.io/v1
-kind: HTTPRoute
-metadata:
-  name: {{ include "seaweedfs.componentName" (list . "admin") }}
-  namespace: {{ .Release.Namespace }}
-  {{- with .Values.admin.httpRoute.annotations }}
-  annotations:
-    {{- toYaml . | nindent 4 }}
-  {{- end }}
-  labels:
-    app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
-    helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
-    app.kubernetes.io/managed-by: {{ .Release.Service }}
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/component: admin
-    {{- with .Values.admin.httpRoute.labels }}
-    {{- toYaml . | nindent 4 }}
-    {{- end }}
-spec:
-  {{- with .Values.admin.httpRoute.parentRefs }}
-  parentRefs:
-    {{- toYaml . | nindent 4 }}
-  {{- end }}
-  {{- with .Values.admin.httpRoute.hostnames }}
-  hostnames:
-    {{- toYaml . | nindent 4 }}
-  {{- end }}
-  rules:
-    {{- range .Values.admin.httpRoute.rules | default (list dict) }}
-    - backendRefs:
-        {{- with .backendRefs }}
-        {{- toYaml . | nindent 8 }}
-        {{- else }}
-        - group: ""
-          kind: Service
-          name: {{ include "seaweedfs.componentName" (list $ "admin") }}
-          namespace: {{ $.Release.Namespace }}
-          port: {{ $.Values.admin.port }}
-          weight: 1
-        {{- end }}
-      {{- with .matches }}
-      matches:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      {{- with .filters }}
-      filters:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      {{- with .timeouts }}
-      timeouts:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-    {{- end }}
-{{- end }}

k8s/charts/seaweedfs/templates/admin/admin-service.yaml

@@ -37,16 +37,6 @@ spec:
     nodePort: {{ $nodePorts.grpc }}
     {{- end }}
     protocol: TCP
-  {{- if gt (int .Values.admin.legacyPort) 0 }}
-  - name: "legacy-http"
-    port: {{ .Values.admin.legacyPort }}
-    targetPort: {{ .Values.admin.legacyPort }}
-    protocol: TCP
-  - name: "legacy-grpc"
-    port: {{ add (int .Values.admin.legacyPort) 10000 }}
-    targetPort: {{ add (int .Values.admin.legacyPort) 10000 }}
-    protocol: TCP
-  {{- end }}
   selector:
     app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
     app.kubernetes.io/instance: {{ .Release.Name }}

k8s/charts/seaweedfs/templates/admin/admin-statefulset.yaml

@@ -9,7 +9,7 @@
 {{- $adminAuthEnabled := include "seaweedfs.admin.authEnabled" . }}
 {{- $adminIp := .Values.admin.ip | default "0.0.0.0" }}
 {{- if and (not (include "seaweedfs.admin.isLoopbackIp" $adminIp)) (ne $adminAuthEnabled "true") }}
-{{- fail (printf "admin.ip is set to %q (non-loopback) but admin authentication is not configured. Since `weed admin` 4.46 refuses to bind a non-loopback address without authentication, the admin container would exit on startup. Set admin.secret.adminPassword or admin.secret.existingSecret, or supply WEED_ADMIN_PASSWORD via admin.extraEnvironmentVars / admin.secretExtraEnvironmentVars, or set admin.ip to a loopback address such as 127.0.0.1 (note: a loopback bind makes the chart's httpGet readiness/liveness probes fail), or set admin.allowInsecureBind to true to opt out via -allowInsecureBind (INSECURE: exposes the admin API unauthenticated on the network)." $adminIp) -}}
+{{- fail (printf "admin.ip is set to %q (non-loopback) but admin authentication is not configured. Since `weed admin` 4.46 refuses to bind a non-loopback address without authentication, the admin container would exit on startup. Set admin.secret.adminPassword or admin.secret.existingSecret, or supply WEED_ADMIN_PASSWORD via admin.extraEnvironmentVars / admin.secretExtraEnvironmentVars, or set admin.ip to a loopback address such as 127.0.0.1 (note: a loopback bind makes the chart's httpGet readiness/liveness probes fail)." $adminIp) -}}
 {{- end }}
 apiVersion: apps/v1
 kind: StatefulSet
@@ -170,32 +170,25 @@ spec:
               -ip={{ .Values.admin.ip | default "0.0.0.0" }} \
               -port={{ .Values.admin.port }} \
               -port.grpc={{ .Values.admin.grpcPort }} \
-              {{- if ne (int .Values.admin.legacyPort) 23646 }}
-              -port.legacy={{ .Values.admin.legacyPort }} \
-              {{- end }}
               {{- if or (eq .Values.admin.data.type "hostPath") (eq .Values.admin.data.type "persistentVolumeClaim") (eq .Values.admin.data.type "emptyDir") (eq .Values.admin.data.type "existingClaim") }}
               -dataDir=/data \
               {{- else if .Values.admin.dataDir }}
               -dataDir={{ .Values.admin.dataDir }} \
               {{- end }}
               {{- if .Values.admin.masters }}
-              -masters={{ .Values.admin.masters }} \
+              -masters={{ .Values.admin.masters }}{{- if or $urlPrefix .Values.admin.extraArgs }} \{{ end }}
               {{- else if .Values.global.seaweedfs.masterServer }}
-              -masters={{ .Values.global.seaweedfs.masterServer }} \
+              -masters={{ .Values.global.seaweedfs.masterServer }}{{- if or $urlPrefix .Values.admin.extraArgs }} \{{ end }}
               {{- else }}
-              -masters={{ range $index := until (.Values.master.replicas | int) }}${SEAWEEDFS_FULLNAME}-master-{{ $index }}.${SEAWEEDFS_FULLNAME}-master.{{ $.Release.Namespace }}:{{ $.Values.master.port }}{{ if lt $index (sub ($.Values.master.replicas | int) 1) }},{{ end }}{{ end }} \
+              -masters={{ range $index := until (.Values.master.replicas | int) }}${SEAWEEDFS_FULLNAME}-master-{{ $index }}.${SEAWEEDFS_FULLNAME}-master.{{ $.Release.Namespace }}:{{ $.Values.master.port }}{{ if lt $index (sub ($.Values.master.replicas | int) 1) }},{{ end }}{{ end }}{{- if or $urlPrefix .Values.admin.extraArgs }} \{{ end }}
               {{- end }}
               {{- if $urlPrefix }}
-              -urlPrefix={{ $urlPrefix }} \
-              {{- end }}
-              {{- if .Values.admin.allowInsecureBind }}
-              -allowInsecureBind \
+              -urlPrefix={{ $urlPrefix }}{{- if .Values.admin.extraArgs }} \{{ end }}
               {{- end }}
               {{- range $index, $arg := .Values.admin.extraArgs }}
               {{ $arg }}{{- if lt $index (sub (len $.Values.admin.extraArgs) 1) }} \{{ end }}
               {{- end }}
           volumeMounts:
-            {{- include "seaweedfs.tmpDirVolumeMount" (list . .Values.admin.containerSecurityContext (tpl (.Values.admin.extraVolumeMounts | default "") .) (tpl (.Values.admin.extraVolumes | default "") .)) | nindent 12 }}
             {{- if or (eq .Values.admin.data.type "hostPath") (eq .Values.admin.data.type "persistentVolumeClaim") (eq .Values.admin.data.type "emptyDir") (eq .Values.admin.data.type "existingClaim") }}
             - name: admin-data
               mountPath: /data
@@ -236,12 +229,6 @@ spec:
               name: http
             - containerPort: {{ .Values.admin.grpcPort }}
               name: grpc
-            {{- if gt (int .Values.admin.legacyPort) 0 }}
-            - containerPort: {{ .Values.admin.legacyPort }}
-              name: legacy-http
-            - containerPort: {{ add (int .Values.admin.legacyPort) 10000 }}
-              name: legacy-grpc
-            {{- end }}
           {{- if .Values.admin.readinessProbe.enabled }}
           readinessProbe:
             httpGet:
@@ -277,7 +264,6 @@ spec:
       {{- include "seaweedfs.tplvalues.render" (dict "value" .Values.admin.sidecars "context" $) | nindent 8 }}
       {{- end }}
       volumes:
-        {{- include "seaweedfs.tmpDirVolume" (list . .Values.admin.containerSecurityContext (tpl (.Values.admin.extraVolumeMounts | default "") .) (tpl (.Values.admin.extraVolumes | default "") .) false) | nindent 8 }}
         {{- if eq .Values.admin.data.type "hostPath" }}
         - name: admin-data
           hostPath:

k8s/charts/seaweedfs/templates/all-in-one/all-in-one-deployment.yaml

@@ -43,7 +43,7 @@ spec:
       {{- $configSecret := (lookup "v1" "Secret" .Release.Namespace $existingS3ConfigSecret) | default dict }}
       {{- $_ := set $podAnnotations "checksum/s3config" ($configSecret | toYaml | sha256sum) }}
       {{- else }}
-      {{- $_ := set $podAnnotations "checksum/s3config" (include "seaweedfs.s3.configChecksum" .) }}
+      {{- $_ := set $podAnnotations "checksum/s3config" (include (print .Template.BasePath "/s3/s3-secret.yaml") . | sha256sum) }}
       {{- end }}
       {{- $_ := set $podAnnotations "checksum/master-config" (include (print .Template.BasePath "/master/master-configmap.yaml") . | sha256sum) }}
       annotations:
@@ -306,7 +306,6 @@ spec:
               {{- end }}
 
           volumeMounts:
-            {{- include "seaweedfs.tmpDirVolumeMount" (list . .Values.allInOne.containerSecurityContext (tpl (.Values.allInOne.extraVolumeMounts | default "") .) (tpl (.Values.allInOne.extraVolumes | default "") .)) | nindent 12 }}
             - name: data
               mountPath: /data
             {{- if and .Values.allInOne.s3.enabled (or .Values.allInOne.s3.enableAuth .Values.s3.enableAuth .Values.filer.s3.enableAuth) }}
@@ -434,7 +433,6 @@ spec:
       {{- include "seaweedfs.tplvalues.render" (dict "value" .Values.allInOne.sidecars "context" $) | nindent 8 }}
       {{- end }}
       volumes:
-        {{- include "seaweedfs.tmpDirVolume" (list . .Values.allInOne.containerSecurityContext (tpl (.Values.allInOne.extraVolumeMounts | default "") .) (tpl (.Values.allInOne.extraVolumes | default "") .) false) | nindent 8 }}
         {{- include "seaweedfs.licenseVolume" . | nindent 8 }}
         - name: data
           {{- if eq .Values.allInOne.data.type "hostPath" }}

k8s/charts/seaweedfs/templates/cert/admin-cert.yaml

@@ -25,10 +25,6 @@ spec:
     organizations:
     - "SeaweedFS CA"
   dnsNames:
-    - '{{ include "seaweedfs.fullname" . }}-admin'
-    - '{{ include "seaweedfs.fullname" . }}-admin.{{ .Release.Namespace }}'
-    - '{{ include "seaweedfs.fullname" . }}-admin.{{ .Release.Namespace }}.svc'
-    - '{{ include "seaweedfs.fullname" . }}-admin.{{ .Release.Namespace }}.svc.cluster.local'
     - '*.{{ include "seaweedfs.fullname" . }}-admin'
     - '*.{{ include "seaweedfs.fullname" . }}-admin.{{ .Release.Namespace }}'
     - '*.{{ include "seaweedfs.fullname" . }}-admin.{{ .Release.Namespace }}.svc'

k8s/charts/seaweedfs/templates/cosi/cosi-cluster-role.yaml

@@ -28,13 +28,6 @@ rules:
     - "update"
     - "create"
     - "delete"
-- apiGroups: ["objectstorage.k8s.io"]
-  resources:
-    - "bucketclasses"
-  verbs:
-    - "get"
-    - "list"
-    - "watch"
 - apiGroups: ["coordination.k8s.io"]
   resources: ["leases"]
   verbs:
@@ -68,7 +61,7 @@ metadata:
     app.kubernetes.io/instance: {{ .Release.Name }}
 subjects:
   - kind: ServiceAccount
-    name: {{ include "seaweedfs.serviceAccountName" . }}-objectstorage-provisioner
+    name: {{ .Values.global.seaweedfs.serviceAccountName }}-objectstorage-provisioner
     namespace: {{ .Release.Namespace }}
 roleRef:
   kind: ClusterRole

k8s/charts/seaweedfs/templates/cosi/cosi-deployment.yaml

@@ -61,7 +61,7 @@ spec:
       schedulerName: {{ .Values.cosi.schedulerName | quote }}
       {{- end }}
       enableServiceLinks: false
-      serviceAccountName: {{ include "seaweedfs.serviceAccountName" . }}-objectstorage-provisioner
+      serviceAccountName: {{ include "seaweedfs.componentName" (list . "objectstorage-provisioner") }}
       {{- if .Values.cosi.initContainers }}
       initContainers:
         {{ tpl .Values.cosi.initContainers . | nindent 8 | trim }}
@@ -113,7 +113,6 @@ spec:
             {{- end -}}
             {{- end }}
           volumeMounts:
-            {{- include "seaweedfs.tmpDirVolumeMount" (list . .Values.cosi.containerSecurityContext (tpl (.Values.cosi.extraVolumeMounts | default "") .) (tpl (.Values.cosi.extraVolumes | default "") .)) | nindent 12 }}
             - mountPath: /var/lib/cosi
               name: socket
             {{- if .Values.cosi.enableAuth }}
@@ -149,9 +148,6 @@ spec:
           resources:
             {{- toYaml . | nindent 12 }}
           {{- end }}
-          {{- if .Values.cosi.containerSecurityContext.enabled }}
-          securityContext: {{- omit .Values.cosi.containerSecurityContext "enabled" | toYaml | nindent 12 }}
-          {{- end }}
         - name: seaweedfs-cosi-sidecar
           image: "{{ .Values.cosi.sidecar.image }}"
           imagePullPolicy: {{ default "IfNotPresent" .Values.global.seaweedfs.imagePullPolicy }}
@@ -163,7 +159,6 @@ spec:
                 fieldRef:
                   fieldPath: metadata.namespace
           volumeMounts:
-            {{- include "seaweedfs.tmpDirVolumeMount" (list . .Values.cosi.containerSecurityContext "" "") | nindent 12 }}
             - mountPath: /var/lib/cosi
               name: socket
           {{- with .Values.cosi.sidecar.resources }}
@@ -177,7 +172,6 @@ spec:
       {{- include "seaweedfs.tplvalues.render" (dict "value" .Values.cosi.sidecars "context" $) | nindent 8 }}
       {{- end }}
       volumes:
-        {{- include "seaweedfs.tmpDirVolume" (list . .Values.cosi.containerSecurityContext (tpl (.Values.cosi.extraVolumeMounts | default "") .) (tpl (.Values.cosi.extraVolumes | default "") .) true) | nindent 8 }}
         - name: socket
           emptyDir: {}
         {{- if .Values.cosi.enableAuth }}

k8s/charts/seaweedfs/templates/cosi/cosi-service-account.yaml

@@ -3,7 +3,7 @@
 apiVersion: v1
 kind: ServiceAccount
 metadata:
-  name: {{ include "seaweedfs.serviceAccountName" . }}-objectstorage-provisioner
+  name: {{ .Values.global.seaweedfs.serviceAccountName }}-objectstorage-provisioner
   namespace: {{ .Release.Namespace }}
   labels:
     app.kubernetes.io/name: {{ template "seaweedfs.name" . }}

k8s/charts/seaweedfs/templates/filer/filer-httproute.yaml

@@ -1,57 +0,0 @@
-{{- $filerEnabled := or .Values.filer.enabled .Values.allInOne.enabled }}
-{{- if and $filerEnabled .Values.filer.httpRoute.enabled }}
-{{- $serviceName := ternary (include "seaweedfs.componentName" (list . "all-in-one")) (include "seaweedfs.componentName" (list . "filer")) .Values.allInOne.enabled }}
-apiVersion: gateway.networking.k8s.io/v1
-kind: HTTPRoute
-metadata:
-  name: {{ include "seaweedfs.componentName" (list . "filer") }}
-  namespace: {{ .Release.Namespace }}
-  {{- with .Values.filer.httpRoute.annotations }}
-  annotations:
-    {{- toYaml . | nindent 4 }}
-  {{- end }}
-  labels:
-    app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
-    helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
-    app.kubernetes.io/managed-by: {{ .Release.Service }}
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/component: filer
-    {{- with .Values.filer.httpRoute.labels }}
-    {{- toYaml . | nindent 4 }}
-    {{- end }}
-spec:
-  {{- with .Values.filer.httpRoute.parentRefs }}
-  parentRefs:
-    {{- toYaml . | nindent 4 }}
-  {{- end }}
-  {{- with .Values.filer.httpRoute.hostnames }}
-  hostnames:
-    {{- toYaml . | nindent 4 }}
-  {{- end }}
-  rules:
-    {{- range .Values.filer.httpRoute.rules | default (list dict) }}
-    - backendRefs:
-        {{- with .backendRefs }}
-        {{- toYaml . | nindent 8 }}
-        {{- else }}
-        - group: ""
-          kind: Service
-          name: {{ $serviceName }}
-          namespace: {{ $.Release.Namespace }}
-          port: {{ $.Values.filer.port }}
-          weight: 1
-        {{- end }}
-      {{- with .matches }}
-      matches:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      {{- with .filters }}
-      filters:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      {{- with .timeouts }}
-      timeouts:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-    {{- end }}
-{{- end }}

k8s/charts/seaweedfs/templates/filer/filer-statefulset.yaml

@@ -48,7 +48,7 @@ spec:
       {{- $configSecret := (lookup "v1" "Secret" .Release.Namespace .Values.filer.s3.existingConfigSecret) | default dict }}
       {{- $_ := set $podAnnotations "checksum/s3config" ($configSecret | toYaml | sha256sum) }}
       {{- else }}
-      {{- $_ := set $podAnnotations "checksum/s3config" (include "seaweedfs.s3.configChecksum" .) }}
+      {{- $_ := set $podAnnotations "checksum/s3config" (include (print .Template.BasePath "/s3/s3-secret.yaml") . | sha256sum) }}
       {{- end }}
       annotations:
         {{- toYaml $podAnnotations | nindent 8 }}
@@ -229,7 +229,6 @@ spec:
               {{ . }} \
               {{- end }}
           volumeMounts:
-            {{- include "seaweedfs.tmpDirVolumeMount" (list . .Values.filer.containerSecurityContext (tpl (.Values.filer.extraVolumeMounts | default "") .) (tpl (.Values.filer.extraVolumes | default "") .)) | nindent 12 }}
             {{- if (or (eq .Values.filer.logs.type "hostPath") (eq .Values.filer.logs.type "persistentVolumeClaim") (eq .Values.filer.logs.type "emptyDir")) }}
             - name: seaweedfs-filer-log-volume
               mountPath: "/logs/"
@@ -338,7 +337,6 @@ spec:
         {{- include "seaweedfs.tplvalues.render" (dict "value" .Values.filer.sidecars "context" $) | nindent 8 }}
         {{- end }}
       volumes:
-        {{- include "seaweedfs.tmpDirVolume" (list . .Values.filer.containerSecurityContext (tpl (.Values.filer.extraVolumeMounts | default "") .) (tpl (.Values.filer.extraVolumes | default "") .) false) | nindent 8 }}
         {{- if eq .Values.filer.logs.type "hostPath" }}
         - name: seaweedfs-filer-log-volume
           hostPath:

k8s/charts/seaweedfs/templates/master/master-httproute.yaml

@@ -1,57 +0,0 @@
-{{- $masterEnabled := or .Values.master.enabled .Values.allInOne.enabled }}
-{{- if and $masterEnabled .Values.master.httpRoute.enabled }}
-{{- $serviceName := ternary (include "seaweedfs.componentName" (list . "all-in-one")) (include "seaweedfs.componentName" (list . "master")) .Values.allInOne.enabled }}
-apiVersion: gateway.networking.k8s.io/v1
-kind: HTTPRoute
-metadata:
-  name: {{ include "seaweedfs.componentName" (list . "master") }}
-  namespace: {{ .Release.Namespace }}
-  {{- with .Values.master.httpRoute.annotations }}
-  annotations:
-    {{- toYaml . | nindent 4 }}
-  {{- end }}
-  labels:
-    app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
-    helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
-    app.kubernetes.io/managed-by: {{ .Release.Service }}
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/component: master
-    {{- with .Values.master.httpRoute.labels }}
-    {{- toYaml . | nindent 4 }}
-    {{- end }}
-spec:
-  {{- with .Values.master.httpRoute.parentRefs }}
-  parentRefs:
-    {{- toYaml . | nindent 4 }}
-  {{- end }}
-  {{- with .Values.master.httpRoute.hostnames }}
-  hostnames:
-    {{- toYaml . | nindent 4 }}
-  {{- end }}
-  rules:
-    {{- range .Values.master.httpRoute.rules | default (list dict) }}
-    - backendRefs:
-        {{- with .backendRefs }}
-        {{- toYaml . | nindent 8 }}
-        {{- else }}
-        - group: ""
-          kind: Service
-          name: {{ $serviceName }}
-          namespace: {{ $.Release.Namespace }}
-          port: {{ $.Values.master.port }}
-          weight: 1
-        {{- end }}
-      {{- with .matches }}
-      matches:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      {{- with .filters }}
-      filters:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      {{- with .timeouts }}
-      timeouts:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-    {{- end }}
-{{- end }}

k8s/charts/seaweedfs/templates/master/master-statefulset.yaml

@@ -179,7 +179,6 @@ spec:
               {{ . }} \
               {{- end }}
           volumeMounts:
-            {{- include "seaweedfs.tmpDirVolumeMount" (list . .Values.master.containerSecurityContext (tpl (.Values.master.extraVolumeMounts | default "") .) (tpl (.Values.master.extraVolumes | default "") .)) | nindent 12 }}
             - name : data-{{ .Release.Namespace }}
               mountPath: /data
             {{- if or (eq .Values.master.logs.type "hostPath") (eq .Values.master.logs.type "persistentVolumeClaim") (eq .Values.master.logs.type "emptyDir") }}
@@ -259,7 +258,6 @@ spec:
         {{- include "seaweedfs.tplvalues.render" (dict "value" .Values.master.sidecars "context" $) | nindent 8 }}
         {{- end }}
       volumes:
-        {{- include "seaweedfs.tmpDirVolume" (list . .Values.master.containerSecurityContext (tpl (.Values.master.extraVolumeMounts | default "") .) (tpl (.Values.master.extraVolumes | default "") .) false) | nindent 8 }}
         {{- include "seaweedfs.licenseVolume" . | nindent 8 }}
         {{- if eq .Values.master.logs.type "hostPath" }}
         - name: seaweedfs-master-log-volume

k8s/charts/seaweedfs/templates/s3/s3-deployment.yaml

@@ -17,10 +17,6 @@ metadata:
 {{- end }}
 spec:
   replicas: {{ .Values.s3.replicas }}
-  {{- with .Values.s3.updateStrategy }}
-  strategy:
-    {{- toYaml . | nindent 4 }}
-  {{- end }}
   selector:
     matchLabels:
       app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
@@ -44,7 +40,7 @@ spec:
       {{- $configSecret := (lookup "v1" "Secret" .Release.Namespace .Values.s3.existingConfigSecret) | default dict }}
       {{- $_ := set $podAnnotations "checksum/s3config" ($configSecret | toYaml | sha256sum) }}
       {{- else }}
-      {{- $_ := set $podAnnotations "checksum/s3config" (include "seaweedfs.s3.configChecksum" .) }}
+      {{- $_ := set $podAnnotations "checksum/s3config" (include (print .Template.BasePath "/s3/s3-secret.yaml") . | sha256sum) }}
       {{- end }}
       annotations:
         {{- toYaml $podAnnotations | nindent 8 }}
@@ -63,7 +59,7 @@ spec:
         {{ tpl .Values.s3.tolerations . | nindent 8 | trim }}
       {{- end }}
       {{- include "seaweedfs.imagePullSecrets" . | nindent 6 }}
-      terminationGracePeriodSeconds: {{ .Values.s3.terminationGracePeriodSeconds }}
+      terminationGracePeriodSeconds: 10
       {{- if .Values.s3.priorityClassName }}
       priorityClassName: {{ .Values.s3.priorityClassName | quote }}
       {{- end }}
@@ -161,7 +157,6 @@ spec:
               {{ . }} \
               {{- end }}
           volumeMounts:
-            {{- include "seaweedfs.tmpDirVolumeMount" (list . .Values.s3.containerSecurityContext (tpl (.Values.s3.extraVolumeMounts | default "") .) (tpl (.Values.s3.extraVolumes | default "") .)) | nindent 12 }}
             {{- if or (eq .Values.s3.logs.type "hostPath") (eq .Values.s3.logs.type "emptyDir") }}
             - name: logs
               mountPath: "/logs/"
@@ -239,10 +234,6 @@ spec:
             failureThreshold: {{ .Values.s3.livenessProbe.failureThreshold }}
             timeoutSeconds: {{ .Values.s3.livenessProbe.timeoutSeconds }}
           {{- end }}
-          {{- with .Values.s3.lifecycle }}
-          lifecycle:
-            {{- toYaml . | nindent 12 }}
-          {{- end }}
           {{- with .Values.s3.resources }}
           resources:
             {{- toYaml . | nindent 12 }}
@@ -254,7 +245,6 @@ spec:
       {{- include "seaweedfs.tplvalues.render" (dict "value" .Values.s3.sidecars "context" $) | nindent 8 }}
       {{- end }}
       volumes:
-        {{- include "seaweedfs.tmpDirVolume" (list . .Values.s3.containerSecurityContext (tpl (.Values.s3.extraVolumeMounts | default "") .) (tpl (.Values.s3.extraVolumes | default "") .) false) | nindent 8 }}
         {{- if .Values.s3.enableAuth }}
         - name: config-users
           secret:

k8s/charts/seaweedfs/templates/s3/s3-httproute.yaml

@@ -1,64 +0,0 @@
-{{- $s3Enabled := or .Values.s3.enabled (and .Values.filer.s3.enabled (not .Values.allInOne.enabled)) (and .Values.allInOne.enabled .Values.allInOne.s3.enabled) }}
-{{- if and $s3Enabled .Values.s3.httpRoute.enabled }}
-{{- $serviceName := include "seaweedfs.componentName" (list . "s3") }}
-{{- $s3Port := .Values.filer.s3.port }}
-{{- if and .Values.allInOne.enabled .Values.allInOne.s3.enabled }}
-{{- $serviceName = include "seaweedfs.componentName" (list . "all-in-one") }}
-{{- $s3Port = .Values.allInOne.s3.port | default .Values.s3.port }}
-{{- else if .Values.s3.enabled }}
-{{- $s3Port = .Values.s3.port }}
-{{- end }}
-apiVersion: gateway.networking.k8s.io/v1
-kind: HTTPRoute
-metadata:
-  name: {{ include "seaweedfs.componentName" (list . "s3") }}
-  namespace: {{ .Release.Namespace }}
-  {{- with .Values.s3.httpRoute.annotations }}
-  annotations:
-    {{- toYaml . | nindent 4 }}
-  {{- end }}
-  labels:
-    app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
-    helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
-    app.kubernetes.io/managed-by: {{ .Release.Service }}
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/component: s3
-    {{- with .Values.s3.httpRoute.labels }}
-    {{- toYaml . | nindent 4 }}
-    {{- end }}
-spec:
-  {{- with .Values.s3.httpRoute.parentRefs }}
-  parentRefs:
-    {{- toYaml . | nindent 4 }}
-  {{- end }}
-  {{- with .Values.s3.httpRoute.hostnames }}
-  hostnames:
-    {{- toYaml . | nindent 4 }}
-  {{- end }}
-  rules:
-    {{- range .Values.s3.httpRoute.rules | default (list dict) }}
-    - backendRefs:
-        {{- with .backendRefs }}
-        {{- toYaml . | nindent 8 }}
-        {{- else }}
-        - group: ""
-          kind: Service
-          name: {{ $serviceName }}
-          namespace: {{ $.Release.Namespace }}
-          port: {{ $s3Port }}
-          weight: 1
-        {{- end }}
-      {{- with .matches }}
-      matches:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      {{- with .filters }}
-      filters:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      {{- with .timeouts }}
-      timeouts:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-    {{- end }}
-{{- end }}

k8s/charts/seaweedfs/templates/sftp/sftp-deployment.yaml

@@ -170,7 +170,6 @@ spec:
               -userStoreFile=/etc/sw/seaweedfs_sftp_config \
               -filer={{ include "seaweedfs.componentName" (list . "filer-client") }}.{{ .Release.Namespace }}:{{ .Values.filer.port }}
           volumeMounts:
-            {{- include "seaweedfs.tmpDirVolumeMount" (list . .Values.sftp.containerSecurityContext (tpl (.Values.sftp.extraVolumeMounts | default "") .) (tpl (.Values.sftp.extraVolumes | default "") .)) | nindent 12 }}
             {{- if or (eq .Values.sftp.logs.type "hostPath") (eq .Values.sftp.logs.type "emptyDir") }}
             - name: logs
               mountPath: "/logs/"
@@ -250,7 +249,6 @@ spec:
       {{- include "seaweedfs.tplvalues.render" (dict "value" .Values.sftp.sidecars "context" $) | nindent 8 }}
       {{- end }}
       volumes:
-        {{- include "seaweedfs.tmpDirVolume" (list . .Values.sftp.containerSecurityContext (tpl (.Values.sftp.extraVolumeMounts | default "") .) (tpl (.Values.sftp.extraVolumes | default "") .) false) | nindent 8 }}
         {{- if .Values.sftp.enableAuth }}
         - name: config-users
           secret:

k8s/charts/seaweedfs/templates/shared/_helpers.tpl

@@ -76,43 +76,6 @@ Inject extra environment vars in the format key:value, if populated
 {{- end }}
 {{- end -}}
 
-{{/*
-Writable temporary directory for containers using a read-only root filesystem.
-Input: list of the root context, the component container security context, the
-rendered extraVolumeMounts and extraVolumes, and whether the pod has secondary
-chart-managed containers that mount seaweedfs-tmp. A user-supplied /tmp mount
-only covers the main container, so the volume is still emitted for secondaries;
-a user-supplied seaweedfs-tmp volume is reused rather than duplicated.
-*/}}
-{{- define "seaweedfs.tmpDirCovered" -}}
-{{- regexMatch `(?m)^\s*-?\s*mountPath:\s*['"]?/tmp/?['"]?\s*(#.*)?$` (index . 2) -}}
-{{- end -}}
-
-{{- define "seaweedfs.tmpDirVolume" -}}
-{{- $root := index . 0 -}}
-{{- $securityContext := index . 1 -}}
-{{- if and $securityContext.enabled $securityContext.readOnlyRootFilesystem
-  (or (index . 4) (ne (include "seaweedfs.tmpDirCovered" .) "true"))
-  (not (regexMatch `(?m)^\s*-?\s*name:\s*['"]?seaweedfs-tmp['"]?\s*(#.*)?$` (index . 3))) }}
-- name: seaweedfs-tmp
-  {{- with $root.Values.global.seaweedfs.tmpDir.sizeLimit }}
-  emptyDir:
-    sizeLimit: {{ . | quote }}
-  {{- else }}
-  emptyDir: {}
-  {{- end }}
-{{- end }}
-{{- end -}}
-
-{{- define "seaweedfs.tmpDirVolumeMount" -}}
-{{- $securityContext := index . 1 -}}
-{{- if and $securityContext.enabled $securityContext.readOnlyRootFilesystem
-  (ne (include "seaweedfs.tmpDirCovered" .) "true") }}
-- name: seaweedfs-tmp
-  mountPath: /tmp
-{{- end }}
-{{- end -}}
-
 {{/* Whether the mysql filer store is selected; a flag the chart cannot read counts as selected. */}}
 {{- define "seaweedfs.filer.mysqlEnabled" -}}
 {{- $merged := dict -}}
@@ -142,13 +105,13 @@ true
 {{- end -}}
 {{- end -}}
 
-{{/* Whether the admin non-loopback bind guard is satisfied: admin.secret
-     (adminPassword or existingSecret), WEED_ADMIN_PASSWORD via
-     extraEnvironmentVars / secretExtraEnvironmentVars, or
-     admin.allowInsecureBind. A secret-backed entry counts as enabled even
-     though the chart cannot read its value. */}}
+{{/* Whether admin authentication is enabled from any supported source:
+     admin.secret (adminPassword or existingSecret), or WEED_ADMIN_PASSWORD
+     supplied via extraEnvironmentVars / secretExtraEnvironmentVars (which
+     weed admin picks up through viper's AutomaticEnv). A secret-backed
+     entry counts as enabled even though the chart cannot read its value. */}}
 {{- define "seaweedfs.admin.authEnabled" -}}
-{{- if or .Values.admin.secret.existingSecret .Values.admin.secret.adminPassword .Values.admin.allowInsecureBind -}}
+{{- if or .Values.admin.secret.existingSecret .Values.admin.secret.adminPassword -}}
 true
 {{- else -}}
 {{- $merged := dict -}}
@@ -444,46 +407,6 @@ true
 {{- end -}}
 {{- end -}}
 
-{{/* Read a JWT key from the chart's existing security.toml without fromToml
-     (which requires Helm >=3.17). Args: (list "<section>" $raw).
-     Return the single-line TOML string token, including its quotes, so escapes
-     and explicitly empty values survive unchanged. No output means absent.
-     Accept bare or simply quoted dotted header segments. Fail on other quoted
-     headers rather than risk rotating a key hidden by unsupported syntax.
-     This reads the chart's section/key layout, not arbitrary TOML syntax. */}}
-{{- define "seaweedfs.existingTomlKey" -}}
-{{- $section := index . 0 -}}
-{{- $raw := index . 1 -}}
-{{- $parts := list -}}
-{{- range $part := splitList "." $section -}}
-  {{- $escaped := regexQuoteMeta $part -}}
-  {{- $parts = append $parts (printf `(?:%s|"%s"|'%s')` $escaped $escaped $escaped) -}}
-{{- end -}}
-{{- $header := printf `^\[[ \t]*%s[ \t]*\][ \t]*(#.*)?$` (join `[ \t]*\.[ \t]*` $parts) -}}
-{{- $segment := `(?:[A-Za-z0-9_-]+|"[^"\\]*"|'[^']*')` -}}
-{{- $simpleHeader := printf `^\[[ \t]*%s(?:[ \t]*\.[ \t]*%s)*[ \t]*\][ \t]*(#.*)?$` $segment $segment -}}
-{{- $assignment := `^(key|"key"|'key')[ \t]*=[ \t]*` -}}
-{{- $string := `"([^"\\]|\\.)*"|'[^']*'` -}}
-{{- $active := false -}}
-{{- $key := "" -}}
-{{- range $rawLine := splitList "\n" $raw -}}
-  {{- $line := trim $rawLine -}}
-  {{- if hasPrefix "[" $line -}}
-    {{- if and (regexMatch `^\[[^]]*["']` $line) (not (regexMatch $simpleHeader $line)) (eq $key "") -}}
-      {{- fail (printf "security.toml has an unsupported quoted section header; refusing to replace [%s].key" $section) -}}
-    {{- end -}}
-    {{- $active = regexMatch $header $line -}}
-  {{- else if and $active (eq $key "") (regexMatch $assignment $line) -}}
-    {{- $value := regexReplaceAll $assignment $line "" -}}
-    {{- if not (regexMatch (printf `^(%s)[ \t]*(#.*)?$` $string) $value) -}}
-      {{- fail (printf "security.toml [%s].key must be a single-line quoted TOML string; refusing to replace an existing key" $section) -}}
-    {{- end -}}
-    {{- $key = regexFind $string $value -}}
-  {{- end -}}
-{{- end -}}
-{{- $key -}}
-{{- end -}}
-
 {{/* True when the post-install bucket hook Job renders: an S3 endpoint, plus
      buckets to create on it. Read by the Job itself and by its NetworkPolicy,
      which has to appear exactly when the Job does - a Job without its policy
@@ -544,9 +467,8 @@ true
 {{-             $pvcName := printf "%s-%s-%s-%d" $dir.name $seaweedfsName $volumeName $e }}
 {{-             $currentPVC := (lookup "v1" "PersistentVolumeClaim" $.Release.Namespace $pvcName) }}
 {{-             if $currentPVC }}
-{{- /* include returns a string such as "6.442450944e+10"; convert back to a number, or gt compares lexically */}}
-{{-               $oldSize := include "seaweedfs.resource-quantity" $currentPVC.spec.resources.requests.storage | float64 }}
-{{-               $newSize := include "seaweedfs.resource-quantity" $desiredSize | float64 }}
+{{-               $oldSize := include "seaweedfs.resource-quantity" $currentPVC.spec.resources.requests.storage }}
+{{-               $newSize := include "seaweedfs.resource-quantity" $desiredSize }}
 {{-               if gt $newSize $oldSize }}
 {{-                 $commands = append $commands (printf "kubectl patch pvc %s-%s-%s-%d -p '{\"spec\":{\"resources\":{\"requests\":{\"storage\":\"%s\"}}}}'" $dir.name $seaweedfsName $volumeName $e $desiredSize) }}
 {{-               end }}
@@ -692,28 +614,3 @@ Usage: {{ include "seaweedfs.service.loadBalancerFields" .Values.s3.service }}
 {{- end }}
 {{- end }}
 {{- end -}}
-
-{{/*
-Checksum that restarts the S3-serving pods when the generated S3 config changes. It hashes the
-values s3-secret.yaml is built from, not the rendered Secret: that template keeps its generated keys
-with lookup, so rendering it again for a checksum draws new random keys whenever lookup finds
-nothing (on install), and the first upgrade then changed the checksum and restarted the pods
-although nothing had changed. Only the values that template reads are hashed, so scaling the S3
-gateway or changing its resources does not restart the filer. Keep this list in step with
-s3-secret.yaml.
-Keys the chart generated are not part of it. Deleting the Secret to rotate them regenerates them on
-the next upgrade without restarting the pods; restart them afterwards (kubectl rollout restart).
-Folding the stored keys in would bring the first-upgrade restart back, since lookup finds nothing
-on install.
-*/}}
-{{- define "seaweedfs.s3.configChecksum" -}}
-{{- dict
-  "secretName" (include "seaweedfs.fullname" .)
-  "enabled" (list .Values.s3.enabled .Values.filer.s3.enabled .Values.allInOne.enabled .Values.allInOne.s3.enabled)
-  "enableAuth" (list .Values.s3.enableAuth .Values.filer.s3.enableAuth .Values.allInOne.s3.enableAuth)
-  "existingConfigSecret" (list .Values.s3.existingConfigSecret .Values.filer.s3.existingConfigSecret .Values.allInOne.s3.existingConfigSecret)
-  "credentials" .Values.s3.credentials
-  "legacySecret" (list .Values.s3.reuseLegacySecret .Values.s3.legacySecretName)
-  "auditLogConfig" (list .Values.s3.auditLogConfig .Values.filer.s3.auditLogConfig)
-  | toJson | sha256sum -}}
-{{- end -}}

k8s/charts/seaweedfs/templates/shared/networkpolicy.yaml

@@ -93,11 +93,7 @@
        ClusterRole under global.seaweedfs.createClusterRole is a leftover from a
        migration and is not exercised by any component. */}}
 {{- if .Values.admin.enabled }}
-{{-   $ports := list .Values.admin.port .Values.admin.grpcPort }}
-{{-   if gt (int .Values.admin.legacyPort) 0 }}
-{{-     $ports = concat $ports (list .Values.admin.legacyPort (add (int .Values.admin.legacyPort) 10000)) }}
-{{-   end }}
-{{-   $targets = append $targets (dict "component" "admin" "ports" $ports) }}
+{{-   $targets = append $targets (dict "component" "admin" "ports" (list .Values.admin.port .Values.admin.grpcPort)) }}
 {{- end }}
 {{- if .Values.worker.enabled }}
 {{-   $ports := list }}

k8s/charts/seaweedfs/templates/shared/post-install-bucket-hook.yaml

@@ -16,20 +16,6 @@
 {{- $clusterUpper := upper $clusterAlias }}
 {{- $clusterMasterKey := printf "WEED_CLUSTER_%s_MASTER" $clusterUpper }}
 {{- $clusterFilerKey := printf "WEED_CLUSTER_%s_FILER" $clusterUpper }}
-{{- $podSecurityContext := .Values.filer.podSecurityContext }}
-{{- $containerSecurityContext := .Values.filer.containerSecurityContext }}
-{{- $nodeSelector := .Values.filer.nodeSelector }}
-{{- $tolerations := .Values.filer.tolerations }}
-{{- $createBucketsHook := .Values.filer.s3.createBucketsHook }}
-{{- if .Values.allInOne.enabled }}
-  {{- $podSecurityContext = .Values.allInOne.podSecurityContext }}
-  {{- $containerSecurityContext = .Values.allInOne.containerSecurityContext }}
-  {{- $nodeSelector = .Values.allInOne.nodeSelector }}
-  {{- $tolerations = .Values.allInOne.tolerations }}
-  {{- $createBucketsHook = .Values.allInOne.s3.createBucketsHook }}
-{{- else if .Values.s3.createBuckets }}
-  {{- $createBucketsHook = .Values.s3.createBucketsHook }}
-{{- end }}
 
 {{- /* Check allInOne mode first */}}
 {{- if .Values.allInOne.enabled }}
@@ -84,17 +70,9 @@ spec:
         app.kubernetes.io/instance: {{ .Release.Name | quote }}
         app.kubernetes.io/component: bucket-hook
     spec:
-      {{- with $createBucketsHook.affinity }}
-      affinity:
-        {{ tpl . $ | indent 8 | trim }}
-      {{- end }}
       restartPolicy: Never
-      {{- if $podSecurityContext.enabled }}
-      securityContext: {{- omit $podSecurityContext "enabled" | toYaml | nindent 8 }}
-      {{- end }}
-      {{- with coalesce $createBucketsHook.tolerations $tolerations }}
-      tolerations:
-        {{ tpl . $ | indent 8 | trim }}
+      {{- if .Values.filer.podSecurityContext.enabled }}
+      securityContext: {{- omit .Values.filer.podSecurityContext "enabled" | toYaml | nindent 8 }}
       {{- end }}
       {{- include "seaweedfs.imagePullSecrets" $ | nindent 6 }}
       containers:
@@ -224,9 +202,8 @@ spec:
                 /usr/bin/weed shell
           {{- end }}  
           {{- end }}
-        {{- if or (and $containerSecurityContext.enabled $containerSecurityContext.readOnlyRootFilesystem) $enableAuth (include "seaweedfs.securityConfigEnabled" .) }}
+        {{- if or $enableAuth (include "seaweedfs.securityConfigEnabled" .) }}
         volumeMounts:
-          {{- include "seaweedfs.tmpDirVolumeMount" (list . $containerSecurityContext "" "") | nindent 10 }}
           {{- if $enableAuth }}
           - name: config-users
             mountPath: /etc/sw
@@ -238,14 +215,6 @@ spec:
             mountPath: /etc/seaweedfs/security.toml
             subPath: security.toml
           {{- end }}
-          {{- if .Values.global.seaweedfs.enableSecurity }}
-          - name: ca-cert
-            readOnly: true
-            mountPath: /usr/local/share/ca-certificates/ca/
-          - name: client-cert
-            readOnly: true
-            mountPath: /usr/local/share/ca-certificates/client/
-          {{- end }}
         {{- end }}
         ports:
           - containerPort: {{ .Values.master.port }}
@@ -260,12 +229,11 @@ spec:
         resources:
           {{- toYaml . | nindent 10 }}
         {{- end }}
-        {{- if $containerSecurityContext.enabled }}
-        securityContext: {{- omit $containerSecurityContext "enabled" | toYaml | nindent 12 }}
+        {{- if .Values.filer.containerSecurityContext.enabled }}
+        securityContext: {{- omit .Values.filer.containerSecurityContext "enabled" | toYaml | nindent 12 }}
         {{- end }}
-    {{- if or (and $containerSecurityContext.enabled $containerSecurityContext.readOnlyRootFilesystem) $enableAuth (include "seaweedfs.securityConfigEnabled" .) }}
+    {{- if or $enableAuth (include "seaweedfs.securityConfigEnabled" .) }}
       volumes:
-        {{- include "seaweedfs.tmpDirVolume" (list . $containerSecurityContext "" "" false) | nindent 8 }}
         {{- if $enableAuth }}
         - name: config-users
           secret:
@@ -281,17 +249,5 @@ spec:
           configMap:
             name: {{ include "seaweedfs.fullname" . }}-security-config
         {{- end }}
-        {{- if .Values.global.seaweedfs.enableSecurity }}
-        - name: ca-cert
-          secret:
-            secretName: {{ include "seaweedfs.fullname" . }}-ca-cert
-        - name: client-cert
-          secret:
-            secretName: {{ include "seaweedfs.fullname" . }}-client-cert
-        {{- end }}
     {{- end }}
-      {{- with coalesce $createBucketsHook.nodeSelector $nodeSelector }}
-      nodeSelector:
-        {{ tpl . $ | indent 8 | trim }}
-      {{- end }}
 {{- end }}

k8s/charts/seaweedfs/templates/shared/security-configmap.yaml

@@ -18,7 +18,7 @@ data:
   {{- $legacyName := printf "%s-%s" (include "seaweedfs.name" .) "security-config" }}
   {{- $existing = lookup "v1" "ConfigMap" .Release.Namespace $legacyName }}
   {{- end }}
-  {{- $existingToml := dig "data" "security.toml" "" $existing }}
+  {{- $securityConfig := fromToml (dig "data" "security.toml" "" $existing) }}
   {{- $securityConfigValues := .Values.global.seaweedfs.securityConfig | default dict }}
   {{- $jwtSigning := $securityConfigValues.jwtSigning | default dict }}
   {{- $expiresAfterSeconds := $jwtSigning.expiresAfterSeconds | default dict }}
@@ -29,7 +29,7 @@ data:
     # the jwt signing key is read by master and volume server
     # the jwt defaults to expire after 10 seconds
     [jwt.signing]
-    key = {{ include "seaweedfs.existingTomlKey" (list "jwt.signing" $existingToml) | default (randAlphaNum 10 | b64enc | quote) }}
+    key = "{{ dig "jwt" "signing" "key" (randAlphaNum 10 | b64enc) $securityConfig }}"
     {{- if gt (int $expiresAfterSeconds.volumeWrite) 0 }}
     expires_after_seconds = {{ int $expiresAfterSeconds.volumeWrite }}
     {{- end }}
@@ -41,7 +41,7 @@ data:
     # - the Volume server validates the JWT on reading
     # the jwt defaults to expire after 60 seconds
     [jwt.signing.read]
-    key = {{ include "seaweedfs.existingTomlKey" (list "jwt.signing.read" $existingToml) | default (randAlphaNum 10 | b64enc | quote) }}
+    key = "{{ dig "jwt" "signing" "read" "key" (randAlphaNum 10 | b64enc) $securityConfig }}"
     {{- if gt (int $expiresAfterSeconds.volumeRead) 0 }}
     expires_after_seconds = {{ int $expiresAfterSeconds.volumeRead }}
     {{- end }}
@@ -53,7 +53,7 @@ data:
     # - the Filer server validates the JWT on writing
     # the jwt defaults to expire after 10 seconds
     [jwt.filer_signing]
-    key = {{ include "seaweedfs.existingTomlKey" (list "jwt.filer_signing" $existingToml) | default (randAlphaNum 10 | b64enc | quote) }}
+    key = "{{ dig "jwt" "filer_signing" "key" (randAlphaNum 10 | b64enc) $securityConfig }}"
     {{- if gt (int $expiresAfterSeconds.filerWrite) 0 }}
     expires_after_seconds = {{ int $expiresAfterSeconds.filerWrite }}
     {{- end }}
@@ -65,7 +65,7 @@ data:
     # - the Filer server validates the JWT on reading
     # the jwt defaults to expire after 60 seconds
     [jwt.filer_signing.read]
-    key = {{ include "seaweedfs.existingTomlKey" (list "jwt.filer_signing.read" $existingToml) | default (randAlphaNum 10 | b64enc | quote) }}
+    key = "{{ dig "jwt" "filer_signing" "read" "key" (randAlphaNum 10 | b64enc) $securityConfig }}"
     {{- if gt (int $expiresAfterSeconds.filerRead) 0 }}
     expires_after_seconds = {{ int $expiresAfterSeconds.filerRead }}
     {{- end }}

k8s/charts/seaweedfs/templates/volume/volume-httproute.yaml

@@ -1,57 +0,0 @@
-{{- $volumeEnabled := or .Values.volume.enabled .Values.allInOne.enabled }}
-{{- if and $volumeEnabled .Values.volume.httpRoute.enabled }}
-{{- $serviceName := ternary (include "seaweedfs.componentName" (list . "all-in-one")) (include "seaweedfs.componentName" (list . "volume")) .Values.allInOne.enabled }}
-apiVersion: gateway.networking.k8s.io/v1
-kind: HTTPRoute
-metadata:
-  name: {{ include "seaweedfs.componentName" (list . "volume") }}
-  namespace: {{ .Release.Namespace }}
-  {{- with .Values.volume.httpRoute.annotations }}
-  annotations:
-    {{- toYaml . | nindent 4 }}
-  {{- end }}
-  labels:
-    app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
-    helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
-    app.kubernetes.io/managed-by: {{ .Release.Service }}
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/component: volume
-    {{- with .Values.volume.httpRoute.labels }}
-    {{- toYaml . | nindent 4 }}
-    {{- end }}
-spec:
-  {{- with .Values.volume.httpRoute.parentRefs }}
-  parentRefs:
-    {{- toYaml . | nindent 4 }}
-  {{- end }}
-  {{- with .Values.volume.httpRoute.hostnames }}
-  hostnames:
-    {{- toYaml . | nindent 4 }}
-  {{- end }}
-  rules:
-    {{- range .Values.volume.httpRoute.rules | default (list dict) }}
-    - backendRefs:
-        {{- with .backendRefs }}
-        {{- toYaml . | nindent 8 }}
-        {{- else }}
-        - group: ""
-          kind: Service
-          name: {{ $serviceName }}
-          namespace: {{ $.Release.Namespace }}
-          port: {{ $.Values.volume.port }}
-          weight: 1
-        {{- end }}
-      {{- with .matches }}
-      matches:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      {{- with .filters }}
-      filters:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      {{- with .timeouts }}
-      timeouts:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-    {{- end }}
-{{- end }}

k8s/charts/seaweedfs/templates/volume/volume-resize-hook.yaml

@@ -30,46 +30,15 @@ spec:
         app.kubernetes.io/instance: {{ .Release.Name | quote }}
         app.kubernetes.io/component: volume-resize-hook
     spec:
-      {{- with .Values.volume.resizeHook.affinity }}
-      affinity:
-        {{ tpl (printf "{{ $volumeName := \"volume\" }}%s" .) $ | indent 8 | trim }}
-      {{- end }}
       serviceAccountName: {{ $seaweedfsName }}-volume-resize-hook
       restartPolicy: Never
-      {{- if .Values.volume.podSecurityContext.enabled }}
-      securityContext: {{- omit .Values.volume.podSecurityContext "enabled" | toYaml | nindent 8 }}
-      {{- end }}
-      {{- with coalesce .Values.volume.resizeHook.tolerations .Values.volume.tolerations }}
-      tolerations:
-        {{ tpl (printf "{{ $volumeName := \"volume\" }}%s" .) $ | indent 8 | trim }}
-      {{- end }}
       containers:
         - name: resize
           image: {{ .Values.volume.resizeHook.image }}
-          {{- if and .Values.volume.containerSecurityContext.enabled .Values.volume.containerSecurityContext.readOnlyRootFilesystem }}
-          env:
-            - name: HOME
-              value: /tmp
-          {{- end }}
           command: ["sh", "-xec"]
           args:
             - |
 {{ $commands | indent 14 }}
-          {{- if and .Values.volume.containerSecurityContext.enabled .Values.volume.containerSecurityContext.readOnlyRootFilesystem }}
-          volumeMounts:
-            {{- include "seaweedfs.tmpDirVolumeMount" (list . .Values.volume.containerSecurityContext "" "") | nindent 12 }}
-          {{- end }}
-          {{- if .Values.volume.containerSecurityContext.enabled }}
-          securityContext: {{- omit .Values.volume.containerSecurityContext "enabled" | toYaml | nindent 12 }}
-          {{- end }}
-      {{- if and .Values.volume.containerSecurityContext.enabled .Values.volume.containerSecurityContext.readOnlyRootFilesystem }}
-      volumes:
-        {{- include "seaweedfs.tmpDirVolume" (list . .Values.volume.containerSecurityContext "" "" false) | nindent 8 }}
-      {{- end }}
-      {{- with coalesce .Values.volume.resizeHook.nodeSelector .Values.volume.nodeSelector }}
-      nodeSelector:
-        {{ tpl (printf "{{ $volumeName := \"volume\" }}%s" .) $ | indent 8 | trim }}
-      {{- end }}
 ---
 apiVersion: v1
 kind: ServiceAccount

k8s/charts/seaweedfs/templates/volume/volume-statefulset.yaml

@@ -104,7 +104,6 @@ spec:
                 fi
               done
           volumeMounts:
-            {{- include "seaweedfs.tmpDirVolumeMount" (list $ $volume.containerSecurityContext "" "") | nindent 12 }}
             - name: idx
               mountPath: /idx
           {{- range $dir :=  $volume.dataDirs }}
@@ -225,7 +224,6 @@ spec:
                 {{ . }} \
                 {{- end }}
           volumeMounts:
-            {{- include "seaweedfs.tmpDirVolumeMount" (list $ $volume.containerSecurityContext (tpl (printf "{{ $volumeName := \"%s\" }}%s" $volumeName ($volume.extraVolumeMounts | default "")) $) (tpl ($volume.extraVolumes | default "") $)) | nindent 12 }}
             {{- range $dir := $volume.dataDirs }}
             {{- if not ( eq $dir.type "custom" ) }}
             - name: {{ $dir.name }}
@@ -308,7 +306,6 @@ spec:
       {{- include "seaweedfs.tplvalues.render" (dict "value" (printf "{{ $volumeName := \"%s\" }}%s" $volumeName $volume.sidecars) "context" $) | nindent 8 }}
       {{- end }}
       volumes:
-        {{- include "seaweedfs.tmpDirVolume" (list $ $volume.containerSecurityContext (tpl (printf "{{ $volumeName := \"%s\" }}%s" $volumeName ($volume.extraVolumeMounts | default "")) $) (tpl ($volume.extraVolumes | default "") $) (and $initContainers_exists $volume.idx)) | nindent 8 }}
 
      {{- range $dir := $volume.dataDirs }}
 

k8s/charts/seaweedfs/templates/worker/worker-deployment.yaml

@@ -144,7 +144,6 @@ spec:
               {{ $arg }}{{- if lt $index (sub (len $.Values.worker.extraArgs) 1) }} \{{ end }}
               {{- end }}
           volumeMounts:
-            {{- include "seaweedfs.tmpDirVolumeMount" (list . .Values.worker.containerSecurityContext (tpl (.Values.worker.extraVolumeMounts | default "") .) (tpl (.Values.worker.extraVolumes | default "") .)) | nindent 12 }}
             {{- if or (eq .Values.worker.data.type "hostPath") (eq .Values.worker.data.type "emptyDir") (eq .Values.worker.data.type "existingClaim") }}
             - name: worker-data
               mountPath: {{ .Values.worker.workingDir }}
@@ -263,16 +262,15 @@ spec:
               --metrics-ip=0.0.0.0 \
               {{- end }}
               --max-concurrency={{ .Values.worker.maxExecute }}
+          {{- if .Values.global.seaweedfs.enableSecurity }}
           volumeMounts:
-            {{- include "seaweedfs.tmpDirVolumeMount" (list . .Values.worker.containerSecurityContext "" "") | nindent 12 }}
-            {{- if .Values.global.seaweedfs.enableSecurity }}
             - name: ca-cert
               readOnly: true
               mountPath: /usr/local/share/ca-certificates/ca/
             - name: worker-cert
               readOnly: true
               mountPath: /usr/local/share/ca-certificates/worker/
-            {{- end }}
+          {{- end }}
           {{- if .Values.worker.lanceMetricsPort }}
           ports:
             - containerPort: {{ .Values.worker.lanceMetricsPort }}
@@ -304,7 +302,6 @@ spec:
       {{- include "seaweedfs.tplvalues.render" (dict "value" .Values.worker.sidecars "context" $) | nindent 8 }}
       {{- end }}
       volumes:
-        {{- include "seaweedfs.tmpDirVolume" (list . .Values.worker.containerSecurityContext (tpl (.Values.worker.extraVolumeMounts | default "") .) (tpl (.Values.worker.extraVolumes | default "") .) (ne (include "seaweedfs.worker.lanceNamespaceUrl" .) "")) | nindent 8 }}
         {{- if eq .Values.worker.data.type "hostPath" }}
         - name: worker-data
           hostPath:

k8s/charts/seaweedfs/values.yaml

@@ -25,9 +25,6 @@ global:
     imagePullPolicy: IfNotPresent
     restartPolicy: Always
     loggingLevel: 1
-    # Writable temporary storage used when containers run with a read-only root filesystem.
-    tmpDir:
-      sizeLimit: ""
     enableSecurity: false
     masterServer: null
     # filerWrite: true mounts security.toml on filer + admin without needing
@@ -263,8 +260,6 @@ master:
   #   runAsUser: 1000
   #   runAsGroup: 3000
   #   fsGroup: 2000
-  #   seccompProfile:
-  #     type: RuntimeDefault
   podSecurityContext: {}
 
   # Configure security context for Container
@@ -273,16 +268,7 @@ master:
   # containerSecurityContext:
   #   enabled: true
   #   runAsUser: 2000
-  #   runAsGroup: 3000
-  #   runAsNonRoot: true
-  #   privileged: false
   #   allowPrivilegeEscalation: false
-  #   readOnlyRootFilesystem: true
-  #   capabilities:
-  #     drop:
-  #       - ALL
-  #   seccompProfile:
-  #     type: RuntimeDefault
   containerSecurityContext: {}
 
   ingress:
@@ -311,24 +297,6 @@ master:
       #   sub_filter_once off;
     tls: []
 
-  # Gateway API HTTPRoute, an alternative to the ingress above.
-  httpRoute:
-    enabled: false
-    labels: {}
-    annotations: {}
-    # Gateways this route attaches to, for example:
-    #   - group: gateway.networking.k8s.io
-    #     kind: Gateway
-    #     name: my-gateway
-    #     namespace: gateway-system
-    #     sectionName: https
-    parentRefs: []
-    hostnames: []
-    # Each rule may set matches, filters, timeouts and backendRefs.
-    # A rule without backendRefs routes to the master service.
-    # An empty list routes all traffic there.
-    rules: []
-
   extraEnvironmentVars:
     WEED_MASTER_VOLUME_GROWTH_COPY_1: "7"
     WEED_MASTER_VOLUME_GROWTH_COPY_2: "6"
@@ -437,10 +405,6 @@ volume:
   resizeHook:
     enabled: true
     image: alpine/k8s:1.28.4
-    # nodeSelector and tolerations fall back to the volume server's when unset
-    nodeSelector: ""
-    tolerations: ""
-    affinity: ""
 
   # idx (the volume index) may use a separate PERSISTENT volume:
   #
@@ -596,8 +560,6 @@ volume:
   #   runAsUser: 1000
   #   runAsGroup: 3000
   #   fsGroup: 2000
-  #   seccompProfile:
-  #     type: RuntimeDefault
   podSecurityContext: {}
 
   # Configure security context for Container
@@ -606,16 +568,7 @@ volume:
   # containerSecurityContext:
   #   enabled: true
   #   runAsUser: 2000
-  #   runAsGroup: 3000
-  #   runAsNonRoot: true
-  #   privileged: false
   #   allowPrivilegeEscalation: false
-  #   readOnlyRootFilesystem: true
-  #   capabilities:
-  #     drop:
-  #       - ALL
-  #   seccompProfile:
-  #     type: RuntimeDefault
   containerSecurityContext: {}
 
   # used to configure livenessProbe on volume-server containers
@@ -669,24 +622,6 @@ volume:
       #   sub_filter '/seaweedfsstatic' './seaweedfsstatic';
       #   sub_filter_once off;
 
-  # Gateway API HTTPRoute, an alternative to the ingress above.
-  httpRoute:
-    enabled: false
-    labels: {}
-    annotations: {}
-    # Gateways this route attaches to, for example:
-    #   - group: gateway.networking.k8s.io
-    #     kind: Gateway
-    #     name: my-gateway
-    #     namespace: gateway-system
-    #     sectionName: https
-    parentRefs: []
-    hostnames: []
-    # Each rule may set matches, filters, timeouts and backendRefs.
-    # A rule without backendRefs routes to the volume server service.
-    # An empty list routes all traffic there.
-    rules: []
-
 # Map of named volume groups for topology-aware deployments.
 # Each key inherits all fields from the `volume` section but can override
 # them locally—for example, replicas, nodeSelector, dataCenter, etc.
@@ -910,8 +845,6 @@ filer:
   #   runAsUser: 1000
   #   runAsGroup: 3000
   #   fsGroup: 2000
-  #   seccompProfile:
-  #     type: RuntimeDefault
   podSecurityContext: {}
 
   # Configure security context for Container
@@ -920,16 +853,7 @@ filer:
   # containerSecurityContext:
   #   enabled: true
   #   runAsUser: 2000
-  #   runAsGroup: 3000
-  #   runAsNonRoot: true
-  #   privileged: false
   #   allowPrivilegeEscalation: false
-  #   readOnlyRootFilesystem: true
-  #   capabilities:
-  #     drop:
-  #       - ALL
-  #   seccompProfile:
-  #     type: RuntimeDefault
   containerSecurityContext: {}
 
   ingresses:
@@ -979,24 +903,6 @@ filer:
         # requires ingress-nginx to run with --enable-ssl-passthrough.
       tls: []
 
-  # Gateway API HTTPRoute, an alternative to the ingress above.
-  httpRoute:
-    enabled: false
-    labels: {}
-    annotations: {}
-    # Gateways this route attaches to, for example:
-    #   - group: gateway.networking.k8s.io
-    #     kind: Gateway
-    #     name: my-gateway
-    #     namespace: gateway-system
-    #     sectionName: https
-    parentRefs: []
-    hostnames: []
-    # Each rule may set matches, filters, timeouts and backendRefs.
-    # A rule without backendRefs routes to the filer service.
-    # An empty list routes all traffic there.
-    rules: []
-
   # extraEnvVars is a list of extra environment variables to set with the stateful set.
   extraEnvironmentVars:
     # the WEED_MYSQL_* keys and the db credential secret only render while this is "true"
@@ -1087,27 +993,12 @@ filer:
     #     anonymousRead: false
     createBucketsHook:
       resources: {}
-      # nodeSelector and tolerations fall back to filer's when unset
-      nodeSelector: ""
-      tolerations: ""
-      affinity: ""
 
 s3:
   enabled: false
   imageOverride: null
   restartPolicy: null
   replicas: 1
-  # Deployment update strategy, rendered as the Deployment's strategy
-  # ref: https://kubernetes.io/docs/concepts/workloads/controllers/deployment/#strategy
-  # Example:
-  # updateStrategy:
-  #   type: RollingUpdate
-  #   rollingUpdate:
-  #     maxUnavailable: 0
-  #     maxSurge: 25%
-  updateStrategy: {}
-  # Time the s3 pod is given to shut down, including any preStop hook
-  terminationGracePeriodSeconds: 10
   bindAddress: 0.0.0.0
   port: 8333
   # add additional https port
@@ -1236,8 +1127,6 @@ s3:
   #   runAsUser: 1000
   #   runAsGroup: 3000
   #   fsGroup: 2000
-  #   seccompProfile:
-  #     type: RuntimeDefault
   podSecurityContext: {}
 
   # Configure security context for Container
@@ -1246,16 +1135,7 @@ s3:
   # containerSecurityContext:
   #   enabled: true
   #   runAsUser: 2000
-  #   runAsGroup: 3000
-  #   runAsNonRoot: true
-  #   privileged: false
   #   allowPrivilegeEscalation: false
-  #   readOnlyRootFilesystem: true
-  #   capabilities:
-  #     drop:
-  #       - ALL
-  #   seccompProfile:
-  #     type: RuntimeDefault
   containerSecurityContext: {}
 
   # You can also use emptyDir storage:
@@ -1300,23 +1180,8 @@ s3:
     failureThreshold: 100
     timeoutSeconds: 10
 
-  # Lifecycle hooks for the s3 container. A preStop sleep lets the pod leave
-  # the Service endpoints before it receives SIGTERM; keep it shorter than
-  # terminationGracePeriodSeconds.
-  # ref: https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/
-  # Example:
-  # lifecycle:
-  #   preStop:
-  #     exec:
-  #       command: ["sleep", "5"]
-  lifecycle: {}
-
   createBucketsHook:
     resources: {}
-    # nodeSelector and tolerations fall back to filer's when unset
-    nodeSelector: ""
-    tolerations: ""
-    affinity: ""
 
   ingress:
     enabled: false
@@ -1330,24 +1195,6 @@ s3:
     annotations: {}
     tls: []
 
-  # Gateway API HTTPRoute, an alternative to the ingress above.
-  httpRoute:
-    enabled: false
-    labels: {}
-    annotations: {}
-    # Gateways this route attaches to, for example:
-    #   - group: gateway.networking.k8s.io
-    #     kind: Gateway
-    #     name: my-gateway
-    #     namespace: gateway-system
-    #     sectionName: https
-    parentRefs: []
-    hostnames: []
-    # Each rule may set matches, filters, timeouts and backendRefs.
-    # A rule without backendRefs routes to the s3 service.
-    # An empty list routes all traffic there.
-    rules: []
-
   # Service settings
   service:
     type: ClusterIP
@@ -1440,33 +1287,7 @@ sftp:
   priorityClassName: ""
   schedulerName: ""
   serviceAccountName: ""
-  # Configure security context for Pod
-  # ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/
-  # Example:
-  # podSecurityContext:
-  #   enabled: true
-  #   runAsUser: 1000
-  #   runAsGroup: 3000
-  #   fsGroup: 2000
-  #   seccompProfile:
-  #     type: RuntimeDefault
   podSecurityContext: {}
-  # Configure security context for Container
-  # ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/
-  # Example:
-  # containerSecurityContext:
-  #   enabled: true
-  #   runAsUser: 2000
-  #   runAsGroup: 3000
-  #   runAsNonRoot: true
-  #   privileged: false
-  #   allowPrivilegeEscalation: false
-  #   readOnlyRootFilesystem: true
-  #   capabilities:
-  #     drop:
-  #       - ALL
-  #   seccompProfile:
-  #     type: RuntimeDefault
   containerSecurityContext: {}
 
   logs:
@@ -1511,24 +1332,17 @@ admin:
   imageOverride: null
   restartPolicy: null
   replicas: 1
-  port: 12535  # Default admin port
-  grpcPort: 22535  # Default gRPC port for worker connections
-  # Legacy compat port: admin also serves HTTP and worker gRPC (legacyPort +
-  # 10000) on this port so workers and clients from before the 23646 -> 12535
-  # default change keep connecting during migration. 0 disables. The flag is
-  # only passed to the binary when the value differs from its 23646 default,
-  # so the chart keeps installing on releases that predate -port.legacy.
-  legacyPort: 23646
+  port: 23646  # Default admin port
+  grpcPort: 33646  # Default gRPC port for worker connections
   # IP address the admin server listens on. Since `weed admin` 4.46 defaults to
   # loopback (127.0.0.1), the chart must bind a non-loopback address for the
   # kubelet's httpGet readiness/liveness probes (which dial the pod IP) to ever
   # succeed. "0.0.0.0" restores the pre-4.46 behaviour of listening on all
   # interfaces. A non-loopback address requires authentication: set
-  # admin.secret.adminPassword or admin.secret.existingSecret, supply
+  # admin.secret.adminPassword or admin.secret.existingSecret, or supply
   # WEED_ADMIN_PASSWORD via admin.extraEnvironmentVars /
-  # admin.secretExtraEnvironmentVars, or opt out with admin.allowInsecureBind;
-  # otherwise the admin container will exit with a clear error rather than
-  # silently staying unready. The whole
+  # admin.secretExtraEnvironmentVars; otherwise the admin container will exit
+  # with a clear error rather than silently staying unready. The whole
   # 127.0.0.0/8 range and ::1 are treated as loopback (matching weed admin).
   # Set to a loopback address only if you also replace the httpGet probes.
   # Note: the -ip flag requires SeaweedFS 4.46 or newer; pinning
@@ -1536,9 +1350,6 @@ admin:
   ip: "0.0.0.0"
   loggingOverrideLevel: null
 
-  # INSECURE: allow binding a non-loopback ip without authentication.
-  allowInsecureBind: false
-
   # Admin authentication
   secret:
     # Name of an existing secret containing admin credentials. If set, adminUser and adminPassword below are ignored.
@@ -1619,33 +1430,7 @@ admin:
   priorityClassName: ""
   schedulerName: ""
   serviceAccountName: ""
-  # Configure security context for Pod
-  # ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/
-  # Example:
-  # podSecurityContext:
-  #   enabled: true
-  #   runAsUser: 1000
-  #   runAsGroup: 3000
-  #   fsGroup: 2000
-  #   seccompProfile:
-  #     type: RuntimeDefault
   podSecurityContext: {}
-  # Configure security context for Container
-  # ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/
-  # Example:
-  # containerSecurityContext:
-  #   enabled: true
-  #   runAsUser: 2000
-  #   runAsGroup: 3000
-  #   runAsNonRoot: true
-  #   privileged: false
-  #   allowPrivilegeEscalation: false
-  #   readOnlyRootFilesystem: true
-  #   capabilities:
-  #     drop:
-  #       - ALL
-  #   seccompProfile:
-  #     type: RuntimeDefault
   containerSecurityContext: {}
 
   extraEnvironmentVars: {}
@@ -1691,24 +1476,6 @@ admin:
     annotations: {}
     tls: []
 
-  # Gateway API HTTPRoute, an alternative to the ingress above.
-  httpRoute:
-    enabled: false
-    labels: {}
-    annotations: {}
-    # Gateways this route attaches to, for example:
-    #   - group: gateway.networking.k8s.io
-    #     kind: Gateway
-    #     name: my-gateway
-    #     namespace: gateway-system
-    #     sectionName: https
-    parentRefs: []
-    hostnames: []
-    # Each rule may set matches, filters, timeouts and backendRefs.
-    # A rule without backendRefs routes to the admin service.
-    # An empty list routes all traffic there.
-    rules: []
-
   service:
     type: ClusterIP
     annotations: {}
@@ -1820,33 +1587,7 @@ worker:
   priorityClassName: ""
   schedulerName: ""
   serviceAccountName: ""
-  # Configure security context for Pod
-  # ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/
-  # Example:
-  # podSecurityContext:
-  #   enabled: true
-  #   runAsUser: 1000
-  #   runAsGroup: 3000
-  #   fsGroup: 2000
-  #   seccompProfile:
-  #     type: RuntimeDefault
   podSecurityContext: {}
-  # Configure security context for Container
-  # ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/
-  # Example:
-  # containerSecurityContext:
-  #   enabled: true
-  #   runAsUser: 2000
-  #   runAsGroup: 3000
-  #   runAsNonRoot: true
-  #   privileged: false
-  #   allowPrivilegeEscalation: false
-  #   readOnlyRootFilesystem: true
-  #   capabilities:
-  #     drop:
-  #       - ALL
-  #   seccompProfile:
-  #     type: RuntimeDefault
   containerSecurityContext: {}
 
   extraEnvironmentVars: {}
@@ -1945,10 +1686,6 @@ allInOne:
     #     anonymousRead: false
     createBucketsHook:
       resources: {}
-      # nodeSelector and tolerations fall back to allInOne's when unset
-      nodeSelector: ""
-      tolerations: ""
-      affinity: ""
 
   # SFTP server configuration
   # Note: Most parameters below default to null, which means they inherit from
@@ -2110,8 +1847,6 @@ allInOne:
   #   runAsUser: 1000
   #   runAsGroup: 3000
   #   fsGroup: 2000
-  #   seccompProfile:
-  #     type: RuntimeDefault
   podSecurityContext: {}
 
   # Configure security context for Container
@@ -2120,16 +1855,7 @@ allInOne:
   # containerSecurityContext:
   #   enabled: true
   #   runAsUser: 2000
-  #   runAsGroup: 3000
-  #   runAsNonRoot: true
-  #   privileged: false
   #   allowPrivilegeEscalation: false
-  #   readOnlyRootFilesystem: true
-  #   capabilities:
-  #     drop:
-  #       - ALL
-  #   seccompProfile:
-  #     type: RuntimeDefault
   containerSecurityContext: {}
 
   # Resource management
@@ -2168,33 +1894,7 @@ cosi:
   # should have a secret key called seaweedfs_s3_config with an inline json configure
   existingConfigSecret: null
 
-  # Configure security context for Pod
-  # ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/
-  # Example:
-  # podSecurityContext:
-  #   enabled: true
-  #   runAsUser: 1000
-  #   runAsGroup: 3000
-  #   fsGroup: 2000
-  #   seccompProfile:
-  #     type: RuntimeDefault
   podSecurityContext: {}
-  # Configure security context for Container
-  # ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/
-  # Example:
-  # containerSecurityContext:
-  #   enabled: true
-  #   runAsUser: 2000
-  #   runAsGroup: 3000
-  #   runAsNonRoot: true
-  #   privileged: false
-  #   allowPrivilegeEscalation: false
-  #   readOnlyRootFilesystem: true
-  #   capabilities:
-  #     drop:
-  #       - ALL
-  #   seccompProfile:
-  #     type: RuntimeDefault
   containerSecurityContext: {}
 
   # used to assign a custom scheduler to cosi pods

other/java/client/src/main/proto/filer.proto

@@ -527,10 +527,6 @@ message AtomicRenameEntryRequest {
     string new_directory = 3;
     string new_name = 4;
     repeated int32 signatures = 5;
-    // When true, the rename fails with ErrEntryAlreadyExists if the target
-    // already exists. Lets a caller that authorized the rename without delete
-    // access on an absent target stay safe if one is created concurrently.
-    bool fail_if_target_exists = 6;
 }
 
 message AtomicRenameEntryResponse {

seaweed-common/Cargo.lock

@@ -1,293 +0,0 @@
-# This file is automatically @generated by Cargo.
-# It is not intended for manual editing.
-version = 4
-
-[[package]]
-name = "aws-lc-rs"
-version = "1.18.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ce2b2dcc879c3bae0d371e77c99f2238400ef24ec001394befa67b6e543add9e"
-dependencies = [
- "aws-lc-sys",
- "zeroize",
-]
-
-[[package]]
-name = "aws-lc-sys"
-version = "0.44.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f09fae7be8bb3174e05c6afdb34199e6dc0c7c04ba9fa237b1967adfbde27483"
-dependencies = [
- "cc",
- "cmake",
- "dunce",
- "fs_extra",
- "pkg-config",
-]
-
-[[package]]
-name = "cc"
-version = "1.4.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "509591b7bcd67f4ef775afad7662703b4935daaa6ec0e5605cfb1090b32a2b6d"
-dependencies = [
- "find-msvc-tools",
- "jobserver",
- "libc",
- "shlex",
-]
-
-[[package]]
-name = "cfg-if"
-version = "1.0.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9330f8b2ff13f34540b44e946ef35111825727b38d33286ef986142615121801"
-
-[[package]]
-name = "cmake"
-version = "0.1.58"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c0f78a02292a74a88ac736019ab962ece0bc380e3f977bf72e376c5d78ff0678"
-dependencies = [
- "cc",
-]
-
-[[package]]
-name = "dunce"
-version = "1.0.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "92773504d58c093f6de2459af4af33faa518c13451eb8f2b5698ed3d36e7c813"
-
-[[package]]
-name = "find-msvc-tools"
-version = "0.1.11"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d45db016d36b838f563236e9193d0ee6ce38f3f68b6c94e914b4929c96bbb890"
-
-[[package]]
-name = "fs_extra"
-version = "1.3.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "42703706b716c37f96a77aea830392ad231f44c9e9a67872fa5548707e11b11c"
-
-[[package]]
-name = "getrandom"
-version = "0.2.17"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ff2abc00be7fca6ebc474524697ae276ad847ad0a6b3faa4bcb027e9a4614ad0"
-dependencies = [
- "cfg-if",
- "libc",
- "wasi",
-]
-
-[[package]]
-name = "getrandom"
-version = "0.4.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "300e883d756b2e4ec94e02791f39b04b522276138852cfc41d9fb7e904106099"
-dependencies = [
- "cfg-if",
- "libc",
- "r-efi",
-]
-
-[[package]]
-name = "jobserver"
-version = "0.1.35"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1c00acbd29eabad4a2392fa0e921c874934dbbf4194312ad20f04a0ed67a3cb3"
-dependencies = [
- "getrandom 0.4.3",
- "libc",
-]
-
-[[package]]
-name = "libc"
-version = "0.2.189"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3eaf3ede3fee6db1a4c2ee091bf8a8b4dccdc6d17f656fb07896ee72867612f2"
-
-[[package]]
-name = "log"
-version = "0.4.33"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0ceec5bc11778974d1bcb055b18002eba7f4b3518b6a0081b3af5f21666da9ad"
-
-[[package]]
-name = "once_cell"
-version = "1.21.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9f7c3e4beb33f85d45ae3e3a1792185706c8e16d043238c593331cc7cd313b50"
-
-[[package]]
-name = "pkg-config"
-version = "0.3.34"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f6b464fbc74e149a392436b17d523f769e057cb6877f6a5c4618bc6f11800548"
-
-[[package]]
-name = "r-efi"
-version = "6.0.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f8dcc9c7d52a811697d2151c701e0d08956f92b0e24136cf4cf27b57a6a0d9bf"
-
-[[package]]
-name = "ring"
-version = "0.17.14"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a4689e6c2294d81e88dc6261c768b63bc4fcdb852be6d1352498b114f61383b7"
-dependencies = [
- "cc",
- "cfg-if",
- "getrandom 0.2.17",
- "libc",
- "untrusted",
- "windows-sys",
-]
-
-[[package]]
-name = "rustls"
-version = "0.23.45"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0d41d731c7d2f962d1ccc364cec258de3c0e93b38c2fb3ba97ac74513048d634"
-dependencies = [
- "aws-lc-rs",
- "log",
- "once_cell",
- "rustls-pki-types",
- "rustls-webpki",
- "subtle",
- "zeroize",
-]
-
-[[package]]
-name = "rustls-pki-types"
-version = "1.15.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2f4925028c7eb5d1fcdaf196971378ed9d2c1c4efc7dc5d011256f76c99c0a96"
-dependencies = [
- "zeroize",
-]
-
-[[package]]
-name = "rustls-webpki"
-version = "0.103.14"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0527518605e68109d875e248ea259b6758801cf165e4b2c2733ae3b51f12535a"
-dependencies = [
- "aws-lc-rs",
- "ring",
- "rustls-pki-types",
- "untrusted",
-]
-
-[[package]]
-name = "seaweed-common"
-version = "0.1.0"
-dependencies = [
- "rustls",
-]
-
-[[package]]
-name = "shlex"
-version = "2.0.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f8fadd59c855ef2080decdef8ff161eb6661b86933c9d82e5ba29dc602a55aba"
-
-[[package]]
-name = "subtle"
-version = "2.6.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "13c2bddecc57b384dee18652358fb23172facb8a2c51ccc10d74c157bdea3292"
-
-[[package]]
-name = "untrusted"
-version = "0.9.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8ecb6da28b8a351d773b68d5825ac39017e680750f980f3a1a85cd8dd28a47c1"
-
-[[package]]
-name = "wasi"
-version = "0.11.1+wasi-snapshot-preview1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ccf3ec651a847eb01de73ccad15eb7d99f80485de043efb2f370cd654f4ea44b"
-
-[[package]]
-name = "windows-sys"
-version = "0.52.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "282be5f36a8ce781fad8c8ae18fa3f9beff57ec1b52cb3de0789201425d9a33d"
-dependencies = [
- "windows-targets",
-]
-
-[[package]]
-name = "windows-targets"
-version = "0.52.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9b724f72796e036ab90c1021d4780d4d3d648aca59e491e6b98e725b84e99973"
-dependencies = [
- "windows_aarch64_gnullvm",
- "windows_aarch64_msvc",
- "windows_i686_gnu",
- "windows_i686_gnullvm",
- "windows_i686_msvc",
- "windows_x86_64_gnu",
- "windows_x86_64_gnullvm",
- "windows_x86_64_msvc",
-]
-
-[[package]]
-name = "windows_aarch64_gnullvm"
-version = "0.52.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "32a4622180e7a0ec044bb555404c800bc9fd9ec262ec147edd5989ccd0c02cd3"
-
-[[package]]
-name = "windows_aarch64_msvc"
-version = "0.52.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "09ec2a7bb152e2252b53fa7803150007879548bc709c039df7627cabbd05d469"
-
-[[package]]
-name = "windows_i686_gnu"
-version = "0.52.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8e9b5ad5ab802e97eb8e295ac6720e509ee4c243f69d781394014ebfe8bbfa0b"
-
-[[package]]
-name = "windows_i686_gnullvm"
-version = "0.52.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0eee52d38c090b3caa76c563b86c3a4bd71ef1a819287c19d586d7334ae8ed66"
-
-[[package]]
-name = "windows_i686_msvc"
-version = "0.52.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "240948bc05c5e7c6dabba28bf89d89ffce3e303022809e73deaefe4f6ec56c66"
-
-[[package]]
-name = "windows_x86_64_gnu"
-version = "0.52.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "147a5c80aabfbf0c7d901cb5895d1de30ef2907eb21fbbab29ca94c5b08b1a78"
-
-[[package]]
-name = "windows_x86_64_gnullvm"
-version = "0.52.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "24d5b23dc417412679681396f2b49f3de8c1473deb516bd34410872eff51ed0d"
-
-[[package]]
-name = "windows_x86_64_msvc"
-version = "0.52.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "589f6da84c646204747d1270a2a5661ea66ed1cced2631d546fdfb155959f9ec"
-
-[[package]]
-name = "zeroize"
-version = "1.9.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e13c156562582aa81c60cb29407084cdb54c4164760106ab78e6c5b0858cf64e"

seaweed-common/Cargo.toml

@@ -1,27 +0,0 @@
-[package]
-name = "seaweed-common"
-version = "0.1.0"
-edition = "2024"
-# The lower of the two consumers' floors (seaweed-volume 1.91.1,
-# seaweed-worker 1.94.1), so depending on this crate cannot raise either
-# tree's MSRV. Verified with `cargo +1.91.1 check --all-targets`.
-rust-version = "1.91.1"
-description = "Helpers shared by the SeaweedFS Rust volume server and the Rust plugin workers"
-
-# There is no root manifest: seaweed-volume and seaweed-worker are separate
-# cargo trees with their own lockfiles, and this crate is a path dependency of
-# both rather than a member of either. Keeping the lint policy identical in all
-# three manifests is what stops them drifting.
-[lints.clippy]
-# Protobuf message literals keep `..Default::default()` on purpose: it is
-# what lets a proto gain a field without touching every constructor.
-needless_update = "allow"
-
-[dependencies]
-# The same requirement both consumers already write. Cargo unifies all
-# semver-compatible `rustls = "0.23"` requirements into one crate per binary,
-# which is what makes `install_default_crypto_provider` write the same
-# process-wide static the consuming crate reads. rustls is already in both
-# trees (the volume server directly, seaweed-worker-core through tonic's
-# `tls-aws-lc`), so this adds no crate to either graph.
-rustls = "0.23"

seaweed-common/src/address.rs

@@ -1,307 +0,0 @@
-//! SeaweedFS server addresses, the way the Go tree does them.
-//!
-//! An operator gives a SeaweedFS process an HTTP address and the gRPC port is
-//! derived from it rather than asked for separately: `host:port` means gRPC on
-//! `port + 10000`, and the explicit `host:port.grpcPort` form names it outright.
-//! Dialling the HTTP port by mistake fails as "frame with invalid size", which
-//! reads like a protocol bug rather than a wrong port, so the rule is worth its
-//! own module. Mirrors `pb.ServerToGrpcAddress` in
-//! `weed/pb/grpc_client_server.go`.
-//!
-//! The volume server and the workers each had their own copy of this and the
-//! copies had drifted: the worker's bracketed IPv6 literals and the volume
-//! server's did not, so `::1:19333` produced `::1:29333`, which the HTTP
-//! authority parser rejects. One implementation, two thin wrappers.
-
-use std::fmt;
-use std::num::ParseIntError;
-
-/// SeaweedFS's HTTP↔gRPC port-offset convention.
-pub const GRPC_PORT_OFFSET: u16 = 10000;
-
-/// Why an address could not be turned into a gRPC address.
-///
-/// The `Display` text is the volume server's original wording, because its
-/// `parse_grpc_address` wrapper hands it straight to callers that put it in a
-/// `Status` or an `io::Error`.
-#[derive(Debug, Clone, PartialEq, Eq)]
-#[non_exhaustive]
-pub enum AddressError {
-    /// No `:` at all, so there is no port to translate.
-    MissingPort(String),
-    /// The HTTP port of the `host:port.grpcPort` form is not a `u16`. It is
-    /// validated even though it is then discarded, so that a malformed address
-    /// is rejected here instead of failing later as an opaque connect error.
-    InvalidHttpPort { port: String, source: ParseIntError },
-    /// The gRPC port of the `host:port.grpcPort` form is not a `u16`.
-    InvalidGrpcPort { port: String, source: ParseIntError },
-    /// The port of the `host:port` form is not a `u16`.
-    InvalidPort { port: String, source: ParseIntError },
-    /// `port + GRPC_PORT_OFFSET` leaves the TCP port range, e.g. `host:60000`.
-    /// Without the check the cast would wrap silently.
-    ImplicitGrpcPortOutOfRange(u16),
-}
-
-impl fmt::Display for AddressError {
-    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
-        match self {
-            Self::MissingPort(address) => write!(f, "cannot parse address: {address}"),
-            Self::InvalidHttpPort { port, source } => {
-                write!(f, "invalid http port {port:?}: {source}")
-            }
-            Self::InvalidGrpcPort { port, source } => {
-                write!(f, "invalid grpc port {port:?}: {source}")
-            }
-            Self::InvalidPort { port, source } => write!(f, "invalid port {port:?}: {source}"),
-            Self::ImplicitGrpcPortOutOfRange(port) => write!(
-                f,
-                "implicit grpc port out of range: {port} + {GRPC_PORT_OFFSET} = {}",
-                u32::from(*port) + u32::from(GRPC_PORT_OFFSET)
-            ),
-        }
-    }
-}
-
-impl std::error::Error for AddressError {
-    fn source(&self) -> Option<&(dyn std::error::Error + 'static)> {
-        match self {
-            Self::InvalidHttpPort { source, .. }
-            | Self::InvalidGrpcPort { source, .. }
-            | Self::InvalidPort { source, .. } => Some(source),
-            Self::MissingPort(_) | Self::ImplicitGrpcPortOutOfRange(_) => None,
-        }
-    }
-}
-
-/// Turn a SeaweedFS server address (`"host:port.grpcPort"` or `"host:port"`)
-/// into the `host:grpcPort` form the endpoint builders expect.
-///
-/// With the trailing `.grpcPort` segment that segment *is* the gRPC port;
-/// without it the gRPC port is `port + GRPC_PORT_OFFSET`. An unbracketed IPv6
-/// literal comes back bracketed, because otherwise the port reads as part of
-/// the address.
-pub fn to_grpc_address(server: &str) -> Result<String, AddressError> {
-    // rfind, not find: an IPv6 literal is full of colons and the port is after
-    // the last one.
-    let colon_idx = server
-        .rfind(':')
-        .ok_or_else(|| AddressError::MissingPort(server.to_string()))?;
-    let host = &server[..colon_idx];
-    let port_part = &server[colon_idx + 1..];
-
-    // rfind again rather than split_once: the host may be an IPv4 address, and
-    // only the part after the last colon is being split here anyway.
-    if let Some(dot_idx) = port_part.rfind('.') {
-        let http_port = &port_part[..dot_idx];
-        let grpc_port = &port_part[dot_idx + 1..];
-        http_port
-            .parse::<u16>()
-            .map_err(|source| AddressError::InvalidHttpPort {
-                port: http_port.to_string(),
-                source,
-            })?;
-        let grpc_port =
-            grpc_port
-                .parse::<u16>()
-                .map_err(|source| AddressError::InvalidGrpcPort {
-                    port: grpc_port.to_string(),
-                    source,
-                })?;
-        return Ok(join_host_port(host, grpc_port));
-    }
-
-    let port: u16 = port_part
-        .parse()
-        .map_err(|source| AddressError::InvalidPort {
-            port: port_part.to_string(),
-            source,
-        })?;
-    let grpc_port = port
-        .checked_add(GRPC_PORT_OFFSET)
-        .ok_or(AddressError::ImplicitGrpcPortOutOfRange(port))?;
-    Ok(join_host_port(host, grpc_port))
-}
-
-/// Join a host and a port, bracketing an IPv6 literal that is not bracketed
-/// already. Public because the address rule is not the only place that has to
-/// put a host and a port back together.
-pub fn join_host_port(host: &str, port: u16) -> String {
-    // An IPv6 literal has to keep its brackets or the port reads as part of it.
-    if host.contains(':') && !host.starts_with('[') {
-        format!("[{host}]:{port}")
-    } else {
-        format!("{host}:{port}")
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use super::{AddressError, GRPC_PORT_OFFSET, join_host_port, to_grpc_address};
-
-    // ---- the volume server's cases -------------------------------------
-
-    #[test]
-    fn dotted_form_states_the_grpc_port() {
-        assert_eq!(
-            to_grpc_address("127.0.0.1:8080.18080").unwrap(),
-            "127.0.0.1:18080"
-        );
-        assert_eq!(
-            to_grpc_address("192.168.1.66:8080.18080").unwrap(),
-            "192.168.1.66:18080"
-        );
-    }
-
-    #[test]
-    fn implicit_form_adds_the_offset() {
-        assert_eq!(
-            to_grpc_address("127.0.0.1:8080").unwrap(),
-            "127.0.0.1:18080"
-        );
-        assert_eq!(
-            to_grpc_address("192.168.1.66:8080").unwrap(),
-            "192.168.1.66:18080"
-        );
-        assert_eq!(
-            to_grpc_address("localhost:9333").unwrap(),
-            "localhost:19333"
-        );
-    }
-
-    #[test]
-    fn the_dotted_grpc_port_comes_back_normalised() {
-        // The volume server's copy validated this segment as a u16 and then
-        // emitted the original text, so a padded or signed port produced an
-        // authority the URI parser rejects. The parsed value is emitted now.
-        assert_eq!(to_grpc_address("host:8080.018080").unwrap(), "host:18080");
-        assert_eq!(to_grpc_address("host:8080.+18080").unwrap(), "host:18080");
-    }
-
-    #[test]
-    fn an_ipv4_host_is_not_confused_with_the_dotted_port() {
-        // Regression: a naive split on '.' breaks on IP addresses.
-        assert_eq!(
-            to_grpc_address("10.0.0.1:8080.18080").unwrap(),
-            "10.0.0.1:18080"
-        );
-        assert_eq!(to_grpc_address("10.0.0.1:8080").unwrap(), "10.0.0.1:18080");
-    }
-
-    #[test]
-    fn rejects_a_non_numeric_http_port_in_the_dotted_form() {
-        let err = to_grpc_address("host:abc.18080").unwrap_err();
-        assert!(
-            matches!(err, AddressError::InvalidHttpPort { .. }),
-            "{err:?}"
-        );
-        assert!(err.to_string().contains("invalid http port"), "{err}");
-    }
-
-    #[test]
-    fn rejects_a_non_numeric_grpc_port_in_the_dotted_form() {
-        let err = to_grpc_address("host:8080.xyz").unwrap_err();
-        assert!(
-            matches!(err, AddressError::InvalidGrpcPort { .. }),
-            "{err:?}"
-        );
-        assert!(err.to_string().contains("invalid grpc port"), "{err}");
-    }
-
-    #[test]
-    fn rejects_an_implicit_port_that_leaves_the_tcp_range() {
-        let err = to_grpc_address("127.0.0.1:60000").unwrap_err();
-        assert!(
-            matches!(err, AddressError::ImplicitGrpcPortOutOfRange(60000)),
-            "{err:?}"
-        );
-        assert!(err.to_string().contains("out of range"), "{err}");
-    }
-
-    #[test]
-    fn the_messages_are_the_volume_servers_wording_verbatim() {
-        // parse_grpc_address hands these straight to callers that put them in a
-        // Status or an io::Error, so the whole string is the contract, not just
-        // the substring the older tests match on. Only the two variants whose
-        // text is entirely ours are pinned exactly; the other three end in a
-        // std ParseIntError message, which is std's to reword.
-        assert_eq!(
-            to_grpc_address("127.0.0.1:60000").unwrap_err().to_string(),
-            "implicit grpc port out of range: 60000 + 10000 = 70000"
-        );
-        assert_eq!(
-            to_grpc_address("hostname").unwrap_err().to_string(),
-            "cannot parse address: hostname"
-        );
-    }
-
-    #[test]
-    fn rejects_an_address_without_a_port() {
-        for source in ["hostname", "no-colon", "localhost"] {
-            let err = to_grpc_address(source).unwrap_err();
-            assert!(matches!(err, AddressError::MissingPort(_)), "{err:?}");
-            assert!(err.to_string().contains("cannot parse"), "{err}");
-        }
-    }
-
-    // ---- the worker's cases --------------------------------------------
-
-    #[test]
-    fn derives_the_grpc_port() {
-        assert_eq!(
-            to_grpc_address("localhost:23646").unwrap(),
-            "localhost:33646"
-        );
-        assert_eq!(
-            to_grpc_address("127.0.0.1:9333").unwrap(),
-            "127.0.0.1:19333"
-        );
-    }
-
-    #[test]
-    fn honours_an_explicit_grpc_port() {
-        assert_eq!(
-            to_grpc_address("localhost:23646.33999").unwrap(),
-            "localhost:33999"
-        );
-    }
-
-    #[test]
-    fn rejects_what_it_cannot_parse() {
-        let err = to_grpc_address("localhost:notaport").unwrap_err();
-        assert!(matches!(err, AddressError::InvalidPort { .. }), "{err:?}");
-        assert!(err.to_string().contains("invalid port"), "{err}");
-    }
-
-    // ---- IPv6, which only the worker's copy handled --------------------
-
-    #[test]
-    fn brackets_ipv6_literals() {
-        assert_eq!(to_grpc_address("::1:23646").unwrap(), "[::1]:33646");
-        assert_eq!(to_grpc_address("::1:9333").unwrap(), "[::1]:19333");
-        assert_eq!(
-            to_grpc_address("fe80::1:9333.19333").unwrap(),
-            "[fe80::1]:19333"
-        );
-    }
-
-    #[test]
-    fn leaves_an_already_bracketed_literal_alone() {
-        assert_eq!(to_grpc_address("[::1]:9333").unwrap(), "[::1]:19333");
-        assert_eq!(to_grpc_address("[::1]:9333.19333").unwrap(), "[::1]:19333");
-    }
-
-    #[test]
-    fn join_host_port_brackets_only_unbracketed_literals() {
-        assert_eq!(join_host_port("127.0.0.1", 19333), "127.0.0.1:19333");
-        assert_eq!(join_host_port("localhost", 19333), "localhost:19333");
-        assert_eq!(join_host_port("::1", 19333), "[::1]:19333");
-        assert_eq!(join_host_port("[::1]", 19333), "[::1]:19333");
-    }
-
-    // ---- the offset itself ---------------------------------------------
-
-    #[test]
-    fn the_offset_is_the_seaweedfs_convention() {
-        assert_eq!(GRPC_PORT_OFFSET, 10000);
-    }
-}

seaweed-common/src/lib.rs

@@ -1,11 +0,0 @@
-//! Helpers the SeaweedFS Rust volume server and the Rust plugin workers both need.
-//!
-//! `seaweed-volume` and `seaweed-worker` are separate cargo trees with separate
-//! lockfiles and no root manifest, so anything both of them need was, until this
-//! crate existed, written twice. The two things in here are the ones where a
-//! second copy is a correctness risk rather than a typing cost: the HTTP↔gRPC
-//! address rule, which two copies had already drifted on, and the process-wide
-//! rustls provider, which only works if every binary installs the same one.
-
-pub mod address;
-pub mod tls;

seaweed-common/src/tls.rs

@@ -1,28 +0,0 @@
-//! The process-wide rustls crypto provider.
-//!
-//! Both binaries link aws-lc-rs and ring transitively — in the volume server
-//! through the AWS SDK and reqwest, in the lance worker through lance's `aws`
-//! backend and reqwest — so rustls cannot auto-select a provider and tonic's
-//! client TLS panics on first use. Each binary has to pin one, and it has to be
-//! the same one, which is why the choice lives here rather than in either tree.
-
-use rustls::crypto::aws_lc_rs;
-
-/// Pin rustls's process-wide default provider to aws-lc-rs, matching the
-/// volume server's TLS config. Idempotent: the first call wins and every
-/// later one is a no-op, so callers do not have to coordinate.
-pub fn install_default_crypto_provider() {
-    let _ = aws_lc_rs::default_provider().install_default();
-}
-
-#[cfg(test)]
-mod tests {
-    use super::install_default_crypto_provider;
-
-    #[test]
-    fn installing_is_idempotent_and_leaves_a_default_behind() {
-        install_default_crypto_provider();
-        install_default_crypto_provider();
-        assert!(rustls::crypto::CryptoProvider::get_default().is_some());
-    }
-}

seaweed-volume/Cargo.lock

@@ -234,9 +234,9 @@ dependencies = [
 
 [[package]]
 name = "aws-lc-rs"
-version = "1.18.1"
+version = "1.16.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b281d307588d634de920874890732659e2e7672f72b5e10e81badc1a8a83621e"
+checksum = "a054912289d18629dc78375ba2c3726a3afe3ff71b4edba9dedfca0e3446d1fc"
 dependencies = [
  "aws-lc-sys",
  "zeroize",
@@ -244,15 +244,14 @@ dependencies = [
 
 [[package]]
 name = "aws-lc-sys"
-version = "0.45.0"
+version = "0.39.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9bff6c3b54fad79a2e60b8102caf565819711497c1f5f092f49508e2f5c31b27"
+checksum = "83a25cf98105baa966497416dbd42565ce3a8cf8dbfd59803ec9ad46f3126399"
 dependencies = [
  "cc",
  "cmake",
  "dunce",
  "fs_extra",
- "pkg-config",
 ]
 
 [[package]]
@@ -2678,12 +2677,6 @@ dependencies = [
  "spki 0.7.3",
 ]
 
-[[package]]
-name = "pkg-config"
-version = "0.3.34"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f6b464fbc74e149a392436b17d523f769e057cb6877f6a5c4618bc6f11800548"
-
 [[package]]
 name = "png"
 version = "0.18.1"
@@ -3396,9 +3389,9 @@ dependencies = [
 
 [[package]]
 name = "rustls"
-version = "0.23.45"
+version = "0.23.37"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0d41d731c7d2f962d1ccc364cec258de3c0e93b38c2fb3ba97ac74513048d634"
+checksum = "758025cb5fccfd3bc2fd74708fd4682be41d99e5dff73c377c0646c6012c73a4"
 dependencies = [
  "aws-lc-rs",
  "log",
@@ -3443,9 +3436,9 @@ dependencies = [
 
 [[package]]
 name = "rustls-webpki"
-version = "0.103.15"
+version = "0.103.13"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f3c3cf1d8b1e7d4927e2d154c3fcb02979afb9939629c62cd9048d4f07b60ac2"
+checksum = "61c429a8649f110dddef65e2a5ad240f747e85f7758a6bccc7e5777bd33f756e"
 dependencies = [
  "aws-lc-rs",
  "ring",
@@ -3494,13 +3487,6 @@ version = "1.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "94143f37725109f92c262ed2cf5e59bce7498c01bcc1502d7b9afe439a4e9f49"
 
-[[package]]
-name = "seaweed-common"
-version = "0.1.0"
-dependencies = [
- "rustls",
-]
-
 [[package]]
 name = "sec1"
 version = "0.3.0"
@@ -4562,7 +4548,6 @@ dependencies = [
  "aws-config",
  "aws-credential-types",
  "aws-sdk-s3",
- "aws-smithy-runtime-api",
  "aws-types",
  "axum",
  "base64",
@@ -4599,7 +4584,6 @@ dependencies = [
  "rustls",
  "rustls-pemfile",
  "rusty-leveldb",
- "seaweed-common",
  "serde",
  "serde_json",
  "serde_urlencoded",

seaweed-volume/Cargo.toml

@@ -27,15 +27,8 @@ redb-experimental-cursor = ["redb/experimental_cursor"]
 # Protobuf message literals keep `..Default::default()` on purpose: it is
 # what lets a proto gain a field without touching every constructor.
 needless_update = "allow"
-# Every `unsafe` block states its precondition, right above the block.
-undocumented_unsafe_blocks = "warn"
 
 [dependencies]
-# Helpers the Rust plugin workers (seaweed-worker) need as well. A path
-# dependency because the two trees are separate cargo workspaces with no
-# common root manifest.
-seaweed-common = { path = "../seaweed-common" }
-
 # Async runtime
 tokio = { version = "1", features = ["full"] }
 tokio-stream = { version = "0.1", features = ["net"] }
@@ -157,9 +150,6 @@ windows-sys = { version = "0.61", features = ["Win32_Storage_FileSystem"] }
 
 [dev-dependencies]
 tempfile = "3"
-# Already a transitive dependency of aws-sdk-s3 at a single locked version;
-# needed directly only for the canned HttpClient in remote_storage::s3 tests.
-aws-smithy-runtime-api = "1"
 
 [build-dependencies]
 tonic-prost-build = "0.14"

seaweed-volume/README.md

@@ -64,14 +64,10 @@ seaweed-volume --port 8080 --master localhost:9333 --dir /data/vol1 --max 7 \
 | `--whiteList` | | Comma-separated IPs with write permission |
 | `--preStopSeconds` | `10` | Graceful drain period before shutdown |
 | `--compactionMBps` | `0` (unlimited) | Compaction I/O rate limit |
-| `--compactionMaxParallelCommits` | `0` (unlimited) | Max concurrent vacuum commits |
 | `--pprof` | `false` | Enable pprof HTTP handlers |
 
 Set `RUST_LOG=debug` (or `trace`, `info`, `warn`) for log level control.
-
-Durable (`fsync=true`) uploads always go through per-volume batching workers
-that share one `.dat`/`.idx` sync per batch, matching the Go volume server;
-non-fsync writes take the synchronous path.
+Set `SEAWEED_WRITE_QUEUE=1` to enable batched async write processing.
 
 ## Features
 

seaweed-volume/proto/master.proto

@@ -119,12 +119,6 @@ message Heartbeat {
   // place of `volumes`. A master that does not understand this never sets
   // volume_digest_supported, so it keeps being sent the whole list.
   repeated VolumeInformationMessage changed_volumes = 28;
-
-  // Highest volume id this server has ever observed, persisted locally. Fed
-  // by HeartbeatResponse.max_volume_id echoes and by AllocateVolume requests.
-  uint32 max_volume_id_seen = 29;
-  // Topology id of the master cluster this server last heartbeated to.
-  string last_seen_topology_id = 30;
 }
 
 message HeartbeatResponse {
@@ -141,12 +135,6 @@ message HeartbeatResponse {
   // The master compares volume digests, so a server that reports one may send
   // changed_volumes in place of its whole list.
   bool volume_digest_supported = 9;
-  // The leader's current allocation bound; servers persist it and report it
-  // back as max_volume_id_seen so the bound survives master state loss.
-  uint32 max_volume_id = 10;
-  // The leader's cluster identity; a different value reported back later
-  // means the master's state was rebuilt.
-  string topology_id = 11;
 }
 
 message VolumeInformationMessage {
@@ -225,9 +213,6 @@ message KeepConnectedRequest {
   string filer_group = 5;
   string data_center = 6;
   string rack = 7;
-  // A draining filer leaves the lock ring but stays a cluster member, so peers
-  // keep following its metadata until the stream closes.
-  bool leave_lock_ring = 8;
 }
 
 message VolumeLocation {
@@ -317,11 +302,6 @@ message VolumeGrowRequest {
   string data_node = 7;
   uint32 memory_map_max_size_mb = 8;
   string disk_type = 9;
-  // If > 0, grow only when the average fill ratio of the layout's writable
-  // volumes has reached this threshold (e.g. 0.6). Lets callers pre-grow on
-  // fill level with one call, instead of listing volumes to compute the
-  // ratio themselves. Ignored when there are no writable volumes.
-  float grow_avg_fill_threshold = 10;
 }
 
 message AssignResponse {
@@ -628,9 +608,4 @@ message RaftLeadershipTransferResponse {
 }
 
 message VolumeGrowResponse {
-  // Average fill ratio of the layout's writable volumes at request time
-  // (0 when there are none). Reported whether or not growth was triggered.
-  float avg_fill = 1;
-  // Number of writable volumes at request time.
-  uint32 writable_count = 2;
 }

seaweed-volume/proto/volume_server.proto

@@ -168,7 +168,6 @@ message VacuumVolumeCheckRequest {
 }
 message VacuumVolumeCheckResponse {
     double garbage_ratio = 1;
-    bool disk_space_low = 4; // the volume is read-only solely because its disk is low on space — a cause compaction itself reclaims
 }
 
 message VacuumVolumeCompactRequest {
@@ -260,10 +259,6 @@ message VolumeDeleteRequest {
     // when true, do not remove the cloud-tier object backing the volume.
     // used for moves where another server is taking over the same .vif.
     bool keep_remote_data = 3;
-    // when true, delete only if every needle is deleted: the volume held
-    // data once but nothing is live anymore. Passing either check,
-    // only_empty or this one, is enough to delete.
-    bool only_garbage = 4;
 }
 message VolumeDeleteResponse {
 }
@@ -476,7 +471,6 @@ message VolumeEcShardsDeleteRequest {
     repeated uint32 shard_ids = 3;
     bool full_teardown = 4; // pre-encode cleanup: wipe every EC artifact + generation for this volume, not just shard_ids
     int64 encode_ts_ns = 5; // full_teardown generation fence: delete only a disk whose .vif generation is strictly OLDER than this; preserve same-or-newer, generation 0, and an unreadable .vif. 0 => wipe-all (shell pre-encode / pre-upgrade)
-    uint32 delete_generations_older_than = 6; // post-commit cleanup: delete only staged <base>.*.v<N> artifacts with N strictly below this; 0 disables
 }
 message VolumeEcShardsDeleteResponse {
     bool full_teardown_done = 1; // set by a new server that performed full_teardown; absent from an old server lets the caller detect the silent no-op
@@ -571,7 +565,6 @@ message ReadVolumeFileStatusResponse {
     string disk_type = 9;
     VolumeInfo volume_info = 10;
     uint32 version = 11;
-    uint64 expire_at_sec = 12; // TTL expiry counted from the last write; 0 when the volume never expires
 }
 
 message DiskStatus {

seaweed-volume/src/main.rs

@@ -12,10 +12,7 @@ use seaweed_volume::security::tls::{
 use seaweed_volume::security::{Guard, SigningKey};
 #[cfg(unix)]
 use seaweed_volume::server::debug::build_debug_router;
-use seaweed_volume::server::grpc_client::{
-    GRPC_INITIAL_WINDOW_SIZE, GRPC_KEEPALIVE_INTERVAL, GRPC_KEEPALIVE_TIMEOUT,
-    GRPC_MAX_MESSAGE_SIZE, load_outgoing_grpc_tls,
-};
+use seaweed_volume::server::grpc_client::load_outgoing_grpc_tls;
 use seaweed_volume::server::grpc_server::VolumeGrpcService;
 #[cfg(unix)]
 use seaweed_volume::server::profiling::CpuProfileSession;
@@ -34,10 +31,10 @@ type CpuProfileParam = Option<CpuProfileSession>;
 #[cfg(not(unix))]
 type CpuProfileParam = Option<()>;
 
-// The two settings that only make sense for the inbound server. The rest of
-// this server's HTTP/2 tuning — keepalive, window sizes, message size — is
-// imported from `server::grpc_client` above, which is also what the outgoing
-// clients dial with, so the two directions cannot drift apart.
+const GRPC_MAX_MESSAGE_SIZE: usize = 1 << 30;
+const GRPC_KEEPALIVE_INTERVAL: std::time::Duration = std::time::Duration::from_secs(60);
+const GRPC_KEEPALIVE_TIMEOUT: std::time::Duration = std::time::Duration::from_secs(20);
+const GRPC_INITIAL_WINDOW_SIZE: u32 = 16 * 1024 * 1024;
 const GRPC_MAX_HEADER_LIST_SIZE: u32 = 8 * 1024 * 1024;
 const GRPC_MAX_CONCURRENT_STREAMS: u32 = 1000;
 
@@ -340,20 +337,15 @@ async fn run(
         rack: config.rack.clone(),
         file_size_limit_bytes: config.file_size_limit_bytes,
         maintenance_byte_per_second: config.maintenance_byte_per_second,
-        vacuum_commit_slots: if config.max_parallel_vacuum_commits > 0 {
-            Some(tokio::sync::Semaphore::new(
-                config.max_parallel_vacuum_commits,
-            ))
-        } else {
-            None
-        },
-        vacuum_commits_waiting: std::sync::atomic::AtomicU32::new(0),
         // Go sets isHeartbeating: true unconditionally at startup
         is_heartbeating: std::sync::atomic::AtomicBool::new(true),
         has_master: !config.masters.is_empty(),
         pre_stop_seconds: config.pre_stop_seconds,
         volume_state_notify: tokio::sync::Notify::new(),
         write_queue: std::sync::OnceLock::new(),
+        s3_tier_registry: std::sync::RwLock::new(
+            seaweed_volume::remote_storage::s3_tier::S3TierRegistry::new(),
+        ),
         read_mode: config.read_mode,
         allow_untrusted_remote_endpoints: config.allow_untrusted_remote_endpoints,
         master_url,
@@ -379,9 +371,6 @@ async fn run(
                 .to_string_lossy()
                 .into_owned()
         },
-        ec_decodes_in_flight: std::sync::Mutex::new(std::collections::HashSet::new()),
-        ec_decode_tail: std::sync::Mutex::new(std::collections::HashSet::new()),
-        ec_decode_tail_notify: tokio::sync::Notify::new(),
     });
 
     // Load persisted state from disk if it exists (matches Go's State.Load on startup)
@@ -433,11 +422,12 @@ async fn run(
         }
     }
 
-    // The write queue is always on: durable (fsync) uploads go through it so
-    // a batch shares one .dat/.idx sync, the way Go's per-volume async writer
-    // group-commits. Non-fsync writes stay on the synchronous path.
-    let wq = WriteQueue::new(state.clone(), 128);
-    let _ = state.write_queue.set(wq);
+    // Initialize the batched write queue if enabled
+    if config.enable_write_queue {
+        info!("Batched write queue enabled");
+        let wq = WriteQueue::new(state.clone(), 128);
+        let _ = state.write_queue.set(wq);
+    }
 
     // Set initial metric gauges for concurrent limits and max volumes
     metrics::CONCURRENT_UPLOAD_LIMIT.set(state.concurrent_upload_limit);

seaweed-volume/src/remote_storage/mod.rs

@@ -7,7 +7,9 @@ pub mod endpoint_guard;
 pub mod s3;
 pub mod s3_tier;
 
-pub use endpoint_guard::{guarded_tcp_connect, validate_remote_endpoint, validate_replica_target};
+pub use endpoint_guard::{
+    guarded_tcp_connect, validate_remote_endpoint, validate_replica_target,
+};
 
 use crate::pb::remote_pb::{RemoteConf, RemoteStorageLocation};
 

seaweed-volume/src/remote_storage/s3.rs

@@ -4,7 +4,6 @@
 
 use aws_sdk_s3::Client;
 use aws_sdk_s3::config::{BehaviorVersion, Credentials, Region};
-use aws_sdk_s3::error::{DisplayErrorContext, SdkError};
 use aws_sdk_s3::primitives::ByteStream;
 
 use super::{RemoteEntry, RemoteStorageClient, RemoteStorageError};
@@ -26,23 +25,6 @@ impl S3RemoteStorageClient {
         endpoint: &str,
         force_path_style: bool,
     ) -> Self {
-        let client = Client::from_conf(
-            Self::config_builder(access_key, secret_key, region, endpoint, force_path_style)
-                .build(),
-        );
-
-        S3RemoteStorageClient { client, conf }
-    }
-
-    /// Build the SDK config for the given credentials and endpoint. Split out so
-    /// tests can attach a canned HTTP client before building the [`Client`].
-    fn config_builder(
-        access_key: &str,
-        secret_key: &str,
-        region: &str,
-        endpoint: &str,
-        force_path_style: bool,
-    ) -> aws_sdk_s3::config::Builder {
         let region = if region.is_empty() {
             "us-east-1"
         } else {
@@ -67,7 +49,9 @@ impl S3RemoteStorageClient {
             s3_config = s3_config.endpoint_url(endpoint);
         }
 
-        s3_config
+        let client = Client::from_conf(s3_config.build());
+
+        S3RemoteStorageClient { client, conf }
     }
 }
 
@@ -91,14 +75,13 @@ impl RemoteStorageClient for S3RemoteStorageClient {
             req = req.range(format!("bytes={}-", offset));
         }
 
-        let resp = req.send().await.map_err(|e| match e {
-            // Go compares `aerr.Code()` to NoSuchKey on GET
-            // (s3_storage_client.go:436): a bare 404 maps to "NotFound"
-            // and stays a generic error, as it does here.
-            SdkError::ServiceError(ref se) if se.err().is_no_such_key() => {
+        let resp = req.send().await.map_err(|e| {
+            let msg = format!("{}", e);
+            if msg.contains("NoSuchKey") || msg.contains("404") {
                 RemoteStorageError::ObjectNotFound(format!("{}/{}", loc.bucket, key))
+            } else {
+                RemoteStorageError::Other(format!("s3 get object: {}", e))
             }
-            e => RemoteStorageError::Other(format!("s3 get object: {}", DisplayErrorContext(&e))),
         })?;
 
         let data = resp
@@ -125,9 +108,7 @@ impl RemoteStorageClient for S3RemoteStorageClient {
             .body(ByteStream::from(data.to_vec()))
             .send()
             .await
-            .map_err(|e| {
-                RemoteStorageError::Other(format!("s3 put object: {}", DisplayErrorContext(&e)))
-            })?;
+            .map_err(|e| RemoteStorageError::Other(format!("s3 put object: {}", e)))?;
 
         Ok(RemoteEntry {
             size: data.len() as i64,
@@ -153,18 +134,13 @@ impl RemoteStorageClient for S3RemoteStorageClient {
             .key(key)
             .send()
             .await
-            .map_err(|e| match e {
-                // Go checks only the raw HTTP status on HEAD
-                // (s3_storage_client.go:373): a HEAD response carries no
-                // error body, so a 404 is not-found whatever code the SDK
-                // assigns, and a non-404 is not.
-                SdkError::ServiceError(ref se) if se.raw().status().as_u16() == 404 => {
+            .map_err(|e| {
+                let msg = format!("{}", e);
+                if msg.contains("404") || msg.contains("NotFound") {
                     RemoteStorageError::ObjectNotFound(format!("{}/{}", loc.bucket, key))
+                } else {
+                    RemoteStorageError::Other(format!("s3 head object: {}", e))
                 }
-                e => RemoteStorageError::Other(format!(
-                    "s3 head object: {}",
-                    DisplayErrorContext(&e)
-                )),
             })?;
 
         Ok(RemoteEntry {
@@ -184,17 +160,18 @@ impl RemoteStorageClient for S3RemoteStorageClient {
             .key(key)
             .send()
             .await
-            .map_err(|e| {
-                RemoteStorageError::Other(format!("s3 delete object: {}", DisplayErrorContext(&e)))
-            })?;
+            .map_err(|e| RemoteStorageError::Other(format!("s3 delete object: {}", e)))?;
 
         Ok(())
     }
 
     async fn list_buckets(&self) -> Result<Vec<String>, RemoteStorageError> {
-        let resp = self.client.list_buckets().send().await.map_err(|e| {
-            RemoteStorageError::Other(format!("s3 list buckets: {}", DisplayErrorContext(&e)))
-        })?;
+        let resp = self
+            .client
+            .list_buckets()
+            .send()
+            .await
+            .map_err(|e| RemoteStorageError::Other(format!("s3 list buckets: {}", e)))?;
 
         Ok(resp
             .buckets()
@@ -207,178 +184,3 @@ impl RemoteStorageClient for S3RemoteStorageClient {
         &self.conf
     }
 }
-
-#[cfg(test)]
-pub(crate) mod tests {
-    use super::*;
-    use aws_sdk_s3::config::http::{HttpRequest, HttpResponse};
-    use aws_sdk_s3::config::retry::RetryConfig;
-    use aws_sdk_s3::config::{HttpClient, RuntimeComponents};
-    use aws_sdk_s3::primitives::SdkBody;
-    use aws_smithy_runtime_api::client::http::{
-        HttpConnector, HttpConnectorFuture, HttpConnectorSettings, SharedHttpConnector,
-    };
-    use aws_smithy_runtime_api::http::StatusCode;
-
-    /// An SDK HTTP client that answers every request with one canned response,
-    /// so the error-mapping paths can be exercised without a network or a
-    /// running S3 server.
-    #[derive(Debug, Clone)]
-    pub(crate) struct CannedResponse {
-        pub(crate) status: u16,
-        pub(crate) body: &'static str,
-    }
-
-    impl HttpConnector for CannedResponse {
-        fn call(&self, _request: HttpRequest) -> HttpConnectorFuture {
-            let status = StatusCode::try_from(self.status).expect("valid HTTP status");
-            HttpConnectorFuture::ready(Ok(HttpResponse::new(status, SdkBody::from(self.body))))
-        }
-    }
-
-    impl HttpClient for CannedResponse {
-        fn http_connector(
-            &self,
-            _settings: &HttpConnectorSettings,
-            _components: &RuntimeComponents,
-        ) -> SharedHttpConnector {
-            SharedHttpConnector::new(self.clone())
-        }
-    }
-
-    fn client_with(status: u16, body: &'static str) -> S3RemoteStorageClient {
-        let config = S3RemoteStorageClient::config_builder(
-            "AKIATEST",
-            "secret",
-            "us-east-1",
-            "http://127.0.0.1:1",
-            true,
-        )
-        .http_client(CannedResponse { status, body })
-        .retry_config(RetryConfig::disabled())
-        .build();
-        S3RemoteStorageClient {
-            client: Client::from_conf(config),
-            conf: RemoteConf::default(),
-        }
-    }
-
-    fn location() -> RemoteStorageLocation {
-        RemoteStorageLocation {
-            name: "remote".to_string(),
-            bucket: "bucket".to_string(),
-            path: "/dir/missing".to_string(),
-            ..Default::default()
-        }
-    }
-
-    pub(crate) const NO_SUCH_KEY: &str = r#"<?xml version="1.0" encoding="UTF-8"?>
-<Error><Code>NoSuchKey</Code><Message>The specified key does not exist.</Message><Key>dir/missing</Key></Error>"#;
-
-    const NOT_FOUND_BODY: &str = r#"<?xml version="1.0" encoding="UTF-8"?>
-<Error><Code>NotFound</Code><Message>Not Found</Message></Error>"#;
-
-    const ACCESS_DENIED: &str = r#"<?xml version="1.0" encoding="UTF-8"?>
-<Error><Code>AccessDenied</Code><Message>Access Denied</Message></Error>"#;
-
-    #[tokio::test]
-    async fn get_no_such_key_is_object_not_found() {
-        let err = client_with(404, NO_SUCH_KEY)
-            .read_file(&location(), 0, 0)
-            .await
-            .unwrap_err();
-        assert!(
-            matches!(&err, RemoteStorageError::ObjectNotFound(path) if path == "bucket/dir/missing"),
-            "expected ObjectNotFound, got {err:?}"
-        );
-    }
-
-    #[tokio::test]
-    async fn get_bare_404_is_not_object_not_found() {
-        // Go compares codes, not statuses, on GET: a body-less 404 stays generic.
-        let err = client_with(404, "")
-            .read_file(&location(), 0, 0)
-            .await
-            .unwrap_err();
-        assert!(
-            matches!(err, RemoteStorageError::Other(_)),
-            "expected Other, got {err:?}"
-        );
-    }
-
-    #[tokio::test]
-    async fn head_404_is_object_not_found() {
-        let err = client_with(404, "")
-            .stat_file(&location())
-            .await
-            .unwrap_err();
-        assert!(
-            matches!(&err, RemoteStorageError::ObjectNotFound(path) if path == "bucket/dir/missing"),
-            "expected ObjectNotFound, got {err:?}"
-        );
-    }
-
-    #[tokio::test]
-    async fn head_404_with_foreign_error_body_is_object_not_found() {
-        // The raw status check makes a 404 not-found whatever body it carries.
-        let err = client_with(404, NO_SUCH_KEY)
-            .stat_file(&location())
-            .await
-            .unwrap_err();
-        assert!(
-            matches!(err, RemoteStorageError::ObjectNotFound(_)),
-            "expected ObjectNotFound, got {err:?}"
-        );
-    }
-
-    #[tokio::test]
-    async fn head_not_found_code_on_a_non_404_status_is_not_object_not_found() {
-        // A NotFound body on a non-404 status stays an error, as in Go.
-        let err = client_with(400, NOT_FOUND_BODY)
-            .stat_file(&location())
-            .await
-            .unwrap_err();
-        assert!(
-            matches!(&err, RemoteStorageError::Other(msg) if msg.contains("NotFound")),
-            "expected Other naming the code, got {err:?}"
-        );
-    }
-
-    #[tokio::test]
-    async fn get_access_denied_keeps_service_error_code() {
-        let err = client_with(403, ACCESS_DENIED)
-            .read_file(&location(), 0, 0)
-            .await
-            .unwrap_err();
-        let msg = err.to_string();
-        assert!(
-            matches!(err, RemoteStorageError::Other(_)),
-            "expected Other, got {err:?}"
-        );
-        assert!(
-            msg.contains("AccessDenied"),
-            "message should carry the S3 error code, got: {msg}"
-        );
-        assert!(
-            !msg.ends_with("service error"),
-            "message should not be the bare SdkError Display, got: {msg}"
-        );
-    }
-
-    #[tokio::test]
-    async fn head_access_denied_keeps_service_error_code() {
-        let err = client_with(403, ACCESS_DENIED)
-            .stat_file(&location())
-            .await
-            .unwrap_err();
-        let msg = err.to_string();
-        assert!(
-            matches!(err, RemoteStorageError::Other(_)),
-            "expected Other, got {err:?}"
-        );
-        assert!(
-            msg.contains("AccessDenied"),
-            "message should carry the S3 error code, got: {msg}"
-        );
-    }
-}

seaweed-volume/src/remote_storage/s3_tier.rs

@@ -8,11 +8,7 @@ use std::future::Future;
 use std::sync::{Arc, OnceLock, RwLock};
 
 use aws_sdk_s3::Client;
-use aws_sdk_s3::config::http::HttpResponse;
 use aws_sdk_s3::config::{BehaviorVersion, Credentials, Region};
-use aws_sdk_s3::error::{DisplayErrorContext, SdkError};
-use aws_sdk_s3::operation::get_object::GetObjectError;
-use aws_sdk_s3::operation::head_object::HeadObjectError;
 use aws_sdk_s3::types::{CompletedMultipartUpload, CompletedPart};
 use tokio::io::{AsyncReadExt, AsyncSeekExt, AsyncWriteExt};
 use tokio::sync::Semaphore;
@@ -20,53 +16,6 @@ use tokio::sync::Semaphore;
 /// Concurrency limit for multipart upload/download (matches Go's s3manager).
 const CONCURRENCY: usize = 5;
 
-/// A tier transfer failure. The variant is what callers match on; the
-/// message is the operator-facing text.
-#[derive(Debug, thiserror::Error)]
-pub enum TierError {
-    /// The remote object does not exist.
-    #[error("{0}")]
-    NotFound(String),
-    /// An S3 request or a local file operation failed.
-    #[error("{0}")]
-    Io(String),
-    /// The tier I/O runtime could not be built or dropped the task.
-    #[error("{0}")]
-    RuntimeUnavailable(String),
-    /// The progress callback asked to stop.
-    #[error("{0}")]
-    Aborted(String),
-}
-
-// Not-found rules as in remote_storage/s3.rs: HEAD by the raw 404 status,
-// GET by the NoSuchKey code only.
-fn head_object_error(key: &str, e: SdkError<HeadObjectError, HttpResponse>) -> TierError {
-    let message = format!("failed to head object {}: {}", key, DisplayErrorContext(&e));
-    match e {
-        SdkError::ServiceError(ref se) if se.raw().status().as_u16() == 404 => {
-            TierError::NotFound(message)
-        }
-        _ => TierError::Io(message),
-    }
-}
-
-fn get_object_error(
-    key: &str,
-    range: &str,
-    e: SdkError<GetObjectError, HttpResponse>,
-) -> TierError {
-    let message = format!(
-        "failed to get object {} range {}: {}",
-        key,
-        range,
-        DisplayErrorContext(&e)
-    );
-    match e {
-        SdkError::ServiceError(ref se) if se.err().is_no_such_key() => TierError::NotFound(message),
-        _ => TierError::Io(message),
-    }
-}
-
 /// Configuration for an S3 tier backend.
 #[derive(Debug, Clone)]
 pub struct S3TierConfig {
@@ -140,7 +89,7 @@ impl S3TierBackend {
         &self,
         file_path: &str,
         progress_fn: F,
-    ) -> Result<(String, u64), TierError>
+    ) -> Result<(String, u64), String>
     where
         F: FnMut(i64, f32) -> Result<(), String> + Send + Sync + 'static,
     {
@@ -148,7 +97,7 @@ impl S3TierBackend {
 
         let metadata = tokio::fs::metadata(file_path)
             .await
-            .map_err(|e| TierError::Io(format!("failed to stat file {}: {}", file_path, e)))?;
+            .map_err(|e| format!("failed to stat file {}: {}", file_path, e))?;
         let file_size = metadata.len();
 
         // Calculate part size: start at 64MB, scale up for very large files (matches Go)
@@ -170,16 +119,11 @@ impl S3TierBackend {
             )
             .send()
             .await
-            .map_err(|e| {
-                TierError::Io(format!(
-                    "failed to create multipart upload: {}",
-                    DisplayErrorContext(&e)
-                ))
-            })?;
+            .map_err(|e| format!("failed to create multipart upload: {}", e))?;
 
         let upload_id = create_resp
             .upload_id()
-            .ok_or_else(|| TierError::Io("no upload_id in multipart upload response".to_string()))?
+            .ok_or_else(|| "no upload_id in multipart upload response".to_string())?
             .to_string();
 
         // Build list of (part_number, offset, size) for all parts
@@ -215,21 +159,19 @@ impl S3TierBackend {
                 let _permit = sem
                     .acquire()
                     .await
-                    .map_err(|e| TierError::Io(format!("semaphore error: {}", e)))?;
+                    .map_err(|e| format!("semaphore error: {}", e))?;
 
                 // Read this part's data from the file at the correct offset
                 let mut file = tokio::fs::File::open(&fp)
                     .await
-                    .map_err(|e| TierError::Io(format!("failed to open file {}: {}", fp, e)))?;
+                    .map_err(|e| format!("failed to open file {}: {}", fp, e))?;
                 file.seek(std::io::SeekFrom::Start(off))
                     .await
-                    .map_err(|e| {
-                        TierError::Io(format!("failed to seek to offset {}: {}", off, e))
-                    })?;
+                    .map_err(|e| format!("failed to seek to offset {}: {}", off, e))?;
                 let mut buf = vec![0u8; size];
-                file.read_exact(&mut buf).await.map_err(|e| {
-                    TierError::Io(format!("failed to read file at offset {}: {}", off, e))
-                })?;
+                file.read_exact(&mut buf)
+                    .await
+                    .map_err(|e| format!("failed to read file at offset {}: {}", off, e))?;
 
                 let upload_part_resp = client
                     .upload_part()
@@ -241,12 +183,7 @@ impl S3TierBackend {
                     .send()
                     .await
                     .map_err(|e| {
-                        TierError::Io(format!(
-                            "failed to upload part {} at offset {}: {}",
-                            pn,
-                            off,
-                            DisplayErrorContext(&e)
-                        ))
+                        format!("failed to upload part {} at offset {}: {}", pn, off, e)
                     })?;
 
                 let e_tag = upload_part_resp.e_tag().unwrap_or_default().to_string();
@@ -265,9 +202,9 @@ impl S3TierBackend {
                     };
                     (guard.1)(uploaded as i64, pct)
                 };
-                progress_result.map_err(TierError::Aborted)?;
+                progress_result?;
 
-                Ok::<_, TierError>(
+                Ok::<_, String>(
                     CompletedPart::builder()
                         .e_tag(e_tag)
                         .part_number(pn)
@@ -282,7 +219,7 @@ impl S3TierBackend {
             for handle in handles {
                 let part = handle
                     .await
-                    .map_err(|e| TierError::Io(format!("upload task panicked: {}", e)))??;
+                    .map_err(|e| format!("upload task panicked: {}", e))??;
                 completed_parts.push(part);
             }
 
@@ -299,14 +236,9 @@ impl S3TierBackend {
                 .multipart_upload(completed_upload)
                 .send()
                 .await
-                .map_err(|e| {
-                    TierError::Io(format!(
-                        "failed to complete multipart upload: {}",
-                        DisplayErrorContext(&e)
-                    ))
-                })?;
+                .map_err(|e| format!("failed to complete multipart upload: {}", e))?;
 
-            Ok::<(), TierError>(())
+            Ok::<(), String>(())
         }
         .await;
 
@@ -349,7 +281,7 @@ impl S3TierBackend {
         dest_path: &str,
         key: &str,
         progress_fn: F,
-    ) -> Result<u64, TierError>
+    ) -> Result<u64, String>
     where
         F: FnMut(i64, f32) -> Result<(), String> + Send + Sync + 'static,
     {
@@ -361,7 +293,7 @@ impl S3TierBackend {
             .key(key)
             .send()
             .await
-            .map_err(|e| head_object_error(key, e))?;
+            .map_err(|e| format!("failed to head object {}: {}", key, e))?;
 
         let file_size = head_resp.content_length().unwrap_or(0) as u64;
 
@@ -373,12 +305,10 @@ impl S3TierBackend {
                 .truncate(true)
                 .open(dest_path)
                 .await
-                .map_err(|e| {
-                    TierError::Io(format!("failed to open dest file {}: {}", dest_path, e))
-                })?;
+                .map_err(|e| format!("failed to open dest file {}: {}", dest_path, e))?;
             file.set_len(file_size)
                 .await
-                .map_err(|e| TierError::Io(format!("failed to set file length: {}", e)))?;
+                .map_err(|e| format!("failed to set file length: {}", e))?;
         }
 
         let part_size: u64 = 64 * 1024 * 1024;
@@ -414,7 +344,7 @@ impl S3TierBackend {
                 let _permit = sem
                     .acquire()
                     .await
-                    .map_err(|e| TierError::Io(format!("semaphore error: {}", e)))?;
+                    .map_err(|e| format!("semaphore error: {}", e))?;
 
                 let end = off + size - 1;
                 let range = format!("bytes={}-{}", off, end);
@@ -426,13 +356,13 @@ impl S3TierBackend {
                     .range(&range)
                     .send()
                     .await
-                    .map_err(|e| get_object_error(&key, &range, e))?;
+                    .map_err(|e| format!("failed to get object {} range {}: {}", key, range, e))?;
 
                 let body = get_resp
                     .body
                     .collect()
                     .await
-                    .map_err(|e| TierError::Io(format!("failed to read body: {}", e)))?;
+                    .map_err(|e| format!("failed to read body: {}", e))?;
                 let bytes = body.into_bytes();
 
                 // Write at the correct offset (like Go's WriteAt)
@@ -440,17 +370,13 @@ impl S3TierBackend {
                     .write(true)
                     .open(&dp)
                     .await
-                    .map_err(|e| {
-                        TierError::Io(format!("failed to open dest file {}: {}", dp, e))
-                    })?;
+                    .map_err(|e| format!("failed to open dest file {}: {}", dp, e))?;
                 file.seek(std::io::SeekFrom::Start(off))
                     .await
-                    .map_err(|e| {
-                        TierError::Io(format!("failed to seek to offset {}: {}", off, e))
-                    })?;
+                    .map_err(|e| format!("failed to seek to offset {}: {}", off, e))?;
                 file.write_all(&bytes)
                     .await
-                    .map_err(|e| TierError::Io(format!("failed to write to {}: {}", dp, e)))?;
+                    .map_err(|e| format!("failed to write to {}: {}", dp, e))?;
 
                 // Report progress. The lock is released before the result is
                 // propagated so an aborting callback cannot poison the mutex
@@ -466,9 +392,9 @@ impl S3TierBackend {
                     };
                     (guard.1)(downloaded as i64, pct)
                 };
-                progress_result.map_err(TierError::Aborted)?;
+                progress_result?;
 
-                Ok::<_, TierError>(())
+                Ok::<_, String>(())
             }));
         }
 
@@ -476,7 +402,7 @@ impl S3TierBackend {
         for handle in handles {
             handle
                 .await
-                .map_err(|e| TierError::Io(format!("download task panicked: {}", e)))??;
+                .map_err(|e| format!("download task panicked: {}", e))??;
         }
 
         // fsync the file so its content is durable before the caller trims the .vif
@@ -485,21 +411,16 @@ impl S3TierBackend {
             .write(true)
             .open(dest_path)
             .await
-            .map_err(|e| TierError::Io(format!("failed to open {} for fsync: {}", dest_path, e)))?;
+            .map_err(|e| format!("failed to open {} for fsync: {}", dest_path, e))?;
         synced
             .sync_all()
             .await
-            .map_err(|e| TierError::Io(format!("failed to fsync {}: {}", dest_path, e)))?;
+            .map_err(|e| format!("failed to fsync {}: {}", dest_path, e))?;
 
         Ok(file_size)
     }
 
-    pub async fn read_range(
-        &self,
-        key: &str,
-        offset: u64,
-        size: usize,
-    ) -> Result<Vec<u8>, TierError> {
+    pub async fn read_range(&self, key: &str, offset: u64, size: usize) -> Result<Vec<u8>, String> {
         let end = offset + (size as u64).saturating_sub(1);
         let range = format!("bytes={}-{}", offset, end);
         let resp = self
@@ -510,35 +431,29 @@ impl S3TierBackend {
             .range(&range)
             .send()
             .await
-            .map_err(|e| get_object_error(key, &range, e))?;
+            .map_err(|e| format!("failed to get object {} range {}: {}", key, range, e))?;
 
         let body = resp
             .body
             .collect()
             .await
-            .map_err(|e| TierError::Io(format!("failed to read object {} body: {}", key, e)))?;
+            .map_err(|e| format!("failed to read object {} body: {}", key, e))?;
         Ok(body.into_bytes().to_vec())
     }
 
     /// Delete a file from S3.
-    pub async fn delete_file(&self, key: &str) -> Result<(), TierError> {
+    pub async fn delete_file(&self, key: &str) -> Result<(), String> {
         self.client
             .delete_object()
             .bucket(&self.bucket)
             .key(key)
             .send()
             .await
-            .map_err(|e| {
-                TierError::Io(format!(
-                    "failed to delete object {}: {}",
-                    key,
-                    DisplayErrorContext(&e)
-                ))
-            })?;
+            .map_err(|e| format!("failed to delete object {}: {}", key, e))?;
         Ok(())
     }
 
-    pub fn delete_file_blocking(&self, key: &str) -> Result<(), TierError> {
+    pub fn delete_file_blocking(&self, key: &str) -> Result<(), String> {
         let client = self.client.clone();
         let bucket = self.bucket.clone();
         let key = key.to_string();
@@ -549,13 +464,7 @@ impl S3TierBackend {
                 .key(&key)
                 .send()
                 .await
-                .map_err(|e| {
-                    TierError::Io(format!(
-                        "failed to delete object {}: {}",
-                        key,
-                        DisplayErrorContext(&e)
-                    ))
-                })?;
+                .map_err(|e| format!("failed to delete object {}: {}", key, e))?;
             Ok(())
         })
     }
@@ -565,7 +474,7 @@ impl S3TierBackend {
         key: &str,
         offset: u64,
         size: usize,
-    ) -> Result<Vec<u8>, TierError> {
+    ) -> Result<Vec<u8>, String> {
         let client = self.client.clone();
         let bucket = self.bucket.clone();
         let key = key.to_string();
@@ -579,12 +488,13 @@ impl S3TierBackend {
                 .range(&range)
                 .send()
                 .await
-                .map_err(|e| get_object_error(&key, &range, e))?;
+                .map_err(|e| format!("failed to get object {} range {}: {}", key, range, e))?;
 
-            let body =
-                resp.body.collect().await.map_err(|e| {
-                    TierError::Io(format!("failed to read object {} body: {}", key, e))
-                })?;
+            let body = resp
+                .body
+                .collect()
+                .await
+                .map_err(|e| format!("failed to read object {} body: {}", key, e))?;
             Ok(body.into_bytes().to_vec())
         })
     }
@@ -645,279 +555,18 @@ pub fn global_s3_tier_registry() -> &'static RwLock<S3TierRegistry> {
     GLOBAL_S3_TIER_REGISTRY.get_or_init(|| RwLock::new(S3TierRegistry::new()))
 }
 
-/// The one process-wide runtime for tiered-S3 I/O issued from synchronous
-/// storage code. A per-call runtime tore down the SDK's pooled connections
-/// after every 64 KiB chunk, re-dialing TLS per read; a long-lived runtime
-/// keeps the pool warm.
-///
-/// Built on first use. A build failure is returned, not cached or panicked:
-/// callers sit inside `Volume::destroy` and needle reads, whose own error
-/// paths must run, and a later call may succeed.
-static TIER_RUNTIME: std::sync::Mutex<Option<tokio::runtime::Runtime>> =
-    std::sync::Mutex::new(None);
-
-fn tier_handle() -> Result<tokio::runtime::Handle, TierError> {
-    let mut slot = TIER_RUNTIME
-        .lock()
-        .unwrap_or_else(|poisoned| poisoned.into_inner());
-    if slot.is_none() {
-        let runtime = tokio::runtime::Builder::new_multi_thread()
-            .worker_threads(2)
-            .thread_name("tier-io")
-            .enable_all()
-            .build()
-            .map_err(|e| {
-                TierError::RuntimeUnavailable(format!(
-                    "failed to build the tier I/O tokio runtime: {}",
-                    e
-                ))
-            })?;
-        *slot = Some(runtime);
-    }
-    Ok(slot.as_ref().expect("just initialised").handle().clone())
-}
-
-/// Run `future` on the tier runtime and block the calling thread until it
-/// finishes. The caller may be a worker of *another* tokio runtime, so this
-/// waits on a channel rather than `Handle::block_on`, which panics when
-/// called from inside any runtime context.
-fn block_on_tier_future<F, T>(future: F) -> Result<T, TierError>
+fn block_on_tier_future<F, T>(future: F) -> Result<T, String>
 where
-    F: Future<Output = Result<T, TierError>> + Send + 'static,
+    F: Future<Output = Result<T, String>> + Send + 'static,
     T: Send + 'static,
 {
-    let handle = tier_handle()?;
-    let task = handle.spawn(future);
-    let (tx, rx) = std::sync::mpsc::sync_channel(1);
-    handle.spawn(async move {
-        // The receiver only goes away if the caller was unwound; nothing to
-        // report then.
-        let _ = tx.send(task.await);
-    });
-    match rx.recv() {
-        Ok(Ok(result)) => result,
-        Ok(Err(join_error)) => Err(describe_join_error(join_error)),
-        Err(_) => Err(TierError::RuntimeUnavailable(
-            "tier I/O runtime dropped the task before it finished".to_string(),
-        )),
-    }
-}
-
-/// Turn a `JoinError` into a message that keeps the panic payload, so an
-/// SDK panic surfaces as "boom" rather than a fixed "thread panicked".
-fn describe_join_error(join_error: tokio::task::JoinError) -> TierError {
-    if join_error.is_panic() {
-        let payload = join_error.into_panic();
-        let message = if let Some(s) = payload.downcast_ref::<&str>() {
-            (*s).to_string()
-        } else if let Some(s) = payload.downcast_ref::<String>() {
-            s.clone()
-        } else {
-            "non-string panic payload".to_string()
-        };
-        TierError::Io(format!("tier I/O task panicked: {}", message))
-    } else {
-        TierError::RuntimeUnavailable(format!("tier I/O task failed: {}", join_error))
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use crate::remote_storage::s3::tests::{CannedResponse, NO_SUCH_KEY};
-    use std::collections::HashSet;
-    use tokio::runtime::Handle;
-
-    fn probe() -> Result<(tokio::runtime::Id, Option<String>), TierError> {
-        block_on_tier_future(async {
-            Ok((
-                Handle::current().id(),
-                std::thread::current().name().map(str::to_string),
-            ))
-        })
-    }
-
-    #[test]
-    fn block_on_tier_future_reuses_one_runtime() {
-        let (first_runtime, first_thread) = probe().expect("first call");
-        let (second_runtime, second_thread) = probe().expect("second call");
-        assert_eq!(
-            first_runtime, second_runtime,
-            "each call must run on the same long-lived tier runtime"
-        );
-        assert_eq!(first_thread.as_deref(), Some("tier-io"));
-        assert_eq!(second_thread.as_deref(), Some("tier-io"));
-
-        let mut runtimes = HashSet::new();
-        for _ in 0..20 {
-            let (id, _) = probe().expect("probe");
-            runtimes.insert(id);
-        }
-        assert_eq!(runtimes.len(), 1);
-    }
-
-    #[test]
-    fn block_on_tier_future_returns_the_value_and_the_error() {
-        assert_eq!(block_on_tier_future(async { Ok(7u32) }).unwrap(), 7);
-        let err = block_on_tier_future::<_, u32>(async { Err(TierError::NotFound("nope".into())) })
-            .unwrap_err();
-        assert!(
-            matches!(&err, TierError::NotFound(m) if m == "nope"),
-            "{err:?}"
-        );
-    }
-
-    #[test]
-    fn block_on_tier_future_works_from_a_std_thread() {
-        let (id, _) = std::thread::spawn(probe)
-            .join()
-            .expect("probe thread")
-            .expect("probe");
-        assert_eq!(id, tier_handle().expect("tier runtime").id());
-    }
-
-    #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
-    async fn block_on_tier_future_works_from_spawn_blocking() {
-        let (id, _) = tokio::task::spawn_blocking(probe)
-            .await
-            .expect("spawn_blocking")
-            .expect("probe");
-        assert_eq!(id, tier_handle().expect("tier runtime").id());
-        assert_ne!(id, Handle::current().id());
-    }
-
-    // Called straight from another runtime's async context: the case that
-    // would panic with `Handle::block_on` ("Cannot start a runtime from
-    // within a runtime").
-    #[tokio::test]
-    async fn block_on_tier_future_works_from_a_current_thread_runtime() {
-        let (id, _) = probe().expect("probe");
-        assert_eq!(id, tier_handle().expect("tier runtime").id());
-        assert_ne!(id, Handle::current().id());
-    }
-
-    #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
-    async fn block_on_tier_future_works_from_a_multi_thread_runtime_worker() {
-        let (id, _) = probe().expect("probe");
-        assert_eq!(id, tier_handle().expect("tier runtime").id());
-        assert_ne!(id, Handle::current().id());
-    }
-
-    #[test]
-    fn block_on_tier_future_reports_the_panic_payload() {
-        let err = block_on_tier_future::<_, ()>(async {
-            if std::hint::black_box(true) {
-                panic!("boom {}", 42);
-            }
-            Ok(())
-        })
-        .expect_err("a panicking future must be an error");
-        assert!(matches!(err, TierError::Io(_)), "got: {err:?}");
-        assert!(err.to_string().contains("boom 42"), "got: {err}");
-        assert!(err.to_string().contains("panicked"), "got: {err}");
-    }
-
-    #[test]
-    fn block_on_tier_future_reports_a_str_panic_payload() {
-        let err = block_on_tier_future::<_, ()>(async {
-            if std::hint::black_box(true) {
-                panic!("static boom");
-            }
-            Ok(())
-        })
-        .expect_err("a panicking future must be an error");
-        assert!(err.to_string().contains("static boom"), "got: {err}");
-    }
-
-    fn backend_answering(status: u16, body: &'static str) -> S3TierBackend {
-        let config = aws_sdk_s3::Config::builder()
-            .behavior_version(BehaviorVersion::latest())
-            .region(Region::new("us-east-1"))
-            .credentials_provider(Credentials::new("AKIATEST", "secret", None, None, "test"))
-            .endpoint_url("http://127.0.0.1:1")
-            .force_path_style(true)
-            .http_client(CannedResponse { status, body })
-            .retry_config(aws_sdk_s3::config::retry::RetryConfig::disabled())
-            .build();
-        S3TierBackend {
-            client: Client::from_conf(config),
-            bucket: "bucket".to_string(),
-            storage_class: "STANDARD".to_string(),
-        }
-    }
-
-    #[tokio::test]
-    async fn download_head_404_is_not_found() {
-        let tmp = tempfile::tempdir().unwrap();
-        let dest = tmp.path().join("1.dat");
-        let err = backend_answering(404, "")
-            .download_file(dest.to_str().unwrap(), "missing", |_, _| Ok(()))
-            .await
-            .unwrap_err();
-        assert!(matches!(err, TierError::NotFound(_)), "{err:?}");
-        assert!(
-            err.to_string()
-                .starts_with("failed to head object missing: "),
-            "{err}"
-        );
-    }
-
-    #[tokio::test]
-    async fn download_head_403_is_io() {
-        let tmp = tempfile::tempdir().unwrap();
-        let dest = tmp.path().join("1.dat");
-        let err = backend_answering(403, "")
-            .download_file(dest.to_str().unwrap(), "denied", |_, _| Ok(()))
-            .await
-            .unwrap_err();
-        assert!(matches!(err, TierError::Io(_)), "{err:?}");
-    }
-
-    #[tokio::test]
-    async fn read_range_no_such_key_is_not_found() {
-        let err = backend_answering(404, NO_SUCH_KEY)
-            .read_range("missing", 0, 8)
-            .await
-            .unwrap_err();
-        assert!(matches!(err, TierError::NotFound(_)), "{err:?}");
-        assert!(
-            err.to_string()
-                .starts_with("failed to get object missing range bytes=0-7: "),
-            "{err}"
-        );
-    }
-
-    #[tokio::test]
-    async fn read_range_bare_404_is_io() {
-        // As in Go, GET is not-found by the NoSuchKey code, not the status.
-        let err = backend_answering(404, "")
-            .read_range("missing", 0, 8)
-            .await
-            .unwrap_err();
-        assert!(matches!(err, TierError::Io(_)), "{err:?}");
-    }
-
-    #[test]
-    fn read_range_blocking_no_such_key_is_not_found() {
-        let err = backend_answering(404, NO_SUCH_KEY)
-            .read_range_blocking("missing", 0, 8)
-            .unwrap_err();
-        assert!(matches!(err, TierError::NotFound(_)), "{err:?}");
-    }
-
-    #[test]
-    fn backend_name_to_type_id_splits_on_dot() {
-        assert_eq!(
-            backend_name_to_type_id("s3"),
-            ("s3".to_string(), "default".to_string())
-        );
-        assert_eq!(
-            backend_name_to_type_id("s3.eu"),
-            ("s3".to_string(), "eu".to_string())
-        );
-        assert_eq!(
-            backend_name_to_type_id("s3.a.b"),
-            (String::new(), String::new())
-        );
-    }
+    std::thread::spawn(move || {
+        let runtime = tokio::runtime::Builder::new_current_thread()
+            .enable_all()
+            .build()
+            .map_err(|e| format!("failed to build tokio runtime: {}", e))?;
+        runtime.block_on(future)
+    })
+    .join()
+    .map_err(|_| "tier runtime thread panicked".to_string())?
 }

seaweed-volume/src/security/tls.rs

@@ -120,11 +120,10 @@ impl ClientCertVerifier for CommonNameVerifier {
 
 // aws-lc-rs and ring both get linked transitively, so rustls can't auto-select
 // a provider and tonic's client TLS panics on first use. Pin the default to
-// aws-lc-rs, matching the server config. Idempotent. The body lives in
-// seaweed-common so this binary and the Rust plugin workers cannot end up
-// installing different providers; re-exported here so callers keep their
-// import path.
-pub use seaweed_common::tls::install_default_crypto_provider;
+// aws-lc-rs, matching the server config. Idempotent.
+pub fn install_default_crypto_provider() {
+    let _ = aws_lc_rs::default_provider().install_default();
+}
 
 pub fn build_rustls_server_config(
     cert_path: &str,

seaweed-volume/src/server/grpc_client.rs

@@ -1,42 +1,16 @@
-//! Construction of the volume server's *outgoing* gRPC clients: TLS material,
-//! endpoint tuning, dial bounds, and the three client constructors every call
-//! site goes through.
-//!
-//! The keepalive, window-size and message-size constants below are shared with
-//! the *inbound* server built in `main.rs`, which imports them from here rather
-//! than declaring its own. Changing one therefore changes both directions at
-//! once, which is deliberate: a volume server talks to its peers with the same
-//! HTTP/2 settings it offers them.
-
 use std::error::Error;
 use std::fmt;
 use std::time::Duration;
 
 use hyper::http::Uri;
-use tonic::service::interceptor::InterceptedService;
 use tonic::transport::{Certificate, Channel, ClientTlsConfig, Endpoint, Identity};
-use tonic::{Request, Status};
 
 use crate::config::VolumeServerConfig;
-use crate::pb::filer_pb::seaweed_filer_client::SeaweedFilerClient;
-use crate::pb::master_pb::seaweed_client::SeaweedClient;
-use crate::pb::volume_server_pb::volume_server_client::VolumeServerClient;
-use crate::server::request_id::outgoing_request_id_interceptor;
 
 pub const GRPC_MAX_MESSAGE_SIZE: usize = 1 << 30;
-pub const GRPC_KEEPALIVE_INTERVAL: Duration = Duration::from_secs(60);
-pub const GRPC_KEEPALIVE_TIMEOUT: Duration = Duration::from_secs(20);
-pub const GRPC_INITIAL_WINDOW_SIZE: u32 = 16 * 1024 * 1024;
-
-/// Bound on the TCP connect of every outgoing dial. `build_grpc_endpoint` is
-/// private and `connect_channel` is the only way out of this module, so every
-/// call site picks this up whether it thinks about timeouts or not.
-///
-/// It bounds the TCP handshake only — tonic hands it to
-/// `HttpConnector::set_connect_timeout`. A peer that completes the handshake
-/// and then stalls in the TLS or HTTP/2 exchange is not covered; callers that
-/// need that bound wrap the whole dial (see `connect_ping_target`).
-const GRPC_CONNECT_TIMEOUT: Duration = Duration::from_secs(5);
+const GRPC_KEEPALIVE_INTERVAL: Duration = Duration::from_secs(60);
+const GRPC_KEEPALIVE_TIMEOUT: Duration = Duration::from_secs(20);
+const GRPC_INITIAL_WINDOW_SIZE: u32 = 16 * 1024 * 1024;
 
 #[derive(Clone, Debug)]
 pub struct OutgoingGrpcTlsConfig {
@@ -107,7 +81,7 @@ pub fn grpc_endpoint_uri(grpc_host_port: &str, tls: Option<&OutgoingGrpcTlsConfi
     format!("{}://{}", scheme, grpc_host_port)
 }
 
-fn build_grpc_endpoint(
+pub fn build_grpc_endpoint(
     grpc_host_port: &str,
     tls: Option<&OutgoingGrpcTlsConfig>,
 ) -> Result<Endpoint, GrpcClientError> {
@@ -175,152 +149,6 @@ pub async fn connect_guarded(
         .map_err(|e| GrpcClientError(format!("connect {} failed: {}", target, e)))
 }
 
-/// How a dial is bounded.
-///
-/// `connect_timeout` is handed to the TCP connector. `request_timeout` becomes
-/// [`Endpoint::timeout`], which tonic installs as a `GrpcTimeout` layer in
-/// front of *every* request the resulting channel carries — it is not a
-/// property of one call.
-#[derive(Clone, Copy, Debug, PartialEq, Eq)]
-pub struct GrpcDialOptions {
-    /// Bound on establishing the connection to the peer.
-    pub connect_timeout: Duration,
-    /// Deadline applied to each RPC on the channel, or `None` to leave them
-    /// unbounded.
-    pub request_timeout: Option<Duration>,
-}
-
-impl GrpcDialOptions {
-    /// A short request/response call: connect within 5 s, answer within 10 s.
-    pub fn unary() -> Self {
-        Self {
-            connect_timeout: GRPC_CONNECT_TIMEOUT,
-            request_timeout: Some(Duration::from_secs(10)),
-        }
-    }
-
-    /// A call the peer may take a while to answer: connect within 5 s, answer
-    /// within 30 s.
-    pub fn long() -> Self {
-        Self {
-            connect_timeout: GRPC_CONNECT_TIMEOUT,
-            request_timeout: Some(Duration::from_secs(30)),
-        }
-    }
-
-    /// A bounded connect with no deadline on the RPCs themselves.
-    ///
-    /// `request_timeout` must stay `None` here. [`Endpoint::timeout`] is not a
-    /// transfer budget: tonic layers it as a `GrpcTimeout` around the
-    /// response future, which resolves when the server's *first response
-    /// headers* arrive, so it bounds how long the peer may take to start
-    /// answering — per request, for every request the channel carries. A 10 s
-    /// value picked to suit one short call would therefore also be the header
-    /// deadline for the `VolumeCopy` that shares the dial, and a busy source
-    /// that takes longer than that to open its file would lose the whole copy.
-    /// `VolumeCopy`, `VolumeTailSender` and `VolumeEcShardsCopy` have never
-    /// carried one.
-    pub fn stream() -> Self {
-        Self {
-            connect_timeout: GRPC_CONNECT_TIMEOUT,
-            request_timeout: None,
-        }
-    }
-}
-
-/// Dial a peer and return a connected channel.
-///
-/// The error carries only the transport failure: every caller already wraps it
-/// with the address and the operation it was attempting.
-pub async fn connect_channel(
-    grpc_host_port: &str,
-    tls: Option<&OutgoingGrpcTlsConfig>,
-    opts: GrpcDialOptions,
-) -> Result<Channel, GrpcClientError> {
-    let mut endpoint =
-        build_grpc_endpoint(grpc_host_port, tls)?.connect_timeout(opts.connect_timeout);
-    if let Some(request_timeout) = opts.request_timeout {
-        endpoint = endpoint.timeout(request_timeout);
-    }
-    endpoint
-        .connect()
-        .await
-        .map_err(|e| GrpcClientError(e.to_string()))
-}
-
-/// Dial a copy/tail source and return a connected channel, re-validating every
-/// resolved address at connect time.
-///
-/// The guarded equivalent of [`connect_channel`]: same `opts` bounds, but the
-/// dial goes through [`connect_guarded`] so a source address that passed
-/// validation cannot be re-pointed by DNS between the check and the connect.
-/// The bounds are applied to the endpoint *before* delegating, so the
-/// `allow_untrusted` opt-out is timed too.
-///
-/// `target` is the caller-facing source address (the unparsed
-/// `"ip:port.grpcPort"` form), which is what the guard pins against; the error
-/// carries only the transport failure, as every caller already wraps it with
-/// the address and the operation it was attempting.
-pub async fn connect_channel_guarded(
-    grpc_host_port: &str,
-    target: &str,
-    tls: Option<&OutgoingGrpcTlsConfig>,
-    opts: GrpcDialOptions,
-    allow_untrusted: bool,
-) -> Result<Channel, GrpcClientError> {
-    let mut endpoint =
-        build_grpc_endpoint(grpc_host_port, tls)?.connect_timeout(opts.connect_timeout);
-    if let Some(request_timeout) = opts.request_timeout {
-        endpoint = endpoint.timeout(request_timeout);
-    }
-    connect_guarded(endpoint, target, allow_untrusted).await
-}
-
-/// The outgoing request-id interceptor as a concrete type, so the client
-/// aliases below can name it.
-pub type RequestIdInterceptor = fn(Request<()>) -> Result<Request<()>, Status>;
-
-/// A volume-server client with the request-id interceptor attached.
-pub type VolumeServerGrpcClient =
-    VolumeServerClient<InterceptedService<Channel, RequestIdInterceptor>>;
-/// A master client with the request-id interceptor attached.
-pub type MasterGrpcClient = SeaweedClient<InterceptedService<Channel, RequestIdInterceptor>>;
-/// A filer client with the request-id interceptor attached.
-pub type FilerGrpcClient = SeaweedFilerClient<InterceptedService<Channel, RequestIdInterceptor>>;
-
-/// Wrap a connected channel in a volume-server client that forwards the
-/// current request id and lifts both message-size limits.
-pub fn volume_server_client(channel: Channel) -> VolumeServerGrpcClient {
-    VolumeServerClient::with_interceptor(
-        channel,
-        outgoing_request_id_interceptor as RequestIdInterceptor,
-    )
-    .max_decoding_message_size(GRPC_MAX_MESSAGE_SIZE)
-    .max_encoding_message_size(GRPC_MAX_MESSAGE_SIZE)
-}
-
-/// Wrap a connected channel in a master client that forwards the current
-/// request id and lifts both message-size limits.
-pub fn master_client(channel: Channel) -> MasterGrpcClient {
-    SeaweedClient::with_interceptor(
-        channel,
-        outgoing_request_id_interceptor as RequestIdInterceptor,
-    )
-    .max_decoding_message_size(GRPC_MAX_MESSAGE_SIZE)
-    .max_encoding_message_size(GRPC_MAX_MESSAGE_SIZE)
-}
-
-/// Wrap a connected channel in a filer client that forwards the current
-/// request id and lifts both message-size limits.
-pub fn filer_client(channel: Channel) -> FilerGrpcClient {
-    SeaweedFilerClient::with_interceptor(
-        channel,
-        outgoing_request_id_interceptor as RequestIdInterceptor,
-    )
-    .max_decoding_message_size(GRPC_MAX_MESSAGE_SIZE)
-    .max_encoding_message_size(GRPC_MAX_MESSAGE_SIZE)
-}
-
 /// Parse a SeaweedFS server address (`"ip:port.grpcPort"` or
 /// `"ip:port"`) into the `host:grpcPort` form `build_grpc_endpoint`
 /// expects. With the trailing `.grpcPort` segment, that segment IS
@@ -330,27 +158,53 @@ pub fn filer_client(channel: Channel) -> FilerGrpcClient {
 /// Shared between `grpc_server.rs` and the distributed-EC-read path
 /// in `store_ec.rs` — keep this as the single source of truth so the
 /// HTTP↔gRPC port translation can't drift between callers.
-///
-/// The rule itself lives in `seaweed_common::address`, which the Rust
-/// plugin workers share; this wrapper only flattens the typed error
-/// back to the `String` its callers already handle. Unbracketed IPv6
-/// literals come back bracketed, which this copy used to get wrong.
 pub fn parse_grpc_address(source: &str) -> Result<String, String> {
-    seaweed_common::address::to_grpc_address(source).map_err(|e| e.to_string())
+    let colon_idx = source
+        .rfind(':')
+        .ok_or_else(|| format!("cannot parse address: {}", source))?;
+    let host = &source[..colon_idx];
+    let port_part = &source[colon_idx + 1..];
+
+    if let Some(dot_idx) = port_part.rfind('.') {
+        // Format: "ip:port.grpcPort". Validate BOTH ports as u16
+        // so a malformed HTTP port (e.g. `host:abc.18080`) is
+        // rejected here rather than tripping a downstream
+        // `build_grpc_endpoint` URI parse failure with a less
+        // useful error.
+        let http_port = &port_part[..dot_idx];
+        let grpc_port = &port_part[dot_idx + 1..];
+        http_port
+            .parse::<u16>()
+            .map_err(|e| format!("invalid http port {:?}: {}", http_port, e))?;
+        grpc_port
+            .parse::<u16>()
+            .map_err(|e| format!("invalid grpc port {:?}: {}", grpc_port, e))?;
+        return Ok(format!("{}:{}", host, grpc_port));
+    }
+
+    // Format: "ip:port" → grpc = port + 10000. Reject inputs whose
+    // implicit grpc port would overflow the TCP port range (e.g.
+    // `host:60000` produces 70000 — invalid). Without this check
+    // the cast silently wraps and the endpoint call later fails
+    // with an opaque connection error.
+    let port: u16 = port_part
+        .parse()
+        .map_err(|e| format!("invalid port {:?}: {}", port_part, e))?;
+    let grpc_port = port as u32 + 10000;
+    if grpc_port > u16::MAX as u32 {
+        return Err(format!(
+            "implicit grpc port out of range: {} + 10000 = {}",
+            port, grpc_port
+        ));
+    }
+    Ok(format!("{}:{}", host, grpc_port))
 }
 
 #[cfg(test)]
 mod tests {
-    use super::{
-        GrpcDialOptions, build_grpc_endpoint, connect_channel, grpc_endpoint_uri,
-        load_outgoing_grpc_tls, volume_server_client,
-    };
+    use super::{build_grpc_endpoint, grpc_endpoint_uri, load_outgoing_grpc_tls};
     use crate::config::{NeedleMapKind, ReadMode, VolumeServerConfig};
-    use crate::pb::volume_server_pb;
     use crate::security::tls::TlsPolicy;
-    use crate::server::request_id::scope_request_id;
-    use std::sync::{Arc, Mutex};
-    use std::time::Duration;
 
     const TEST_CERT_PEM: &str = "-----BEGIN CERTIFICATE-----\nMIIBPDCB76ADAgECAhRuRPQgeAu43BT/M7EfAWSdapVdYDAFBgMrZXAwFDESMBAG\nA1UEAwwJbG9jYWxob3N0MB4XDTI2MDcwNTE2MTUyOVoXDTM2MDcwMjE2MTUyOVow\nFDESMBAGA1UEAwwJbG9jYWxob3N0MCowBQYDK2VwAyEAr/3bNIFI+8V32oCiY6y+\nXRFmZpdNQ2g//VtRkT+nQg+jUzBRMB0GA1UdDgQWBBTsy9tLf1zPiXCQfgci6zNi\ndEzRSjAfBgNVHSMEGDAWgBTsy9tLf1zPiXCQfgci6zNidEzRSjAPBgNVHRMBAf8E\nBTADAQH/MAUGAytlcANBAIvsdw0IbvOBBkb9cd7BfMJfIP9pQQrAL03pCRWJFnFh\nSysaLVgFXI4T078IiaM874oO+iB+5vNbWEpc7CkGow4=\n-----END CERTIFICATE-----\n";
     const TEST_KEY_PEM: &str = "-----BEGIN PRIVATE KEY-----\nMC4CAQAwBQYDK2VwBCIEIHbyn71Kk+Y7KT3sBctit7uZpErpoH6qDbFj6P8qGaZH\n-----END PRIVATE KEY-----\n";
@@ -397,7 +251,6 @@ mod tests {
             mem_profile: String::new(),
             compaction_byte_per_second: 0,
             maintenance_byte_per_second: 0,
-            max_parallel_vacuum_commits: 0,
             file_size_limit_bytes: 0,
             concurrent_upload_limit: 0,
             concurrent_download_limit: 0,
@@ -431,6 +284,7 @@ mod tests {
             grpc_allowed_wildcard_domain: String::new(),
             grpc_volume_allowed_common_names: vec![],
             tls_policy: TlsPolicy::default(),
+            enable_write_queue: false,
             security_file: String::new(),
         }
     }
@@ -545,131 +399,4 @@ mod tests {
         let err = parse_grpc_address("hostname").unwrap_err();
         assert!(err.contains("cannot parse"), "{}", err);
     }
-
-    #[test]
-    fn test_parse_grpc_address_brackets_ipv6_literals() {
-        use super::parse_grpc_address;
-        // This used to come back as `::1:29333`, which is not a valid
-        // authority: `build_grpc_endpoint` reads the last colon as the port
-        // separator and rejects the rest.
-        assert_eq!(parse_grpc_address("::1:19333").unwrap(), "[::1]:29333");
-        assert_eq!(parse_grpc_address("::1:9333.19333").unwrap(), "[::1]:19333");
-        // Already bracketed, so it is left alone.
-        assert_eq!(parse_grpc_address("[::1]:9333").unwrap(), "[::1]:19333");
-    }
-
-    #[test]
-    fn test_build_grpc_endpoint_accepts_an_ipv6_master_address() {
-        use super::parse_grpc_address;
-        let endpoint = build_grpc_endpoint(&parse_grpc_address("::1:9333").unwrap(), None).unwrap();
-        assert_eq!(endpoint.uri().port_u16(), Some(19333));
-    }
-    /// A minimal HTTP/2 server that records the gRPC request headers it is
-    /// sent and answers every call with a trailers-only `unimplemented`. It is
-    /// enough to prove what a helper-built client puts on the wire, without
-    /// standing up the whole `VolumeServer` service behind a tonic server.
-    async fn serve_header_capture() -> (u16, Arc<Mutex<Option<String>>>) {
-        use hyper::service::service_fn;
-        use hyper_util::rt::{TokioExecutor, TokioIo};
-
-        let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();
-        let port = listener.local_addr().unwrap().port();
-        let seen: Arc<Mutex<Option<String>>> = Arc::new(Mutex::new(None));
-        let captured = Arc::clone(&seen);
-
-        tokio::spawn(async move {
-            while let Ok((stream, _)) = listener.accept().await {
-                let captured = Arc::clone(&captured);
-                tokio::spawn(async move {
-                    let _ = hyper::server::conn::http2::Builder::new(TokioExecutor::new())
-                        .serve_connection(
-                            TokioIo::new(stream),
-                            service_fn(move |req: hyper::Request<hyper::body::Incoming>| {
-                                let captured = Arc::clone(&captured);
-                                async move {
-                                    let value = req
-                                        .headers()
-                                        .get("x-amz-request-id")
-                                        .and_then(|v| v.to_str().ok())
-                                        .map(str::to_string);
-                                    *captured.lock().unwrap() = value;
-                                    Ok::<_, std::convert::Infallible>(
-                                        hyper::http::Response::builder()
-                                            .status(200)
-                                            .header("content-type", "application/grpc")
-                                            .header("grpc-status", "12")
-                                            .body(tonic::body::Body::empty())
-                                            .unwrap(),
-                                    )
-                                }
-                            }),
-                        )
-                        .await;
-                });
-            }
-        });
-
-        (port, seen)
-    }
-
-    #[tokio::test]
-    async fn test_helper_built_client_sends_the_scoped_request_id() {
-        let (port, seen) = serve_header_capture().await;
-
-        let channel = connect_channel(
-            &format!("127.0.0.1:{}", port),
-            None,
-            GrpcDialOptions::unary(),
-        )
-        .await
-        .expect("dial the header-capturing server");
-
-        let mut client = volume_server_client(channel);
-        // The interceptor has a request id to forward only inside a scope, so
-        // the call has to run inside one for this to test anything.
-        let _ = scope_request_id("REQUEST-ID-ON-THE-WIRE".to_string(), async move {
-            client
-                .ping(volume_server_pb::PingRequest {
-                    target: String::new(),
-                    target_type: String::new(),
-                })
-                .await
-        })
-        .await;
-
-        assert_eq!(
-            seen.lock().unwrap().as_deref(),
-            Some("REQUEST-ID-ON-THE-WIRE"),
-            "a client built by volume_server_client must carry the outgoing request id"
-        );
-    }
-
-    #[test]
-    fn test_dial_presets_match_the_call_sites_they_replace() {
-        assert_eq!(
-            GrpcDialOptions::unary().connect_timeout,
-            Duration::from_secs(5)
-        );
-        assert_eq!(
-            GrpcDialOptions::unary().request_timeout,
-            Some(Duration::from_secs(10))
-        );
-        assert_eq!(
-            GrpcDialOptions::long().connect_timeout,
-            Duration::from_secs(5)
-        );
-        assert_eq!(
-            GrpcDialOptions::long().request_timeout,
-            Some(Duration::from_secs(30))
-        );
-        assert_eq!(
-            GrpcDialOptions::stream().connect_timeout,
-            Duration::from_secs(5)
-        );
-        assert_eq!(
-            GrpcDialOptions::stream().request_timeout,
-            None,
-            "a streaming dial must not put a per-request deadline on the channel"
-        );
-    }
 }

seaweed-volume/src/server/memory_status.rs

@@ -36,20 +36,16 @@ pub fn collect_mem_status() -> volume_server_pb::MemStatus {
 
 #[cfg(target_os = "linux")]
 fn get_system_memory_linux() -> Option<(u64, u64)> {
-    // SAFETY: `libc::sysinfo` is plain data — integers and trailing padding,
-    // no pointers and no restricted niches — so the all-zero value is a valid
-    // one for the kernel to overwrite.
-    let mut info: libc::sysinfo = unsafe { std::mem::zeroed() };
-    // SAFETY: `&mut info` is a live, aligned, exclusive pointer to a
-    // `sysinfo` that the kernel only writes through, and its fields are read
-    // below only after the call reports success.
-    if unsafe { libc::sysinfo(&mut info) } != 0 {
-        return None;
+    unsafe {
+        let mut info: libc::sysinfo = std::mem::zeroed();
+        if libc::sysinfo(&mut info) == 0 {
+            let unit = info.mem_unit as u64;
+            let total = info.totalram as u64 * unit;
+            let free = info.freeram as u64 * unit;
+            return Some((total, free));
+        }
     }
-    let unit = info.mem_unit as u64;
-    let total = info.totalram as u64 * unit;
-    let free = info.freeram as u64 * unit;
-    Some((total, free))
+    None
 }
 
 #[cfg(target_os = "linux")]

seaweed-volume/src/server/mod.rs

@@ -1,8 +1,3 @@
-use tonic::Status;
-
-use crate::remote_storage::s3_tier::TierError;
-use crate::storage::volume::VolumeError;
-
 #[cfg(unix)]
 pub mod debug;
 pub mod grpc_client;
@@ -18,111 +13,3 @@ pub mod store_ec;
 pub mod ui;
 pub mod volume_server;
 pub mod write_queue;
-
-/// Map a storage error onto the gRPC code that describes it.
-impl From<VolumeError> for Status {
-    fn from(err: VolumeError) -> Self {
-        let message = err.to_string();
-        match err {
-            VolumeError::NotFound
-            | VolumeError::VolumeNotFound(_)
-            | VolumeError::Tier(TierError::NotFound(_)) => Status::not_found(message),
-            VolumeError::ReadOnly(_) | VolumeError::NotEmpty => {
-                Status::failed_precondition(message)
-            }
-            VolumeError::InsufficientSpace { .. } => Status::resource_exhausted(message),
-            VolumeError::AlreadyExists => Status::already_exists(message),
-            _ => Status::internal(message),
-        }
-    }
-}
-
-/// Same mapping, with the RPC's own context prefixed (`compact volume 7: ...`).
-pub fn status_with_context(context: &str, err: VolumeError) -> Status {
-    let status = Status::from(err);
-    Status::new(status.code(), format!("{context}: {}", status.message()))
-}
-
-/// Render a configured disk directory as an absolute path for display, so the
-/// status JSON and the UI show the same thing for a relative `-dir`. Falls
-/// back to the configured spelling when the current directory cannot be read.
-pub(crate) fn absolute_display_path(path: &str) -> String {
-    let p = std::path::Path::new(path);
-    if p.is_absolute() {
-        return path.to_string();
-    }
-    std::env::current_dir()
-        .map(|cwd| cwd.join(p).to_string_lossy().to_string())
-        .unwrap_or_else(|_| path.to_string())
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use crate::storage::types::VolumeId;
-
-    #[test]
-    fn test_volume_error_maps_to_grpc_code() {
-        use tonic::Code;
-
-        let code = |e: VolumeError| Status::from(e).code();
-        assert_eq!(
-            code(VolumeError::VolumeNotFound(VolumeId(7))),
-            Code::NotFound
-        );
-        assert_eq!(code(VolumeError::NotFound), Code::NotFound);
-        assert_eq!(
-            code(VolumeError::ReadOnly(VolumeId(7))),
-            Code::FailedPrecondition
-        );
-        assert_eq!(
-            VolumeError::ReadOnly(VolumeId(7)).to_string(),
-            "volume 7 is read only"
-        );
-        assert_eq!(
-            code(VolumeError::InsufficientSpace {
-                vid: VolumeId(7),
-                required: 2,
-                free: 1,
-            }),
-            Code::ResourceExhausted
-        );
-        assert_eq!(code(VolumeError::AlreadyExists), Code::AlreadyExists);
-        assert_eq!(code(VolumeError::NotInitialized), Code::Internal);
-        assert_eq!(
-            code(TierError::NotFound("gone".into()).into()),
-            Code::NotFound
-        );
-        for tier in [
-            TierError::Io("io".into()),
-            TierError::RuntimeUnavailable("rt".into()),
-            TierError::Aborted("bye".into()),
-        ] {
-            assert_eq!(code(tier.into()), Code::Internal);
-        }
-
-        let status = status_with_context(
-            "backend s3.default copy file /data/1.dat",
-            TierError::NotFound("failed to head object k: NotFound".into()).into(),
-        );
-        assert_eq!(status.code(), Code::NotFound);
-        assert_eq!(
-            status.message(),
-            "backend s3.default copy file /data/1.dat: failed to head object k: NotFound"
-        );
-
-        let status = status_with_context(
-            "compact volume 7",
-            VolumeError::InsufficientSpace {
-                vid: VolumeId(7),
-                required: 2,
-                free: 1,
-            },
-        );
-        assert_eq!(status.code(), Code::ResourceExhausted);
-        assert_eq!(
-            status.message(),
-            "compact volume 7: not enough free space: required 2, free 1"
-        );
-    }
-}

seaweed-volume/src/server/profiling.rs

@@ -136,7 +136,6 @@ mod tests {
             mem_profile: String::new(),
             compaction_byte_per_second: 0,
             maintenance_byte_per_second: 0,
-            max_parallel_vacuum_commits: 0,
             file_size_limit_bytes: 0,
             concurrent_upload_limit: 0,
             concurrent_download_limit: 0,
@@ -170,6 +169,7 @@ mod tests {
             grpc_allowed_wildcard_domain: String::new(),
             grpc_volume_allowed_common_names: vec![],
             tls_policy: TlsPolicy::default(),
+            enable_write_queue: false,
             security_file: String::new(),
         }
     }

seaweed-volume/src/server/store_ec.rs

@@ -26,7 +26,7 @@
 //! cache write-back briefly reacquires the EcVolume's internal
 //! `RwLock` so we do not contend with the Store-level lock at all.
 
-use std::collections::{HashMap, HashSet};
+use std::collections::HashMap;
 use std::fs;
 use std::io;
 use std::sync::Arc;
@@ -38,13 +38,12 @@ use reed_solomon_erasure::galois_8::ReedSolomon;
 use tokio::sync::Semaphore;
 use tonic::Request;
 
-use crate::pb::master_pb::{self, LookupEcVolumeRequest};
+use crate::pb::master_pb::{self, LookupEcVolumeRequest, seaweed_client::SeaweedClient};
 use crate::pb::volume_server_pb::{
-    CopyFileRequest, VolumeEcBlobDeleteRequest, VolumeEcShardReadRequest,
-};
-use crate::server::grpc_client::{
-    GrpcDialOptions, connect_channel, master_client, parse_grpc_address, volume_server_client,
+    CopyFileRequest, VolumeEcShardReadRequest, volume_server_client::VolumeServerClient,
 };
+use crate::server::grpc_client::{GRPC_MAX_MESSAGE_SIZE, build_grpc_endpoint, parse_grpc_address};
+use crate::server::request_id::outgoing_request_id_interceptor;
 use crate::server::volume_server::{VolumeServerState, to_http_address};
 use crate::storage::erasure_coding::ec_shard::{ShardId, shard_id_try_from};
 use crate::storage::needle::needle::{Needle, NeedleError, get_actual_size};
@@ -95,41 +94,20 @@ struct Snapshot {
     encode_ts_ns: i64,
 }
 
-/// Why a distributed EC read has no needle to return.
-#[derive(Debug, Clone, Copy, PartialEq, Eq)]
-pub enum EcMiss {
-    NotFound,
-    /// Tombstoned in the local `.ecx`/`.ecj`, or reported deleted by a peer.
-    Deleted,
-    VolumeNotFound,
-}
-
-/// Top-level entry point. Returns `Ok(None)` for any miss — absent,
-/// deleted, or volume gone; errors propagate as `io::Error`.
+/// Top-level entry point. Returns `Ok(None)` for "not found" (matches
+/// Go's `ReadEcShardNeedle`); errors propagate as `io::Error`.
 pub async fn read_ec_shard_needle_distributed(
     state: &Arc<VolumeServerState>,
     vid: VolumeId,
     needle_id: NeedleId,
 ) -> io::Result<Option<Needle>> {
-    Ok(read_ec_shard_needle_or_miss(state, vid, needle_id)
-        .await?
-        .ok())
-}
-
-/// Like `read_ec_shard_needle_distributed`, but says why there is no needle,
-/// as Go's `ReadEcShardNeedle` tells `ErrorDeleted` from not-found.
-pub async fn read_ec_shard_needle_or_miss(
-    state: &Arc<VolumeServerState>,
-    vid: VolumeId,
-    needle_id: NeedleId,
-) -> io::Result<Result<Needle, EcMiss>> {
     // Phase A — under the Store read lock, locate the needle, compute
     // intervals, and read any locally-mounted shard intervals. We must
     // not `.await` while holding this guard (std::sync::RwLockReadGuard
     // is !Send).
     let mut snapshot = match snapshot_under_lock(state, vid, needle_id)? {
-        Ok(s) => s,
-        Err(miss) => return Ok(Err(miss)),
+        Some(s) => s,
+        None => return Ok(None),
     };
 
     // Phase B — refresh the shard_locations cache from the master if
@@ -231,11 +209,17 @@ pub async fn read_ec_shard_needle_or_miss(
         .collect()
         .await;
 
-    // A peer reports the needle deleted (a cross-server window where the
-    // local index still shows it live): answer deleted rather than serving zeros.
-    let Some(assembled) = gather_intervals(fetched)? else {
-        return Ok(Err(EcMiss::Deleted));
-    };
+    let mut assembled: Vec<Vec<u8>> = Vec::with_capacity(fetched.len());
+    for res in fetched {
+        let (buf, is_deleted) = res?;
+        // A peer reports the needle deleted (a cross-server window where the
+        // local index still shows it live): treat as not-found rather than
+        // serving zeros, mirroring Go's ErrorDeleted.
+        if is_deleted {
+            return Ok(None);
+        }
+        assembled.push(buf);
+    }
 
     // Phase D — assemble and parse the Needle. Mirrors the tail of
     // `EcVolume::read_ec_shard_needle`.
@@ -267,271 +251,7 @@ pub async fn read_ec_shard_needle_or_miss(
         snapshot.version,
     )
     .map_err(|e| io::Error::new(io::ErrorKind::InvalidData, format!("{}", e)))?;
-    Ok(Ok(n))
-}
-
-/// `None` when any holder reported the needle deleted. That outranks another
-/// interval's error: deletes are never invented, so the needle is gone either way.
-fn gather_intervals(fetched: Vec<io::Result<(Vec<u8>, bool)>>) -> io::Result<Option<Vec<Vec<u8>>>> {
-    if fetched.iter().any(|r| matches!(r, Ok((_, true)))) {
-        return Ok(None);
-    }
-    fetched
-        .into_iter()
-        .map(|r| r.map(|(buf, _)| buf))
-        .collect::<io::Result<_>>()
-        .map(Some)
-}
-
-/// What one EC delete RPC carries — `VolumeEcBlobDeleteRequest` minus tonic.
-struct EcDeleteTarget<'a> {
-    vid: VolumeId,
-    collection: &'a str,
-    version: Version,
-    needle_id: NeedleId,
-}
-
-/// `Store.doDeleteNeedleFromAtLeastOneRemoteEcShards` in Go: journal the
-/// tombstone on one holder of the needle's primary data shard, falling back
-/// to any other shard holder when the primary has none. Exactly one node
-/// journals — replicas of a shard hold identical .ecx copies, so journaling
-/// on more than one would double the reported delete count.
-///
-/// `NotFound` means the volume or needle is gone; other errors mean every
-/// reachable holder failed or no shard has a holder at all.
-pub async fn delete_ec_shard_needle_distributed(
-    state: &Arc<VolumeServerState>,
-    vid: VolumeId,
-    needle_id: NeedleId,
-) -> io::Result<()> {
-    let (
-        primary_shard_id,
-        collection,
-        version,
-        total_shards,
-        local_shards,
-        data_shards,
-        encode_ts_ns,
-        refreshed_at,
-        cached_locations,
-    ) = {
-        let store = state.store.read().unwrap();
-        let ecv = store.find_ec_volume(vid).ok_or_else(|| {
-            io::Error::new(
-                io::ErrorKind::NotFound,
-                format!("ec volume {} not mounted", vid.0),
-            )
-        })?;
-        let (_, _, intervals) = ecv.locate_needle(needle_id)?.ok_or_else(|| {
-            io::Error::new(
-                io::ErrorKind::NotFound,
-                format!("needle {} not in ec volume {}", needle_id, vid.0),
-            )
-        })?;
-        let (shard_id, _) = intervals
-            .first()
-            .map(|i| ecv.interval_to_shard_id_and_offset(i))
-            .ok_or_else(|| io::Error::new(io::ErrorKind::NotFound, "no intervals for needle"))?;
-        let (cached_locations, refreshed_at) = ecv.shard_locations_snapshot();
-        (
-            shard_id,
-            ecv.collection.clone(),
-            ecv.version,
-            ecv.data_shards + ecv.parity_shards,
-            local_shard_ids(ecv),
-            ecv.data_shards as usize,
-            ecv.encode_ts_ns,
-            refreshed_at,
-            cached_locations,
-        )
-    };
-    let target = EcDeleteTarget {
-        vid,
-        collection: &collection,
-        version,
-        needle_id,
-    };
-
-    // Holder addresses come from the same staleness-gated cache as the read
-    // path: a master LookupEcVolume only when due, merged on a complete reply.
-    let mut locations = cached_locations;
-    if claim_shard_locations_refresh(
-        state,
-        vid,
-        &locations,
-        refreshed_at,
-        data_shards,
-        total_shards as usize,
-    ) {
-        match cached_lookup_ec_shard_locations(state, vid).await {
-            Ok(fresh) => {
-                match write_back_shard_locations(state, vid, fresh, data_shards, encode_ts_ns) {
-                    Some(merged) => locations = merged,
-                    None => mark_shard_locations_stale(state, vid),
-                }
-            }
-            Err(_) => mark_shard_locations_stale(state, vid),
-        }
-    }
-
-    match delete_on_ec_shard_holders(state, &locations, &local_shards, primary_shard_id, &target)
-        .await
-    {
-        Ok(true) => return Ok(()),
-        Err(e) => return Err(e),
-        Ok(false) => {}
-    }
-
-    for shard_id in 0..total_shards {
-        let Ok(shard_id) = shard_id_try_from(shard_id) else {
-            continue;
-        };
-        if shard_id == primary_shard_id {
-            continue;
-        }
-        if let Ok(true) =
-            delete_on_ec_shard_holders(state, &locations, &local_shards, shard_id, &target).await
-        {
-            return Ok(());
-        }
-    }
-
-    Err(io::Error::other(format!(
-        "ec volume {}: no shard holder could journal the delete",
-        vid.0
-    )))
-}
-
-/// `doDeleteNeedleFromRemoteEcShardServers` in Go. `Ok(false)` is the
-/// shard-missing signal — no live holder anywhere — that triggers the
-/// caller's fallback walk over the remaining shards.
-async fn delete_on_ec_shard_holders(
-    state: &Arc<VolumeServerState>,
-    locations: &HashMap<ShardId, Vec<String>>,
-    local_shards: &HashSet<ShardId>,
-    shard_id: ShardId,
-    target: &EcDeleteTarget<'_>,
-) -> io::Result<bool> {
-    let addrs = locations.get(&shard_id);
-    if !local_shards.contains(&shard_id) && addrs.is_none_or(|a| a.is_empty()) {
-        return Ok(false);
-    }
-
-    let mut last_err = None;
-    if local_shards.contains(&shard_id) {
-        // A decode in its publishing tail must not miss this delete. The
-        // tail membership is verified again under the store write lock
-        // inside journal_delete_local — WouldBlock means the decode claimed
-        // it in the gap after this wait — so wait and retry.
-        loop {
-            crate::server::grpc_server::wait_ec_decode_tail(state, target.vid).await;
-            match journal_delete_local(state, target.vid, target.needle_id) {
-                Ok(()) => return Ok(true),
-                Err(e) if e.kind() == io::ErrorKind::WouldBlock => continue,
-                // Nothing was committed — the volume unmounted or remounted
-                // without the needle — so it is safe to fall back to other
-                // shard holders, unlike an RPC failure which may have landed.
-                Err(e) if e.kind() == io::ErrorKind::NotFound => return Ok(false),
-                Err(e) => {
-                    last_err = Some(e);
-                    break;
-                }
-            }
-        }
-    }
-    if let Some(addrs) = addrs {
-        let self_http = to_http_address(&state.self_url);
-        for addr in addrs {
-            // A stale self entry: the loopback RPC would journal on this same
-            // volume, which the local attempt above already covered.
-            if to_http_address(addr).as_ref() == self_http.as_ref() {
-                continue;
-            }
-            match delete_on_remote_ec_shard(state, addr, target).await {
-                Ok(()) => return Ok(true),
-                Err(e) => last_err = Some(e),
-            }
-        }
-    }
-    match last_err {
-        Some(e) => Err(e),
-        None => Ok(false),
-    }
-}
-
-/// `doDeleteNeedleFromRemoteEcShard` in Go — one `VolumeEcBlobDelete` RPC.
-async fn delete_on_remote_ec_shard(
-    state: &Arc<VolumeServerState>,
-    addr: &str,
-    target: &EcDeleteTarget<'_>,
-) -> io::Result<()> {
-    let grpc_addr =
-        parse_grpc_address(addr).map_err(|e| io::Error::new(io::ErrorKind::InvalidInput, e))?;
-    let channel = connect_channel(
-        &grpc_addr,
-        state.outgoing_grpc_tls.as_ref(),
-        GrpcDialOptions::unary(),
-    )
-    .await
-    .map_err(|e| io::Error::other(format!("connect to {}: {}", addr, e)))?;
-    let mut client = volume_server_client(channel);
-    client
-        .volume_ec_blob_delete(Request::new(VolumeEcBlobDeleteRequest {
-            volume_id: target.vid.0,
-            collection: target.collection.to_string(),
-            file_key: target.needle_id.0,
-            version: target.version.0 as u32,
-        }))
-        .await
-        .map_err(|e| io::Error::other(format!("volume_ec_blob_delete on {}: {}", addr, e)))?;
-    Ok(())
-}
-
-/// Journals on the local volume — what the `VolumeEcBlobDelete` handler runs
-/// when this server is the shard holder. An absent needle is an error, not a
-/// no-op: `journal_delete` would accept it silently, but here it means the
-/// volume remounted as a different generation mid-delete and the tombstone
-/// should go to a replica that still has the needle.
-fn journal_delete_local(
-    state: &Arc<VolumeServerState>,
-    vid: VolumeId,
-    needle_id: NeedleId,
-) -> io::Result<()> {
-    let mut store = state.store.write().unwrap();
-    // Membership is read under the write lock: a decode can claim the
-    // publishing tail while this call waited for the decoder's read lock,
-    // so a check taken earlier would be stale by commit time.
-    if crate::server::grpc_server::ec_decode_tail_contains(state, vid) {
-        return Err(io::Error::new(
-            io::ErrorKind::WouldBlock,
-            format!("ec volume {} is in decode publishing tail", vid.0),
-        ));
-    }
-    let ecv = store.find_ec_volume_mut(vid).ok_or_else(|| {
-        io::Error::new(
-            io::ErrorKind::NotFound,
-            format!("ec volume {} unmounted", vid.0),
-        )
-    })?;
-    match ecv.find_needle_from_ecx(needle_id)? {
-        None => {
-            return Err(io::Error::new(
-                io::ErrorKind::NotFound,
-                format!("needle {} not in local ecx", needle_id),
-            ));
-        }
-        Some((_, size)) if size.is_deleted() => return Ok(()),
-        Some(_) => {}
-    }
-    ecv.journal_delete(needle_id)
-}
-
-fn local_shard_ids(ecv: &crate::storage::erasure_coding::EcVolume) -> HashSet<ShardId> {
-    ecv.shards
-        .iter()
-        .enumerate()
-        .filter_map(|(i, s)| s.as_ref().map(|_| i as ShardId))
-        .collect()
+    Ok(Some(n))
 }
 
 /// FULL EC scrub: verify every needle's bytes across local AND remote shards,
@@ -604,9 +324,9 @@ pub async fn scrub_ec_volume_distributed(
         // mounted volume's encode_ts_ns no longer matches, abort like a
         // mid-scan unmount rather than mixing generations.
         let encode_ts_ns = ecv.encode_ts_ns;
-        // One read section, so the map and the refresh time it is aged against
-        // describe the same lookup.
-        let (cached_locations, cache_refreshed_at) = ecv.shard_locations_snapshot();
+        // Bind to locals so the inner RwLock/Mutex guards drop before the block ends.
+        let cached_locations = ecv.shard_locations.read().unwrap().clone();
+        let cache_refreshed_at = *ecv.shard_locations_refresh_time.lock().unwrap();
         let data_shards = ecv.data_shards as usize;
         let total_shards = (ecv.data_shards + ecv.parity_shards) as usize;
         (
@@ -708,7 +428,7 @@ pub async fn scrub_ec_volume_distributed(
                 );
             }
         };
-        ecv.shard_locations_snapshot().0
+        ecv.shard_locations.read().unwrap().clone()
     };
 
     // Walk the .ecx (private fd captured under the lock, no lock held) for the
@@ -912,10 +632,11 @@ fn snapshot_under_lock(
     state: &Arc<VolumeServerState>,
     vid: VolumeId,
     needle_id: NeedleId,
-) -> io::Result<Result<Snapshot, EcMiss>> {
+) -> io::Result<Option<Snapshot>> {
     let store = state.store.read().unwrap();
-    let Some(ecv) = store.find_ec_volume(vid) else {
-        return Ok(Err(EcMiss::VolumeNotFound));
+    let ecv = match store.find_ec_volume(vid) {
+        Some(v) => v,
+        None => return Ok(None),
     };
 
     // Reuse EcVolume::locate_needle for offset/size resolution AND
@@ -923,17 +644,11 @@ fn snapshot_under_lock(
     // local-only read path uses, so we stay byte-identical on the
     // shard-size + interval boundaries. locate_needle applies the runtime
     // delete mask, which is correct for serving reads.
-    let Some((offset, size, intervals)) = ecv.locate_needle(needle_id)? else {
-        // locate_needle folds a tombstone into not-found.
-        let deleted =
-            matches!(ecv.find_needle_from_ecx(needle_id)?, Some((_, s)) if s.is_deleted());
-        return Ok(Err(if deleted {
-            EcMiss::Deleted
-        } else {
-            EcMiss::NotFound
-        }));
+    let (offset, size, intervals) = match ecv.locate_needle(needle_id)? {
+        Some(v) => v,
+        None => return Ok(None),
     };
-    build_snapshot(ecv, offset, size, &intervals).map(Ok)
+    build_snapshot(ecv, offset, size, &intervals).map(Some)
 }
 
 /// Like `snapshot_under_lock`, but locates intervals from the RAW .ecx
@@ -1058,7 +773,8 @@ fn build_snapshot(
     }
     let actual = get_actual_size(size, ecv.version);
     let interval_results = read_local_intervals(ecv, intervals);
-    let (cached_locations, cache_refreshed_at) = ecv.shard_locations_snapshot();
+    let cached_locations = ecv.shard_locations.read().unwrap().clone();
+    let cache_refreshed_at = *ecv.shard_locations_refresh_time.lock().unwrap();
 
     Ok(Snapshot {
         data_shards: ecv.data_shards,
@@ -1110,14 +826,14 @@ fn needs_refresh(
 fn mark_shard_locations_stale(state: &Arc<VolumeServerState>, vid: VolumeId) {
     let store = state.store.read().unwrap();
     if let Some(ecv) = store.find_ec_volume(vid) {
-        ecv.mark_shard_locations_stale();
+        *ecv.shard_locations_stale.lock().unwrap() = true;
     }
 }
 
-/// Decide whether the caller's snapshot is due a master lookup and, when it is,
-/// consume the cache's stale mark in the same critical section. A mark raised
-/// from here on belongs to the next refresh: the read that raised it has
-/// disproved the map this lookup is about to install.
+/// Decide whether the cached map is due a master lookup and, when it is, consume
+/// its stale mark in the same critical section. A mark raised from here on
+/// belongs to the next refresh: the read that raised it has disproved the map
+/// this lookup is about to install.
 fn claim_shard_locations_refresh(
     state: &Arc<VolumeServerState>,
     vid: VolumeId,
@@ -1130,9 +846,12 @@ fn claim_shard_locations_refresh(
     let Some(ecv) = store.find_ec_volume(vid) else {
         return needs_refresh(locations, refreshed_at, false, data_shards, total_shards);
     };
-    ecv.claim_shard_locations_refresh(|stale| {
-        needs_refresh(locations, refreshed_at, stale, data_shards, total_shards)
-    })
+    let mut stale = ecv.shard_locations_stale.lock().unwrap();
+    let refresh = needs_refresh(locations, refreshed_at, *stale, data_shards, total_shards);
+    if refresh {
+        *stale = false;
+    }
+    refresh
 }
 
 async fn cached_lookup_ec_shard_locations(
@@ -1153,15 +872,18 @@ async fn cached_lookup_ec_shard_locations(
 
     let grpc_addr =
         parse_grpc_address(&master).map_err(|e| io::Error::new(io::ErrorKind::InvalidInput, e))?;
-    let channel = connect_channel(
-        &grpc_addr,
-        state.outgoing_grpc_tls.as_ref(),
-        GrpcDialOptions::unary(),
-    )
-    .await
-    .map_err(|e| io::Error::other(format!("master connect: {}", e)))?;
+    let endpoint = build_grpc_endpoint(&grpc_addr, state.outgoing_grpc_tls.as_ref())
+        .map_err(|e| io::Error::other(e.to_string()))?;
+    let channel = endpoint
+        .connect_timeout(Duration::from_secs(5))
+        .timeout(Duration::from_secs(10))
+        .connect()
+        .await
+        .map_err(|e| io::Error::other(format!("master connect: {}", e)))?;
 
-    let mut client = master_client(channel);
+    let mut client = SeaweedClient::with_interceptor(channel, outgoing_request_id_interceptor)
+        .max_decoding_message_size(GRPC_MAX_MESSAGE_SIZE)
+        .max_encoding_message_size(GRPC_MAX_MESSAGE_SIZE);
 
     let resp = client
         .lookup_ec_volume(Request::new(LookupEcVolumeRequest { volume_id: vid.0 }))
@@ -1342,13 +1064,14 @@ async fn do_read_remote_ec_shard_interval(
     } = iv;
     let grpc_addr =
         parse_grpc_address(source).map_err(|e| io::Error::new(io::ErrorKind::InvalidInput, e))?;
-    let channel = connect_channel(
-        &grpc_addr,
-        state.outgoing_grpc_tls.as_ref(),
-        GrpcDialOptions::long(),
-    )
-    .await
-    .map_err(|e| io::Error::other(format!("connect to {}: {}", source, e)))?;
+    let endpoint = build_grpc_endpoint(&grpc_addr, state.outgoing_grpc_tls.as_ref())
+        .map_err(|e| io::Error::other(e.to_string()))?;
+    let channel = endpoint
+        .connect_timeout(Duration::from_secs(5))
+        .timeout(Duration::from_secs(30))
+        .connect()
+        .await
+        .map_err(|e| io::Error::other(format!("connect to {}: {}", source, e)))?;
 
     // TODO(grpc-jwt): clusters with `jwt.signing.key` configured will
     // reject peer-to-peer VolumeEcShardRead calls until the Rust
@@ -1358,7 +1081,9 @@ async fn do_read_remote_ec_shard_interval(
     // here in isolation would split the credential plumbing across
     // call sites. Re-visit when outgoing JWT signing lands as a
     // server-wide helper.
-    let mut client = volume_server_client(channel);
+    let mut client = VolumeServerClient::with_interceptor(channel, outgoing_request_id_interceptor)
+        .max_decoding_message_size(GRPC_MAX_MESSAGE_SIZE)
+        .max_encoding_message_size(GRPC_MAX_MESSAGE_SIZE);
 
     let req = VolumeEcShardReadRequest {
         volume_id: vid.0,
@@ -1746,14 +1471,16 @@ async fn fetch_ec_index_from_one_peer(
 ) -> io::Result<()> {
     let grpc_addr =
         parse_grpc_address(peer).map_err(|e| io::Error::new(io::ErrorKind::InvalidInput, e))?;
-    let channel = connect_channel(
-        &grpc_addr,
-        state.outgoing_grpc_tls.as_ref(),
-        GrpcDialOptions::long(),
-    )
-    .await
-    .map_err(|e| io::Error::other(format!("connect {}: {}", peer, e)))?;
-    let mut client = volume_server_client(channel);
+    let channel = build_grpc_endpoint(&grpc_addr, state.outgoing_grpc_tls.as_ref())
+        .map_err(|e| io::Error::other(e.to_string()))?
+        .connect_timeout(Duration::from_secs(5))
+        .timeout(Duration::from_secs(30))
+        .connect()
+        .await
+        .map_err(|e| io::Error::other(format!("connect {}: {}", peer, e)))?;
+    let mut client = VolumeServerClient::with_interceptor(channel, outgoing_request_id_interceptor)
+        .max_decoding_message_size(GRPC_MAX_MESSAGE_SIZE)
+        .max_encoding_message_size(GRPC_MAX_MESSAGE_SIZE);
 
     let copy_req = |ext: &str, ignore_not_found: bool| CopyFileRequest {
         volume_id: m.vid.0,
@@ -1773,7 +1500,7 @@ async fn fetch_ec_index_from_one_peer(
         .await
         .map_err(|e| io::Error::other(format!("copy .ecx: {}", e)))?
         .into_inner();
-    drain_copy_stream(stream, ecx_path).await?;
+    drain_copy_stream(stream, ecx_path, false).await?;
 
     let meta =
         fs::metadata(ecx_path).map_err(|e| io::Error::other(format!("stat copied .ecx: {}", e)))?;
@@ -1786,30 +1513,15 @@ async fn fetch_ec_index_from_one_peer(
         )));
     }
 
-    // .ecj is the source peer's deletion journal; .vif carries EC params. Both
-    // are best-effort: a missing .ecj is recreated at mount and a missing .vif
-    // falls back to default EC parameters. The journal is a *set*: merge the
-    // peer's ids into any local ones as a union instead of appending, so
-    // a volume bounced between servers cannot double its journal. The merge
-    // only appends whole records, so a failure leaves nothing to clean up.
+    // .ecj is the source peer's deletion journal (appended); .vif carries EC
+    // params. Both are best-effort: a missing .ecj is recreated at mount and a
+    // missing .vif falls back to default EC parameters. A failed .ecj append
+    // leaves a partial file, so drop it.
     match client.copy_file(copy_req(".ecj", true)).await {
         Ok(resp) => {
-            let mut stream = resp.into_inner();
-            let merged = match crate::server::grpc_server::receive_ecj_ids(&mut stream).await {
-                Ok((ids, true)) => crate::server::grpc_server::merge_ecj_ids(
-                    state,
-                    m.vid,
-                    m.data_dir.clone(),
-                    ecj_path.to_string(),
-                    ids,
-                )
-                .await
-                .map(|_| ()),
-                Ok((_, false)) => Ok(()),
-                Err(e) => Err(e),
-            };
-            if let Err(e) = merged {
+            if let Err(e) = drain_copy_stream(resp.into_inner(), ecj_path, true).await {
                 tracing::warn!(volume_id = m.vid.0, peer = %peer, "copy .ecj: {}", e);
+                let _ = fs::remove_file(ecj_path);
             }
         }
         Err(e) => tracing::warn!(volume_id = m.vid.0, peer = %peer, "copy .ecj: {}", e),
@@ -1817,7 +1529,7 @@ async fn fetch_ec_index_from_one_peer(
 
     match client.copy_file(copy_req(".vif", true)).await {
         Ok(resp) => {
-            if let Err(e) = drain_copy_stream(resp.into_inner(), vif_path).await {
+            if let Err(e) = drain_copy_stream(resp.into_inner(), vif_path, false).await {
                 tracing::warn!(volume_id = m.vid.0, peer = %peer, "copy .vif: {}", e);
             }
         }
@@ -1827,14 +1539,22 @@ async fn fetch_ec_index_from_one_peer(
     Ok(())
 }
 
-/// Drain a CopyFile stream into a local file, truncating it first.
+/// Drain a CopyFile stream into a local file, appending or truncating.
 async fn drain_copy_stream(
     mut stream: tonic::Streaming<crate::pb::volume_server_pb::CopyFileResponse>,
     dest_path: &str,
+    append: bool,
 ) -> io::Result<()> {
     use std::io::Write;
-    let mut file = fs::File::create(dest_path)
-        .map_err(|e| io::Error::other(format!("create {}: {}", dest_path, e)))?;
+    let mut file = if append {
+        fs::OpenOptions::new()
+            .create(true)
+            .append(true)
+            .open(dest_path)
+    } else {
+        fs::File::create(dest_path)
+    }
+    .map_err(|e| io::Error::other(format!("create {}: {}", dest_path, e)))?;
     while let Some(chunk) = stream
         .message()
         .await
@@ -1850,21 +1570,6 @@ async fn drain_copy_stream(
 mod tests {
     use super::*;
 
-    #[test]
-    fn gather_intervals_puts_a_reported_deletion_ahead_of_errors() {
-        let failed = || Err(io::Error::other("shard unreachable"));
-        assert!(
-            gather_intervals(vec![failed(), Ok((Vec::new(), true))])
-                .unwrap()
-                .is_none()
-        );
-        assert!(gather_intervals(vec![failed(), Ok((vec![1], false))]).is_err());
-        assert_eq!(
-            gather_intervals(vec![Ok((vec![1], false)), Ok((vec![2], false))]).unwrap(),
-            Some(vec![vec![1], vec![2]])
-        );
-    }
-
     fn locations(count: usize) -> HashMap<ShardId, Vec<String>> {
         (0..count)
             .map(|sid| (sid as ShardId, vec!["127.0.0.1:8080".to_string()]))

seaweed-volume/src/server/ui.rs

@@ -1,6 +1,5 @@
 use std::fmt::Write as _;
 
-use crate::server::absolute_display_path;
 use crate::server::server_stats;
 use crate::server::volume_server::VolumeServerState;
 use crate::storage::store::Store;
@@ -400,7 +399,7 @@ fn collect_ui_data(
                 file_count: volume.file_count(),
                 delete_count: volume.deleted_count(),
                 deleted_byte_count: volume.deleted_size(),
-                ttl: volume.super_block().ttl.to_string(),
+                ttl: volume.super_block.ttl.to_string(),
                 read_only: volume.is_read_only(),
                 version: volume.version().0 as u32,
                 remote_storage_name,
@@ -451,6 +450,16 @@ fn collect_ui_data(
     (disk_rows, volumes, remote_volumes, ec_volumes)
 }
 
+fn absolute_display_path(path: &str) -> String {
+    let p = std::path::Path::new(path);
+    if p.is_absolute() {
+        return path.to_string();
+    }
+    std::env::current_dir()
+        .map(|cwd| cwd.join(p).to_string_lossy().to_string())
+        .unwrap_or_else(|_| path.to_string())
+}
+
 fn join_i64(values: &[i64]) -> String {
     values
         .iter()

seaweed-volume/src/server/volume_server.rs

@@ -63,12 +63,6 @@ pub struct VolumeServerState {
     pub file_size_limit_bytes: i64,
     /// Default IO rate limit for maintenance copy/replication work.
     pub maintenance_byte_per_second: i64,
-    /// Bounds concurrent vacuum commits; None means unlimited. Queued commits
-    /// wait on the semaphore, not on the store lock, so reads keep flowing.
-    /// Mirrors Go's `vacuumCommitSlots`.
-    pub vacuum_commit_slots: Option<tokio::sync::Semaphore>,
-    /// Vacuum commits currently waiting for a slot.
-    pub vacuum_commits_waiting: AtomicU32,
     /// Whether the server is connected to master (heartbeat active).
     pub is_heartbeating: AtomicBool,
     /// Whether master addresses are configured.
@@ -77,10 +71,10 @@ pub struct VolumeServerState {
     pub pre_stop_seconds: u32,
     /// Notify heartbeat to send an immediate update when volume state changes.
     pub volume_state_notify: tokio::sync::Notify,
-    /// Per-volume write workers that group-commit durable (fsync) uploads.
-    /// Set once at startup in production; a test state may leave it unset,
-    /// which sends every write down the synchronous path.
+    /// Optional batched write queue for improved throughput under load.
     pub write_queue: std::sync::OnceLock<WriteQueue>,
+    /// Registry of S3 tier backends for tiered storage operations.
+    pub s3_tier_registry: std::sync::RwLock<crate::remote_storage::s3_tier::S3TierRegistry>,
     /// Read mode: local, proxy, or redirect for non-local volumes.
     pub read_mode: ReadMode,
     /// If true, FetchAndWriteNeedle skips remote S3 endpoint validation,
@@ -122,21 +116,6 @@ pub struct VolumeServerState {
     pub cli_white_list: Vec<String>,
     /// Path to state.pb file for persisting VolumeServerState across restarts.
     pub state_file_path: String,
-    /// Volumes with an EC decode in flight. A dropped request leaves the
-    /// blocking job running; this keeps a retry from racing it on the
-    /// same volume files.
-    pub ec_decodes_in_flight:
-        std::sync::Mutex<std::collections::HashSet<crate::storage::types::VolumeId>>,
-    /// Volumes whose EC decode is in its publishing tail (journal catch-up,
-    /// .idx write, compaction). Local .ecj appenders wait on
-    /// `ec_decode_tail_notify` while their vid is listed, so no committed
-    /// delete falls between the last catch_up and the .cpd/.cpx swap —
-    /// the per-volume slice of Go's EcVolume.ecjFileAccessLock.
-    pub ec_decode_tail:
-        std::sync::Mutex<std::collections::HashSet<crate::storage::types::VolumeId>>,
-    /// Wakes .ecj appenders waiting on `ec_decode_tail` when a decode's
-    /// publishing tail ends.
-    pub ec_decode_tail_notify: tokio::sync::Notify,
 }
 
 impl VolumeServerState {
@@ -152,40 +131,6 @@ impl VolumeServerState {
         Ok(())
     }
 
-    /// Wait for a vacuum commit slot without touching the store lock; the wait
-    /// counts against the caller's `grpc-timeout`. An already-expired deadline
-    /// is refused even when a slot is free, matching Go's post-acquire
-    /// `ctx.Err()` check in `acquireVacuumCommitSlot`.
-    pub async fn acquire_vacuum_commit_slot(
-        &self,
-        deadline: Option<tokio::time::Instant>,
-    ) -> Result<Option<tokio::sync::SemaphorePermit<'_>>, tonic::Status> {
-        let Some(slots) = &self.vacuum_commit_slots else {
-            return Ok(None);
-        };
-        self.vacuum_commits_waiting.fetch_add(1, Ordering::Relaxed);
-        let acquired = match deadline {
-            Some(d) => match tokio::time::timeout_at(d, slots.acquire()).await {
-                Ok(permit) => permit.map_err(|e| tonic::Status::internal(e.to_string())),
-                Err(_) => Err(tonic::Status::deadline_exceeded(
-                    "timed out waiting for a vacuum commit slot",
-                )),
-            },
-            None => slots
-                .acquire()
-                .await
-                .map_err(|e| tonic::Status::internal(e.to_string())),
-        };
-        self.vacuum_commits_waiting.fetch_sub(1, Ordering::Relaxed);
-        let permit = acquired?;
-        if deadline.is_some_and(|d| tokio::time::Instant::now() >= d) {
-            return Err(tonic::Status::deadline_exceeded(
-                "timed out waiting for a vacuum commit slot",
-            ));
-        }
-        Ok(Some(permit))
-    }
-
     /// Build the seed master set from a list of raw `host:port[.grpcPort]`
     /// addresses, normalised the same way Go's `pb.ServerAddress.ToHttpAddress`
     /// does (drop the `.grpcPort` suffix, preserve everything else).

seaweed-volume/src/server/write_queue.rs

@@ -1,19 +1,14 @@
 //! Async batched write processing for the volume server.
 //!
-//! Durable (fsync) uploads are submitted here instead of each handler calling
-//! `write_needle` directly — Go's `writeNeedle2` makes the same split, so the
-//! queue is always constructed. Each volume gets its own FIFO worker (Go's
-//! volume_write.go keeps one batching worker per volume), which drains its
-//! channel in batches of up to 128 entries or 4 MiB and shares the .dat/.idx
-//! flushes across durable writes (see `Volume::write_needles_grouped`).
-//! Writes to different volumes proceed in parallel; a volume's ordering and
-//! exclusion still come from its data-file write lease.
+//! Instead of each upload handler directly calling `write_needle`, writes are
+//! submitted to a queue. A background worker drains the queue in batches (up to
+//! 128 entries), groups them by volume ID, and processes them together under a
+//! single store lock. Requests that asked for `fsync` are flushed by
+//! `write_needle` itself, one flush per durable write.
 
-use std::collections::HashMap;
-use std::collections::hash_map::Entry;
-use std::sync::{Arc, Mutex};
+use std::sync::Arc;
 
-use tokio::sync::{OwnedSemaphorePermit, Semaphore, mpsc, oneshot};
+use tokio::sync::{mpsc, oneshot};
 use tracing::debug;
 
 use crate::storage::needle::needle::Needle;
@@ -34,10 +29,6 @@ pub struct WriteRequest {
     pub needle: Needle,
     pub fsync: bool,
     pub response_tx: oneshot::Sender<WriteResult>,
-    /// The global queued-slot permit, owned by the request itself: a caller
-    /// that cancels `submit` after the send must not free the slot while the
-    /// worker still holds the needle.
-    pub queue_permit: Option<OwnedSemaphorePermit>,
 }
 
 /// Maximum number of write requests to batch together.
@@ -47,218 +38,101 @@ const MAX_BATCH_SIZE: usize = 128;
 /// This prevents large writes from accumulating unbounded latency.
 const MAX_BATCH_BYTES: usize = 4 * 1024 * 1024;
 
-/// Cap on volumes doing grouped I/O at once, so many writers cannot crowd
-/// readers off a slow disk the way unlimited parallel fsyncs would.
-const MAX_CONCURRENT_VOLUME_WRITES: usize = 8;
-
-/// How often an idle worker re-checks that its volume is still mounted.
-/// Workers live for their volume's queue lifetime (Go parity), so the only
-/// retirement is the volume leaving the store.
-const IDLE_WORKER_POLL: std::time::Duration = std::time::Duration::from_secs(60);
-
-/// Handle for submitting write requests to the per-volume workers.
+/// Handle for submitting write requests to the background worker.
 #[derive(Clone)]
 pub struct WriteQueue {
-    state: Arc<VolumeServerState>,
-    /// Per-volume channel capacity; backpressure kicks in when full.
-    capacity: usize,
-    io_permits: Arc<Semaphore>,
-    /// Bounds queued+in-flight writes across all volumes — per-volume channels
-    /// alone would multiply the old single queue's capacity by volume count.
-    queue_permits: Arc<Semaphore>,
-    workers: Arc<Mutex<HashMap<VolumeId, mpsc::Sender<WriteRequest>>>>,
-    /// Submissions accepted, for tests asserting which writes route here.
-    #[cfg(test)]
-    submits: Arc<std::sync::atomic::AtomicU64>,
+    tx: mpsc::Sender<WriteRequest>,
 }
 
 impl WriteQueue {
-    /// Create a new write queue. Per-volume workers are spawned lazily on the
-    /// first submission for that volume.
+    /// Create a new write queue and spawn the background worker.
+    ///
+    /// `capacity` controls the channel buffer size (backpressure kicks in when full).
+    /// The worker holds a reference to `state` for accessing the store.
     pub fn new(state: Arc<VolumeServerState>, capacity: usize) -> Self {
-        WriteQueue {
-            state,
-            capacity,
-            io_permits: Arc::new(Semaphore::new(MAX_CONCURRENT_VOLUME_WRITES)),
-            queue_permits: Arc::new(Semaphore::new(capacity)),
-            workers: Arc::new(Mutex::new(HashMap::new())),
-            #[cfg(test)]
-            submits: Arc::new(std::sync::atomic::AtomicU64::new(0)),
-        }
-    }
-
-    /// How many writes were submitted, for tests asserting upload routing.
-    #[cfg(test)]
-    pub fn submits_for_test(&self) -> u64 {
-        self.submits.load(std::sync::atomic::Ordering::Relaxed)
-    }
-
-    /// Sender for the volume's worker, spawning one on first use.
-    fn worker_for(&self, volume_id: VolumeId) -> mpsc::Sender<WriteRequest> {
-        let mut workers = self.workers.lock().unwrap();
-        match workers.entry(volume_id) {
-            Entry::Occupied(e) => e.get().clone(),
-            Entry::Vacant(e) => {
-                let (tx, rx) = mpsc::channel(self.capacity);
-                tokio::spawn(
-                    VolumeWriteWorker {
-                        rx,
-                        vid: volume_id,
-                        state: self.state.clone(),
-                        io_permits: self.io_permits.clone(),
-                        workers: self.workers.clone(),
-                    }
-                    .run(),
-                );
-                e.insert(tx.clone());
-                tx
-            }
-        }
+        let (tx, rx) = mpsc::channel(capacity);
+        let worker = WriteQueueWorker { rx, state };
+        tokio::spawn(worker.run());
+        WriteQueue { tx }
     }
 
     /// Submit a write request and wait for the result.
     ///
     /// Returns `Err` if the worker has shut down or the response channel was dropped.
     pub async fn submit(&self, volume_id: VolumeId, needle: Needle, fsync: bool) -> WriteResult {
-        // Workers spawn only for mounted volumes — a bogus id never creates
-        // a channel, so volume-id sprays can't grow the worker map.
-        #[cfg(test)]
-        self.submits
-            .fetch_add(1, std::sync::atomic::Ordering::Relaxed);
-        {
-            let store = self.state.store.read().unwrap();
-            if store.find_volume(volume_id).is_none() {
-                return Err(VolumeError::NotFound);
-            }
-        }
-        // The permit travels inside the request, so the global queued bound
-        // covers the request until the worker drops it — including after a
-        // canceled submit.
-        let queue_permit = self
-            .queue_permits
-            .clone()
-            .acquire_owned()
-            .await
-            .map_err(|_| broken_pipe("write queue shut down"))?;
         let (response_tx, response_rx) = oneshot::channel();
-        let mut request = WriteRequest {
+        let request = WriteRequest {
             volume_id,
             needle,
             fsync,
             response_tx,
-            queue_permit: Some(queue_permit),
         };
 
-        // A send fails only against a retiring worker's closed channel; the
-        // request was never accepted, so retrying it behind a fresh worker
-        // keeps same-volume order. The volume recheck bounds the spin.
-        loop {
-            let tx = self.worker_for(volume_id);
-            match tx.send(request).await {
-                Ok(()) => break,
-                Err(mpsc::error::SendError(returned)) => {
-                    request = returned;
-                    {
-                        let store = self.state.store.read().unwrap();
-                        if store.find_volume(volume_id).is_none() {
-                            return Err(VolumeError::NotFound);
-                        }
-                    }
-                    tokio::task::yield_now().await;
-                }
-            }
+        // Send to queue; this awaits if the channel is full (backpressure).
+        if self.tx.send(request).await.is_err() {
+            return Err(VolumeError::Io(std::io::Error::new(
+                std::io::ErrorKind::BrokenPipe,
+                "write queue worker has shut down",
+            )));
         }
 
         // Wait for the worker to process our request.
         match response_rx.await {
             Ok(result) => result,
-            Err(_) => Err(broken_pipe("write queue worker dropped response channel")),
+            Err(_) => Err(VolumeError::Io(std::io::Error::new(
+                std::io::ErrorKind::BrokenPipe,
+                "write queue worker dropped response channel",
+            ))),
         }
     }
 }
 
-fn broken_pipe(msg: &'static str) -> VolumeError {
-    VolumeError::Io(std::io::Error::new(std::io::ErrorKind::BrokenPipe, msg))
-}
-
-/// FIFO worker draining one volume's write channel in batches. Like Go's
-/// per-volume async writer it runs for the volume's queue lifetime — exiting
-/// only when the channel closes or its volume leaves the store — so no
-/// handoff can ever split one volume's write order across two workers.
-struct VolumeWriteWorker {
+/// Background worker that drains write requests and processes them in batches.
+struct WriteQueueWorker {
     rx: mpsc::Receiver<WriteRequest>,
-    vid: VolumeId,
     state: Arc<VolumeServerState>,
-    io_permits: Arc<Semaphore>,
-    workers: Arc<Mutex<HashMap<VolumeId, mpsc::Sender<WriteRequest>>>>,
 }
 
-impl VolumeWriteWorker {
+impl WriteQueueWorker {
     async fn run(mut self) {
+        debug!("write queue worker started");
+
         loop {
-            let first = match tokio::time::timeout(IDLE_WORKER_POLL, self.rx.recv()).await {
-                Ok(Some(req)) => req,
-                // recv() yields None only once every sender is gone — the map
-                // holds a sender per volume, so that is exactly queue shutdown.
-                Ok(None) => return,
-                Err(_) if self.volume_gone() => {
-                    self.retire().await;
+            // Wait for the first request (blocks until one arrives or channel closes).
+            let first = match self.rx.recv().await {
+                Some(req) => req,
+                None => {
+                    debug!("write queue channel closed, worker exiting");
                     return;
                 }
-                Err(_) => continue,
             };
-            self.process_from(first).await;
-        }
-    }
 
-    /// The volume's handle left the store, so the worker can go too; an idle
-    /// worker for a mounted volume stays (Go keeps the writer for the mount).
-    fn volume_gone(&self) -> bool {
-        let store = self.state.store.read().unwrap();
-        store.find_volume(self.vid).is_none()
-    }
+            // Drain as many additional requests as available, up to MAX_BATCH_SIZE
+            // or MAX_BATCH_BYTES (matches Go: 128 requests or 4MB, whichever comes first).
+            let mut batch = Vec::with_capacity(MAX_BATCH_SIZE);
+            let mut batch_bytes: usize = first.needle.data.len();
+            batch.push(first);
 
-    /// Retire in a fixed order that keeps same-volume FIFO: close the channel
-    /// so racing senders fail fast (they retry and wait for a fresh worker),
-    /// drain what was already accepted, and only then give up the map slot —
-    /// a replacement worker can never start while this one still holds queued
-    /// writes.
-    async fn retire(&mut self) {
-        self.rx.close();
-        while let Some(first) = self.rx.recv().await {
-            self.process_from(first).await;
-        }
-        self.workers.lock().unwrap().remove(&self.vid);
-    }
-
-    /// Collect a batch around `first` and process it under the I/O bound.
-    async fn process_from(&mut self, first: WriteRequest) {
-        // Drain as many additional requests as available, up to MAX_BATCH_SIZE
-        // or MAX_BATCH_BYTES (matches Go: 128 requests or 4MB, whichever comes first).
-        let mut batch = Vec::with_capacity(MAX_BATCH_SIZE);
-        let mut batch_bytes: usize = first.needle.data.len();
-        batch.push(first);
-        while batch.len() < MAX_BATCH_SIZE && batch_bytes < MAX_BATCH_BYTES {
-            match self.rx.try_recv() {
-                Ok(req) => {
-                    batch_bytes += req.needle.data.len();
-                    batch.push(req);
+            while batch.len() < MAX_BATCH_SIZE && batch_bytes < MAX_BATCH_BYTES {
+                match self.rx.try_recv() {
+                    Ok(req) => {
+                        batch_bytes += req.needle.data.len();
+                        batch.push(req);
+                    }
+                    Err(_) => break,
                 }
-                Err(_) => break,
             }
-        }
-        debug!("processing write batch of {} requests", batch.len());
 
-        // Bound the number of volumes doing grouped I/O at once, then run
-        // the batch in spawn_blocking since write_needle does file I/O.
-        let Ok(_permit) = self.io_permits.clone().acquire_owned().await else {
-            return;
-        };
-        let state = self.state.clone();
-        let _ = tokio::task::spawn_blocking(move || {
-            process_batch(state, batch);
-        })
-        .await;
+            let batch_size = batch.len();
+            debug!("processing write batch of {} requests", batch_size);
+
+            // Process the batch in spawn_blocking since write_needle does file I/O.
+            let state = self.state.clone();
+            let _ = tokio::task::spawn_blocking(move || {
+                process_batch(state, batch);
+            })
+            .await;
+        }
     }
 }
 
@@ -281,29 +155,12 @@ fn process_batch(state: Arc<VolumeServerState>, batch: Vec<WriteRequest>) {
         }
     }
 
-    // Resolve each group's volume handle under a brief store read, then run
-    // the group's I/O with the guard released — one volume's write must not
-    // block admission on another volume's.
+    // Process each volume group under a single store lock.
+    let mut store = state.store.write().unwrap();
+
     for (vid, entries) in groups {
-        let (mut writes, senders): (Vec<_>, Vec<_>) = entries
-            .into_iter()
-            .map(|(needle, fsync, response_tx)| ((needle, fsync), response_tx))
-            .unzip();
-        let vol = {
-            let store = state.store.read().unwrap();
-            store.writable_volume(vid)
-        };
-        let results = match vol {
-            Ok(vol) => vol.write_needles_grouped(&mut writes),
-            Err(e) => writes
-                .iter()
-                .map(|_| match e {
-                    VolumeError::ReadOnly(vid) => Err(VolumeError::ReadOnly(vid)),
-                    _ => Err(VolumeError::NotFound),
-                })
-                .collect(),
-        };
-        for (response_tx, result) in senders.into_iter().zip(results) {
+        for (mut needle, fsync, response_tx) in entries {
+            let result = store.write_volume_needle(vid, &mut needle, fsync);
             // Send result back; ignore error if receiver dropped.
             let _ = response_tx.send(result);
         }
@@ -345,13 +202,14 @@ mod tests {
             rack: String::new(),
             file_size_limit_bytes: 0,
             maintenance_byte_per_second: 0,
-            vacuum_commit_slots: None,
-            vacuum_commits_waiting: std::sync::atomic::AtomicU32::new(0),
             is_heartbeating: AtomicBool::new(false),
             has_master: false,
             pre_stop_seconds: 0,
             volume_state_notify: tokio::sync::Notify::new(),
             write_queue: std::sync::OnceLock::new(),
+            s3_tier_registry: std::sync::RwLock::new(
+                crate::remote_storage::s3_tier::S3TierRegistry::new(),
+            ),
             read_mode: crate::config::ReadMode::Local,
             allow_untrusted_remote_endpoints: false,
             master_url: String::new(),
@@ -370,9 +228,6 @@ mod tests {
             security_file: String::new(),
             cli_white_list: vec![],
             state_file_path: String::new(),
-            ec_decodes_in_flight: std::sync::Mutex::new(std::collections::HashSet::new()),
-            ec_decode_tail: std::sync::Mutex::new(std::collections::HashSet::new()),
-            ec_decode_tail_notify: tokio::sync::Notify::new(),
         })
     }
 
@@ -460,64 +315,6 @@ mod tests {
         }
     }
 
-    /// The queue hands a volume's batch to the grouped path, so ten durable
-    /// writes cost one .dat sync and one .idx sync, not ten of each.
-    #[test]
-    fn test_process_batch_group_commits_fsync_writes() {
-        use crate::config::MinFreeSpace;
-        use crate::storage::types::{DiskType, NeedleId};
-        use crate::storage::volume::VolumeSpec;
-
-        let tmp = tempfile::TempDir::new().unwrap();
-        let dir = tmp.path().to_str().unwrap();
-        let state = make_test_state();
-        {
-            let mut store = state.store.write().unwrap();
-            store
-                .add_location(
-                    dir,
-                    dir,
-                    10,
-                    DiskType::HardDrive,
-                    MinFreeSpace::Percent(1.0),
-                    Vec::new(),
-                )
-                .unwrap();
-            store
-                .add_volume(VolumeId(1), DiskType::HardDrive, &VolumeSpec::default())
-                .unwrap();
-        }
-
-        let mut receivers = Vec::new();
-        let batch = (1..=10u64)
-            .map(|id| {
-                let (response_tx, response_rx) = oneshot::channel();
-                receivers.push(response_rx);
-                WriteRequest {
-                    volume_id: VolumeId(1),
-                    needle: Needle {
-                        id: NeedleId(id),
-                        cookie: 0x1111.into(),
-                        data: vec![id as u8; 8],
-                        data_size: 8,
-                        ..Needle::default()
-                    },
-                    fsync: true,
-                    response_tx,
-                    queue_permit: None,
-                }
-            })
-            .collect();
-        process_batch(state.clone(), batch);
-
-        for mut rx in receivers {
-            assert!(matches!(rx.try_recv().unwrap(), Ok((_, _, false))));
-        }
-        let store = state.store.read().unwrap();
-        let (_, vol) = store.find_volume(VolumeId(1)).unwrap();
-        assert_eq!(vol.sync_counts_for_test(), (1, 1));
-    }
-
     #[tokio::test]
     async fn test_write_queue_dropped_sender() {
         // When the queue is dropped, subsequent submits should fail gracefully.
@@ -539,199 +336,4 @@ mod tests {
         let result = queue2.submit(VolumeId(1), needle, false).await;
         assert!(result.is_err()); // NotFound is fine -- the point is it doesn't panic
     }
-
-    /// Issue #791: a write parked inside its .dat append must not hold the
-    /// store guard, so another volume still resolves and writes. The hook
-    /// runs under the volume's data-file lease, so the assertion is that the
-    /// store — not the per-volume serialization — stays open.
-    #[test]
-    fn test_process_batch_does_not_block_other_volumes() {
-        use crate::config::MinFreeSpace;
-        use crate::storage::types::{DiskType, NeedleId};
-        use crate::storage::volume::{VolumeSpec, needle_write_hook};
-        use std::sync::Barrier;
-
-        let tmp = tempfile::TempDir::new().unwrap();
-        let dir = tmp.path().to_str().unwrap();
-        let state = make_test_state();
-        {
-            let mut store = state.store.write().unwrap();
-            store
-                .add_location(
-                    dir,
-                    dir,
-                    10,
-                    DiskType::HardDrive,
-                    MinFreeSpace::Percent(1.0),
-                    Vec::new(),
-                )
-                .unwrap();
-            for vid in [VolumeId(1), VolumeId(2)] {
-                store
-                    .add_volume(vid, DiskType::HardDrive, &VolumeSpec::default())
-                    .unwrap();
-            }
-        }
-
-        let in_append = Arc::new(Barrier::new(2));
-        let release = Arc::new(Barrier::new(2));
-        let _reg = needle_write_hook::register(NeedleId(101), {
-            let in_append = in_append.clone();
-            let release = release.clone();
-            move |_| {
-                in_append.wait();
-                release.wait();
-            }
-        });
-
-        let (response_tx, mut response_rx) = oneshot::channel();
-        let batch = vec![WriteRequest {
-            volume_id: VolumeId(1),
-            needle: Needle {
-                id: NeedleId(101),
-                cookie: 0x1111.into(),
-                data: vec![7u8; 8],
-                data_size: 8,
-                ..Needle::default()
-            },
-            fsync: false,
-            response_tx,
-            queue_permit: None,
-        }];
-        let writer = {
-            let state = state.clone();
-            std::thread::spawn(move || process_batch(state, batch))
-        };
-
-        in_append.wait(); // volume 1's write is inside its .dat append.
-
-        // The store still admits a lifecycle writer and a volume-2 write.
-        drop(state.store.try_write().unwrap());
-        let vol2 = state
-            .store
-            .read()
-            .unwrap()
-            .writable_volume(VolumeId(2))
-            .unwrap();
-        let mut n2 = Needle {
-            id: NeedleId(9),
-            cookie: 0x2222.into(),
-            data: vec![9u8; 8],
-            data_size: 8,
-            ..Needle::default()
-        };
-        vol2.write_needle(&mut n2, true, false).unwrap();
-
-        // Same-volume exclusion is intact: volume 1's data-file lease is held.
-        let (_, vol1) = state.store.read().unwrap().find_volume(VolumeId(1)).unwrap();
-        assert!(vol1.instance().try_write_lock().is_none());
-
-        release.wait();
-        writer.join().unwrap();
-        assert!(response_rx.try_recv().unwrap().is_ok());
-        assert!(vol1.instance().try_write_lock().is_some());
-    }
-
-    /// A write parked inside volume 1's .dat append must not keep later
-    /// batches for other volumes queued behind it: each volume drains through
-    /// its own FIFO worker, while same-volume writes still serialize.
-    /// NeedleId(102) is reserved for this test — hooks are keyed by needle id
-    /// process-wide and parallel tests must not share one.
-    #[tokio::test]
-    async fn test_write_queue_does_not_block_other_volumes() {
-        use crate::config::MinFreeSpace;
-        use crate::storage::types::{DiskType, NeedleId};
-        use crate::storage::volume::{VolumeSpec, needle_write_hook};
-        use std::sync::Barrier;
-
-        let tmp = tempfile::TempDir::new().unwrap();
-        let dir = tmp.path().to_str().unwrap();
-        let state = make_test_state();
-        {
-            let mut store = state.store.write().unwrap();
-            store
-                .add_location(
-                    dir,
-                    dir,
-                    10,
-                    DiskType::HardDrive,
-                    MinFreeSpace::Percent(1.0),
-                    Vec::new(),
-                )
-                .unwrap();
-            for vid in [VolumeId(1), VolumeId(2)] {
-                store
-                    .add_volume(vid, DiskType::HardDrive, &VolumeSpec::default())
-                    .unwrap();
-            }
-        }
-        let queue = WriteQueue::new(state, MAX_BATCH_SIZE);
-
-        let in_append = Arc::new(Barrier::new(2));
-        let release = Arc::new(Barrier::new(2));
-        let _reg = needle_write_hook::register(NeedleId(102), {
-            let in_append = in_append.clone();
-            let release = release.clone();
-            move |_| {
-                in_append.wait();
-                release.wait();
-            }
-        });
-
-        let needle_a = Needle {
-            id: NeedleId(102),
-            cookie: 0x1111.into(),
-            data: vec![7u8; 8],
-            data_size: 8,
-            ..Needle::default()
-        };
-        let a1 = tokio::spawn({
-            let queue = queue.clone();
-            async move { queue.submit(VolumeId(1), needle_a, false).await }
-        });
-        // The hook parks on a blocking thread, so wait on the barrier off the
-        // runtime worker.
-        let parked = {
-            let in_append = in_append.clone();
-            tokio::task::spawn_blocking(move || in_append.wait())
-        };
-        parked.await.unwrap(); // volume 1's write is inside its .dat append.
-
-        // Volume 2's worker is independent: its submit completes now.
-        let needle_b = Needle {
-            id: NeedleId(9),
-            cookie: 0x2222.into(),
-            data: vec![9u8; 8],
-            data_size: 8,
-            ..Needle::default()
-        };
-        queue.submit(VolumeId(2), needle_b, true).await.unwrap();
-
-        // Same-volume FIFO is preserved: a second volume-1 write stays queued.
-        let needle_a2 = Needle {
-            id: NeedleId(2),
-            cookie: 0x3333.into(),
-            data: vec![8u8; 8],
-            data_size: 8,
-            ..Needle::default()
-        };
-        let mut a2 = tokio::spawn({
-            let queue = queue.clone();
-            async move { queue.submit(VolumeId(1), needle_a2, false).await }
-        });
-        assert!(
-            tokio::time::timeout(std::time::Duration::from_millis(200), &mut a2)
-                .await
-                .is_err(),
-            "a same-volume write must queue behind the stalled one"
-        );
-
-        let released = {
-            let release = release.clone();
-            tokio::task::spawn_blocking(move || release.wait())
-        };
-        released.await.unwrap();
-        assert!(a1.await.unwrap().is_ok());
-        assert!(a2.await.unwrap().is_ok());
-    }
 }

seaweed-volume/src/storage/disk_location.rs

@@ -18,9 +18,7 @@ use crate::storage::erasure_coding::ec_shard::{
     DATA_SHARDS_COUNT, ERASURE_CODING_LARGE_BLOCK_SIZE, ERASURE_CODING_SMALL_BLOCK_SIZE,
     EcVolumeShard, ShardId,
 };
-use crate::storage::erasure_coding::ec_volume::{
-    ECJ_COMPACT_TMP_EXT, EcVolume, is_usable_ecx_file,
-};
+use crate::storage::erasure_coding::ec_volume::EcVolume;
 use crate::storage::needle_map::NeedleMapKind;
 use crate::storage::super_block::SUPER_BLOCK_SIZE;
 use crate::storage::types::*;
@@ -37,7 +35,7 @@ pub struct DiskLocation {
     pub tags: Vec<String>,
     pub max_volume_count: AtomicI32,
     pub original_max_volume_count: i32,
-    volumes: HashMap<VolumeId, Arc<Volume>>,
+    volumes: HashMap<VolumeId, Volume>,
     ec_volumes: HashMap<VolumeId, EcVolume>,
     pub is_disk_space_low: Arc<AtomicBool>,
     pub available_space: AtomicU64,
@@ -237,7 +235,6 @@ impl DiskLocation {
         }
 
         for (collection, vid, v) in self.open_volumes(to_load, needle_map_kind) {
-            let v = Arc::new(v);
             crate::metrics::VOLUME_GAUGE
                 .with_label_values(&[&collection, "volume"])
                 .inc();
@@ -463,16 +460,13 @@ impl DiskLocation {
         let idx_base = volume_file_name(&self.idx_directory, collection, vid);
         const MAX_SHARD_COUNT: usize = 32;
 
-        // Remove index files from idx directory (.ecx, .ecj, and a compaction
-        // tmp a crash may have left beside the .ecj)
+        // Remove index files from idx directory (.ecx, .ecj)
         rm_if_present(format!("{}.ecx", idx_base))?;
         rm_if_present(format!("{}.ecj", idx_base))?;
-        rm_if_present(format!("{}{}", idx_base, ECJ_COMPACT_TMP_EXT))?;
         // Also try data directory in case .ecx/.ecj were created before -dir.idx was configured
         if self.idx_directory != self.directory {
             rm_if_present(format!("{}.ecx", base))?;
             rm_if_present(format!("{}.ecj", base))?;
-            rm_if_present(format!("{}{}", base, ECJ_COMPACT_TMP_EXT))?;
         }
 
         // Remove all EC shard files (.ec00 ~ .ec31)
@@ -485,13 +479,6 @@ impl DiskLocation {
         if self.idx_directory != self.directory {
             remove_bitrot_sidecars(&idx_base)?;
         }
-
-        // Staged 2PC generations (<base>.ecNN.v<N>, versioned .ecx/.ecj/.vif)
-        // belong to this volume's EC state too; leaving them orphans the files.
-        crate::storage::erasure_coding::ec_shard::remove_ec_generation_files(&base, 0)?;
-        if self.idx_directory != self.directory {
-            crate::storage::erasure_coding::ec_shard::remove_ec_generation_files(&idx_base, 0)?;
-        }
         Ok(())
     }
 
@@ -550,23 +537,20 @@ impl DiskLocation {
         None
     }
 
-    /// Find a volume by ID. Returns a shared handle like Go's findVolume:
-    /// the lookup borrows the map briefly and I/O runs on the handle after.
-    pub fn find_volume(&self, vid: VolumeId) -> Option<Arc<Volume>> {
-        self.volumes.get(&vid).cloned()
+    /// Find a volume by ID.
+    pub fn find_volume(&self, vid: VolumeId) -> Option<&Volume> {
+        self.volumes.get(&vid)
+    }
+
+    /// Find a volume by ID (mutable).
+    pub fn find_volume_mut(&mut self, vid: VolumeId) -> Option<&mut Volume> {
+        self.volumes.get_mut(&vid)
     }
 
     /// Add a volume to this location.
     pub fn set_volume(&mut self, vid: VolumeId, volume: Volume) {
         let collection = volume.collection.clone();
-        if let Some(old) = self.volumes.insert(vid, Arc::new(volume)) {
-            // A held handle would keep writing the same files against a stale
-            // in-memory index; close it so the stale handle fails closed.
-            crate::metrics::VOLUME_GAUGE
-                .with_label_values(&[&old.collection, "volume"])
-                .dec();
-            old.close();
-        }
+        self.volumes.insert(vid, volume);
         crate::metrics::VOLUME_GAUGE
             .with_label_values(&[&collection, "volume"])
             .inc();
@@ -590,20 +574,13 @@ impl DiskLocation {
         crate::metrics::VOLUME_GAUGE
             .with_label_values(&[spec.collection, "volume"])
             .inc();
-        if let Some(old) = self.volumes.insert(vid, Arc::new(v)) {
-            // Same fail-closed rule as set_volume: a stale handle must not
-            // keep writing the files the replacement just reopened.
-            crate::metrics::VOLUME_GAUGE
-                .with_label_values(&[&old.collection, "volume"])
-                .dec();
-            old.close();
-        }
+        self.volumes.insert(vid, v);
         Ok(())
     }
 
     /// Remove and close a volume.
-    pub fn unload_volume(&mut self, vid: VolumeId) -> Option<Arc<Volume>> {
-        if let Some(v) = self.volumes.remove(&vid) {
+    pub fn unload_volume(&mut self, vid: VolumeId) -> Option<Volume> {
+        if let Some(mut v) = self.volumes.remove(&vid) {
             crate::metrics::VOLUME_GAUGE
                 .with_label_values(&[&v.collection, "volume"])
                 .dec();
@@ -621,30 +598,14 @@ impl DiskLocation {
         &mut self,
         vid: VolumeId,
         only_empty: bool,
-        only_garbage: bool,
         keep_remote_data: bool,
     ) -> Result<(), VolumeError> {
-        // Refuse before removing: a refused destroy must leave it mounted.
-        if let Some(v) = self.volumes.get(&vid)
-            && v.is_compacting()
-        {
-            return Err(v.compacting_error());
-        }
-        if let Some(v) = self.volumes.remove(&vid) {
-            match v.destroy(only_empty, only_garbage, keep_remote_data) {
-                Ok(()) => {
-                    crate::metrics::VOLUME_GAUGE
-                        .with_label_values(&[&v.collection, "volume"])
-                        .dec();
-                    Ok(())
-                }
-                Err(e) => {
-                    // A failed destroy left the local files in place, so the
-                    // replica stays registered rather than becoming a phantom.
-                    self.volumes.insert(vid, v);
-                    Err(e)
-                }
-            }
+        if let Some(mut v) = self.volumes.remove(&vid) {
+            crate::metrics::VOLUME_GAUGE
+                .with_label_values(&[&v.collection, "volume"])
+                .dec();
+            v.destroy(only_empty, keep_remote_data)?;
+            Ok(())
         } else {
             Err(VolumeError::NotFound)
         }
@@ -660,14 +621,12 @@ impl DiskLocation {
             .collect();
 
         for vid in vids {
-            if let Some(v) = self.volumes.remove(&vid) {
-                if let Err(e) = v.destroy(false, false, false) {
+            if let Some(mut v) = self.volumes.remove(&vid) {
+                crate::metrics::VOLUME_GAUGE
+                    .with_label_values(&[&v.collection, "volume"])
+                    .dec();
+                if let Err(e) = v.destroy(false, false) {
                     warn!(volume_id = vid.0, error = %e, "delete collection: failed to destroy volume");
-                    self.volumes.insert(vid, v);
-                } else {
-                    crate::metrics::VOLUME_GAUGE
-                        .with_label_values(&[&v.collection, "volume"])
-                        .dec();
                 }
             }
         }
@@ -708,7 +667,7 @@ impl DiskLocation {
 
     /// Iterate over all volumes.
     pub fn iter_volumes(&self) -> impl Iterator<Item = (&VolumeId, &Volume)> {
-        self.volumes.iter().map(|(k, v)| (k, v.as_ref()))
+        self.volumes.iter()
     }
 
     /// Number of free volume slots.
@@ -729,7 +688,12 @@ impl DiskLocation {
 
     /// Iterate over all volumes.
     pub fn volumes(&self) -> impl Iterator<Item = (&VolumeId, &Volume)> {
-        self.volumes.iter().map(|(k, v)| (k, v.as_ref()))
+        self.volumes.iter()
+    }
+
+    /// Iterate over all volumes (mutable).
+    pub fn volumes_mut(&mut self) -> impl Iterator<Item = (&VolumeId, &mut Volume)> {
+        self.volumes.iter_mut()
     }
 
     /// Sum of unused space in writable volumes (volumeSizeLimit - actual size per volume).
@@ -815,17 +779,21 @@ impl DiskLocation {
     /// Mirrors `DiskLocation.HasEcxFileOnDisk` in
     /// `weed/storage/disk_location_ec.go`. Skips entries that are
     /// directories so a stray dir named `<collection>_<vid>.ecx` doesn't
-    /// register as a present index file. A 0-byte `.ecx` is a corrupt stub
-    /// left by a failed EC distribute copy; it must not steer placement
-    /// toward this disk, so it counts as absent (Go requires `Size() > 0`).
+    /// register as a present index file.
     pub fn has_ecx_file_on_disk(&self, collection: &str, vid: VolumeId) -> bool {
         let idx_base = volume_file_name(&self.idx_directory, collection, vid);
-        if is_usable_ecx_file(&format!("{}.ecx", idx_base)) {
+        let idx_path = format!("{}.ecx", idx_base);
+        if let Ok(meta) = fs::metadata(&idx_path)
+            && !meta.is_dir()
+        {
             return true;
         }
         if self.idx_directory != self.directory {
             let data_base = volume_file_name(&self.directory, collection, vid);
-            if is_usable_ecx_file(&format!("{}.ecx", data_base)) {
+            let data_path = format!("{}.ecx", data_base);
+            if let Ok(meta) = fs::metadata(&data_path)
+                && !meta.is_dir()
+            {
                 return true;
             }
         }
@@ -837,20 +805,6 @@ impl DiskLocation {
         self.ec_volumes.remove(&vid)
     }
 
-    /// Drop the in-memory EC volume for vid and close its descriptors without
-    /// deleting files, so a following unlink frees the inodes instead of
-    /// leaving open fds serving the old bytes. Mirrors Go's unloadEcVolume.
-    pub fn unload_ec_volume(&mut self, vid: VolumeId) {
-        if let Some(mut ec_vol) = self.ec_volumes.remove(&vid) {
-            for _ in 0..ec_vol.shard_count() {
-                crate::metrics::VOLUME_GAUGE
-                    .with_label_values(&[&ec_vol.collection, "ec_shards"])
-                    .dec();
-            }
-            ec_vol.close();
-        }
-    }
-
     /// Mount EC shards for a volume on this location.
     ///
     /// `source_disk_type` is the source volume's disk type carried on the
@@ -1179,20 +1133,15 @@ pub fn get_disk_stats(path: &str) -> (u64, u64) {
             Ok(p) => p,
             Err(_) => return (0, 0),
         };
-        // SAFETY: `libc::statvfs` is plain data — integers and reserved
-        // padding, no pointers and no restricted niches — so the all-zero
-        // value is a valid one for the call to overwrite.
-        let mut stat: libc::statvfs = unsafe { std::mem::zeroed() };
-        // SAFETY: `c_path` is a live NUL-terminated `CString` that outlives
-        // the call, and `&mut stat` is a live, aligned, exclusive pointer the
-        // kernel only writes through; the fields are read below only after
-        // the call reports success.
-        if unsafe { libc::statvfs(c_path.as_ptr(), &mut stat) } != 0 {
-            return (0, 0);
+        unsafe {
+            let mut stat: libc::statvfs = std::mem::zeroed();
+            if libc::statvfs(c_path.as_ptr(), &mut stat) == 0 {
+                let all = stat.f_blocks as u64 * stat.f_frsize as u64;
+                let free = stat.f_bavail as u64 * stat.f_frsize as u64;
+                return (all, free);
+            }
         }
-        let all = stat.f_blocks as u64 * stat.f_frsize as u64;
-        let free = stat.f_bavail as u64 * stat.f_frsize as u64;
-        (all, free)
+        (0, 0)
     }
     #[cfg(windows)]
     {
@@ -1783,7 +1732,7 @@ mod tests {
             .unwrap();
         assert_eq!(loc.volumes_len(), 2);
 
-        loc.delete_volume(VolumeId(1), false, false, false).unwrap();
+        loc.delete_volume(VolumeId(1), false, false).unwrap();
         assert_eq!(loc.volumes_len(), 1);
         assert!(loc.find_volume(VolumeId(1)).is_none());
     }
@@ -1836,34 +1785,6 @@ mod tests {
         assert!(loc.find_volume(VolumeId(3)).is_some());
     }
 
-    /// A 0-byte `.ecx` is the stub a failed EC distribute copy leaves behind.
-    /// Go's HasEcxFileOnDisk requires Size() > 0 so the stub cannot pin
-    /// placement to a disk that has no usable index.
-    #[test]
-    fn test_has_ecx_file_on_disk_ignores_zero_byte_stub() {
-        let tmp = TempDir::new().unwrap();
-        let data = tmp.path().join("data");
-        let idx = tmp.path().join("idx");
-        fs::create_dir_all(&data).unwrap();
-        fs::create_dir_all(&idx).unwrap();
-        let loc = DiskLocation::new(
-            data.to_str().unwrap(),
-            idx.to_str().unwrap(),
-            10,
-            DiskType::HardDrive,
-            MinFreeSpace::Percent(1.0),
-            Vec::new(),
-        )
-        .unwrap();
-
-        fs::write(idx.join("pics_7.ecx"), b"").unwrap();
-        assert!(!loc.has_ecx_file_on_disk("pics", VolumeId(7)));
-
-        // A real index in the data dir still counts, stub or no stub.
-        fs::write(data.join("pics_7.ecx"), [0u8; 16]).unwrap();
-        assert!(loc.has_ecx_file_on_disk("pics", VolumeId(7)));
-    }
-
     #[test]
     fn test_disk_location_delete_collection_removes_ec_volumes() {
         let tmp = TempDir::new().unwrap();
@@ -1880,8 +1801,6 @@ mod tests {
 
         let shard_path = format!("{}/pics_7.ec00", dir);
         std::fs::write(&shard_path, b"ec-shard").unwrap();
-        // An EC volume needs its .ecx to mount.
-        std::fs::write(format!("{}/pics_7.ecx", dir), [0u8; 16]).unwrap();
 
         loc.mount_ec_shards(VolumeId(7), "pics", &[0], "").unwrap();
         assert!(loc.has_ec_volume(VolumeId(7)));
@@ -1919,7 +1838,6 @@ mod tests {
         // mount_ec_shards with source_disk_type="ssd" — simulating the
         // VolumeEcShardsMount RPC path.
         std::fs::write(format!("{}/pics_7.ec00", dir), b"ec-shard").unwrap();
-        std::fs::write(format!("{}/pics_7.ecx", dir), [0u8; 16]).unwrap();
         loc.mount_ec_shards(VolumeId(7), "pics", &[0], "ssd")
             .unwrap();
         {
@@ -2019,7 +1937,6 @@ mod tests {
         // A collection name unique to this test: the gauge is process-global
         // and sibling tests running in parallel touch other labels.
         std::fs::write(format!("{}/dupmount_11.ec00", dir), b"shard bytes").unwrap();
-        std::fs::write(format!("{}/dupmount_11.ecx", dir), [0u8; 16]).unwrap();
         let gauge = crate::metrics::VOLUME_GAUGE.with_label_values(&["dupmount", "ec_shards"]);
         let before = gauge.get();
 

seaweed-volume/src/storage/erasure_coding/ec_decoder.rs

@@ -3,12 +3,10 @@
 //! Rebuilds the original .dat + .idx files from data shards (.ec00-.ec09)
 //! and the sorted index (.ecx) + deletion journal (.ecj).
 
-use std::collections::HashSet;
 use std::fs::File;
 use std::io::{self, Read, Write};
 
 use crate::storage::erasure_coding::ec_shard::*;
-use crate::storage::erasure_coding::ec_volume::read_ecj_ids;
 use crate::storage::idx;
 use crate::storage::needle::needle::get_actual_size;
 use crate::storage::super_block::SUPER_BLOCK_SIZE;
@@ -22,21 +20,18 @@ use crate::storage::volume::{fsync_dir, volume_file_name};
 /// `dir` is used both for reading `.ec00` and `.ecx`. For split-disk
 /// reconciled volumes call [`find_dat_file_size_with_dirs`] instead.
 pub fn find_dat_file_size(dir: &str, collection: &str, volume_id: VolumeId) -> io::Result<i64> {
-    let deleted = read_ecj_deletions(&[dir], collection, volume_id)?;
-    find_dat_file_size_with_dirs(dir, dir, collection, volume_id, &deleted)
+    find_dat_file_size_with_dirs(dir, dir, collection, volume_id)
 }
 
 /// Like [`find_dat_file_size`] but lets the caller pass separate dirs
 /// for `.ec00` (the data shard) and `.ecx` (the sealed index). This
 /// is the form needed when shards are split across data dirs and the
-/// `.ecx` lives on a sibling disk's idx dir (#9252). Needles in `deleted`
-/// count as deleted.
+/// `.ecx` lives on a sibling disk's idx dir (#9252).
 pub fn find_dat_file_size_with_dirs(
     ec00_dir: &str,
     ecx_dir: &str,
     collection: &str,
     volume_id: VolumeId,
-    deleted: &HashSet<NeedleId>,
 ) -> io::Result<i64> {
     let ec00_base = volume_file_name(ec00_dir, collection, volume_id);
     let ecx_base = volume_file_name(ecx_dir, collection, volume_id);
@@ -58,9 +53,9 @@ pub fn find_dat_file_size_with_dirs(
 
     for i in 0..entry_count {
         let start = i * NEEDLE_MAP_ENTRY_SIZE;
-        let (key, offset, size) =
+        let (_, offset, size) =
             idx_entry_from_bytes(&ecx_data[start..start + NEEDLE_MAP_ENTRY_SIZE]);
-        if size.is_deleted() || deleted.contains(&key) {
+        if size.is_deleted() {
             continue;
         }
         let entry_stop = offset.to_actual_offset() + get_actual_size(size, version);
@@ -72,124 +67,6 @@ pub fn find_dat_file_size_with_dirs(
     Ok(dat_size)
 }
 
-/// Whether the `.ecx` in `ecx_dir` indexes a needle deleted neither there nor
-/// in `deleted`.
-pub fn has_live_needles(
-    ecx_dir: &str,
-    collection: &str,
-    volume_id: VolumeId,
-    deleted: &HashSet<NeedleId>,
-) -> io::Result<bool> {
-    let ecx_base = volume_file_name(ecx_dir, collection, volume_id);
-    let ecx_data = std::fs::read(format!("{}.ecx", ecx_base))?;
-    let (entries, _) = ecx_data.as_chunks::<NEEDLE_MAP_ENTRY_SIZE>();
-    Ok(entries.iter().any(|entry| {
-        let (key, _, size) = idx_entry_from_bytes(entry);
-        !size.is_deleted() && !deleted.contains(&key)
-    }))
-}
-
-/// Distinct needle ids journaled in the `.ecj` of any of `dirs`. Go folds the
-/// journal into the `.ecx` (RebuildEcxFile) before a decode; reading it leaves
-/// the sealed index untouched. Only NotFound means "no journal".
-pub fn read_ecj_deletions(
-    dirs: &[&str],
-    collection: &str,
-    volume_id: VolumeId,
-) -> io::Result<HashSet<NeedleId>> {
-    Ok(EcjDeletions::read(dirs, collection, volume_id)?.ids)
-}
-
-/// The ids [`read_ecj_deletions`] returns, plus how far each journal was read
-/// so that ids journaled later can be added.
-pub struct EcjDeletions {
-    pub ids: HashSet<NeedleId>,
-    /// Each distinct journal path and the whole-record length read so far.
-    journals: Vec<(String, u64)>,
-}
-
-impl EcjDeletions {
-    pub fn read(dirs: &[&str], collection: &str, volume_id: VolumeId) -> io::Result<Self> {
-        let mut journals: Vec<(String, u64)> = Vec::new();
-        for dir in dirs {
-            let path = format!("{}.ecj", volume_file_name(dir, collection, volume_id));
-            if !journals.iter().any(|(p, _)| *p == path) {
-                journals.push((path, 0));
-            }
-        }
-        let mut deletions = EcjDeletions {
-            ids: HashSet::new(),
-            journals,
-        };
-        deletions.catch_up()?;
-        Ok(deletions)
-    }
-
-    /// Adds the ids appended to each journal since the last read. A journal
-    /// that shrank is read again from the start — and the whole set rebuilt,
-    /// since ids already folded in from the truncated tail may have been a
-    /// rolled-back append. Non-regular journals (the FIFOs the tests stand
-    /// in for a blocking disk) stat empty and cannot be rolled back, so they
-    /// never count as shrunk.
-    pub fn catch_up(&mut self) -> io::Result<()> {
-        let mut shrank = false;
-        for (path, read_to) in &self.journals {
-            if *read_to == 0 {
-                continue;
-            }
-            match std::fs::metadata(path) {
-                Ok(m) => {
-                    if m.is_file() && m.len() < *read_to {
-                        shrank = true;
-                        break;
-                    }
-                }
-                // A journal that was read before and is now gone shrank to
-                // nothing (e.g. the volume was destroyed mid-scan) — the ids
-                // read from it no longer reflect committed content.
-                Err(e) if e.kind() == io::ErrorKind::NotFound => {
-                    shrank = true;
-                    break;
-                }
-                Err(e) => return Err(e),
-            }
-        }
-        if shrank {
-            self.ids.clear();
-            for (_, read_to) in &mut self.journals {
-                *read_to = 0;
-            }
-        }
-        for (path, read_to) in &mut self.journals {
-            let file = match File::open(&*path) {
-                Ok(file) => file,
-                Err(e) if e.kind() == io::ErrorKind::NotFound => continue,
-                Err(e) => return Err(e),
-            };
-            let len = file.metadata()?.len();
-            if len < *read_to {
-                *read_to = 0;
-            }
-            read_ecj_ids(&file, *read_to, len, &mut self.ids)?;
-            *read_to = len - len % NEEDLE_ID_SIZE as u64;
-        }
-        Ok(())
-    }
-
-    /// Clears the set and re-reads every journal from the start. Run under
-    /// the caller's store read lock (no append in flight): the result is
-    /// then exactly the committed content — an earlier unlocked read may
-    /// have folded in bytes a rolled-back append later truncated, or missed
-    /// a record re-appended to the very offset a rollback freed.
-    pub fn rescan(&mut self) -> io::Result<()> {
-        self.ids.clear();
-        for (_, read_to) in &mut self.journals {
-            *read_to = 0;
-        }
-        self.catch_up()
-    }
-}
-
 /// What it takes to rebuild a volume's .dat from its EC data shards.
 ///
 /// Mirrors Go's `WriteDatFile(baseFileName, datFileSize,
@@ -388,87 +265,53 @@ pub fn write_dat_file_from_shards(spec: &DatRebuild<'_>) -> io::Result<()> {
     write_result
 }
 
-/// Fails when the decoded `.dat` in `dat_dir` is shorter than the
-/// `dat_file_size` bytes its EC index references: the caller deletes the
-/// shards next, and they are the only other copy of the needles past the cut.
-/// A longer file passes.
-pub fn verify_decoded_dat_file(
-    dat_dir: &str,
-    collection: &str,
-    volume_id: VolumeId,
-    dat_file_size: i64,
-) -> io::Result<()> {
-    let dat_path = format!("{}.dat", volume_file_name(dat_dir, collection, volume_id));
-    let size = std::fs::metadata(&dat_path)?.len();
-    if (size as i64) < dat_file_size {
-        return Err(io::Error::new(
-            io::ErrorKind::UnexpectedEof,
-            format!(
-                "decoded {} is {} bytes, short of the {} its ec index references",
-                dat_path, size, dat_file_size
-            ),
-        ));
-    }
-    Ok(())
-}
-
 /// Write .idx file from .ecx index + .ecj deletion journal.
 ///
-/// See [`write_idx_file_from_ec_index_with_dirs`]; everything lives in `dir`.
+/// Copies sorted .ecx entries to .idx, then appends tombstones for
+/// deleted needles from .ecj.
 pub fn write_idx_file_from_ec_index(
     dir: &str,
     collection: &str,
     volume_id: VolumeId,
 ) -> io::Result<()> {
-    let deleted = read_ecj_deletions(&[dir], collection, volume_id)?;
-    let dat_file_size = find_dat_file_size_with_dirs(dir, dir, collection, volume_id, &deleted)?;
-    write_idx_file_from_ec_index_with_dirs(dir, dir, collection, volume_id, &deleted, dat_file_size)
-}
-
-/// Write the `.idx` for a `.dat` decoded to `dat_file_size` bytes, from the
-/// `.ecx` in `ecx_dir`, into `idx_dir`.
-///
-/// Copies the `.ecx` rows, then appends one tombstone per row whose needle is
-/// in `deleted`. A deleted needle at or past `dat_file_size` was cut from the
-/// `.dat`, so its row is dropped: a row pointing past the end of the `.dat`
-/// makes the volume load read-only.
-pub fn write_idx_file_from_ec_index_with_dirs(
-    ecx_dir: &str,
-    idx_dir: &str,
-    collection: &str,
-    volume_id: VolumeId,
-    deleted: &HashSet<NeedleId>,
-    dat_file_size: i64,
-) -> io::Result<()> {
-    let ecx_path = format!("{}.ecx", volume_file_name(ecx_dir, collection, volume_id));
-    let idx_path = format!("{}.idx", volume_file_name(idx_dir, collection, volume_id));
+    let base = volume_file_name(dir, collection, volume_id);
+    let ecx_path = format!("{}.ecx", base);
+    let ecj_path = format!("{}.ecj", base);
+    let idx_path = format!("{}.idx", base);
     // Write to a temp file and atomically rename into place, so a crash
     // mid-write never leaves a partial .idx at the final name beside the
     // source shards.
     let tmp_path = format!("{}.tmp", idx_path);
 
     let write_result = (|| -> io::Result<()> {
-        let mut ecx_file = File::open(&ecx_path)?;
-        let mut idx_file = io::BufWriter::new(File::create(&tmp_path)?);
-        let mut tombstoned = Vec::new();
-        idx::walk_index_file(&mut ecx_file, 0, |key, offset, size| {
-            let is_deleted = size.is_deleted() || deleted.contains(&key);
-            if is_deleted && offset.to_actual_offset() >= dat_file_size {
-                return Ok(());
+        // Copy .ecx to the temp .idx
+        std::fs::copy(&ecx_path, &tmp_path)?;
+
+        // Append deletions from .ecj as tombstones. Read the journal directly
+        // and treat only NotFound as "no journal": Path::exists would also
+        // swallow a permission/IO error and silently skip deletions, which
+        // would resurrect deleted needles as live.
+        let mut idx_file = std::fs::OpenOptions::new().append(true).open(&tmp_path)?;
+        match std::fs::read(&ecj_path) {
+            Ok(ecj_data) => {
+                let count = ecj_data.len() / NEEDLE_ID_SIZE;
+                for i in 0..count {
+                    let start = i * NEEDLE_ID_SIZE;
+                    let needle_id = NeedleId::from_bytes(&ecj_data[start..start + NEEDLE_ID_SIZE]);
+                    idx::write_index_entry(
+                        &mut idx_file,
+                        needle_id,
+                        Offset::default(),
+                        TOMBSTONE_FILE_SIZE,
+                    )?;
+                }
             }
-            idx::write_index_entry(&mut idx_file, key, offset, size)?;
-            if !size.is_deleted() && deleted.contains(&key) {
-                tombstoned.push(key);
-            }
-            Ok(())
-        })?;
-        for key in tombstoned {
-            idx::write_index_entry(&mut idx_file, key, Offset::default(), TOMBSTONE_FILE_SIZE)?;
+            Err(e) if e.kind() == io::ErrorKind::NotFound => {}
+            Err(e) => return Err(e),
         }
 
         // fsync, rename, then fsync the dir so the decoded .idx is durable and
         // atomically published before the caller deletes the source shards.
-        let idx_file = idx_file.into_inner().map_err(|e| e.into_error())?;
         idx_file.sync_all()?;
         drop(idx_file);
         // Windows rename does not replace an existing file on every version;
@@ -502,7 +345,7 @@ mod tests {
         let dir = tmp.path().to_str().unwrap();
 
         // Create volume with data
-        let v = Volume::new(
+        let mut v = Volume::new(
             dir,
             dir,
             VolumeId(1),
@@ -851,116 +694,4 @@ mod tests {
             .is_err()
         );
     }
-
-    /// A journal many chunks long that repeats a few ids reads back as those
-    /// ids, from each dir once, whatever its length.
-    #[test]
-    fn test_read_ecj_deletions_collects_distinct_ids_across_dirs() {
-        let tmp = TempDir::new().unwrap();
-        let data = tmp.path().join("data");
-        let idx = tmp.path().join("idx");
-        let missing = tmp.path().join("missing");
-        std::fs::create_dir_all(&data).unwrap();
-        std::fs::create_dir_all(&idx).unwrap();
-        let (data, idx, missing) = (
-            data.to_str().unwrap(),
-            idx.to_str().unwrap(),
-            missing.to_str().unwrap(),
-        );
-
-        let entry = |id: u64| {
-            let mut buf = [0u8; NEEDLE_ID_SIZE];
-            NeedleId(id).to_bytes(&mut buf);
-            buf
-        };
-        // Past two load chunks of three repeating ids, then an id only in the
-        // last chunk and a torn trailing record.
-        let mut ecj = Vec::new();
-        while ecj.len() <= 2 * (1 << 20) {
-            for id in [1, 2, 3] {
-                ecj.extend_from_slice(&entry(id));
-            }
-        }
-        ecj.extend_from_slice(&entry(7));
-        ecj.extend_from_slice(&entry(8)[..3]);
-        std::fs::write(format!("{idx}/1.ecj"), &ecj).unwrap();
-        std::fs::write(format!("{data}/1.ecj"), entry(9)).unwrap();
-
-        let ids = read_ecj_deletions(&[data, idx, idx, missing], "", VolumeId(1)).unwrap();
-        let expected: HashSet<NeedleId> = [1, 2, 3, 7, 9].into_iter().map(NeedleId).collect();
-        assert_eq!(ids, expected);
-    }
-
-    #[test]
-    fn test_verify_decoded_dat_file_rejects_a_short_dat() {
-        let tmp = TempDir::new().unwrap();
-        let dir = tmp.path().to_str().unwrap();
-        let dat_path = format!("{dir}/1.dat");
-
-        let err = verify_decoded_dat_file(dir, "", VolumeId(1), 100).unwrap_err();
-        assert_eq!(err.kind(), io::ErrorKind::NotFound);
-
-        std::fs::write(&dat_path, vec![0u8; 99]).unwrap();
-        let err = verify_decoded_dat_file(dir, "", VolumeId(1), 100).unwrap_err();
-        assert!(err.to_string().contains("short of the 100"), "{err}");
-
-        std::fs::write(&dat_path, vec![0u8; 100]).unwrap();
-        verify_decoded_dat_file(dir, "", VolumeId(1), 100).unwrap();
-        std::fs::write(&dat_path, vec![0u8; 101]).unwrap();
-        verify_decoded_dat_file(dir, "", VolumeId(1), 100).unwrap();
-    }
-
-    /// Ids appended after the first read, including the rest of a record torn
-    /// at that point, are picked up; a journal that shrank is read again.
-    #[test]
-    fn test_ecj_deletions_catch_up_reads_appended_ids() {
-        let tmp = TempDir::new().unwrap();
-        let dir = tmp.path().to_str().unwrap();
-        let ecj_path = format!("{dir}/1.ecj");
-        let entry = |id: u64| {
-            let mut buf = [0u8; NEEDLE_ID_SIZE];
-            NeedleId(id).to_bytes(&mut buf);
-            buf
-        };
-        let append = |bytes: &[u8]| {
-            let mut f = std::fs::OpenOptions::new()
-                .create(true)
-                .append(true)
-                .open(&ecj_path)
-                .unwrap();
-            f.write_all(bytes).unwrap();
-        };
-        let ids = |d: &EcjDeletions| {
-            let mut ids: Vec<u64> = d.ids.iter().map(|id| id.0).collect();
-            ids.sort();
-            ids
-        };
-
-        // No journal yet.
-        let mut deletions = EcjDeletions::read(&[dir, dir], "", VolumeId(1)).unwrap();
-        assert!(deletions.ids.is_empty());
-
-        append(&entry(1));
-        append(&entry(2)[..3]);
-        deletions.catch_up().unwrap();
-        assert_eq!(ids(&deletions), [1]);
-
-        append(&entry(2)[3..]);
-        append(&entry(3));
-        deletions.catch_up().unwrap();
-        assert_eq!(ids(&deletions), [1, 2, 3]);
-
-        // A shrunk journal is rebuilt from its surviving content: ids folded
-        // in from the truncated tail may have been rolled back and must not
-        // linger as phantom tombstones.
-        std::fs::write(&ecj_path, entry(9)).unwrap();
-        deletions.catch_up().unwrap();
-        assert_eq!(ids(&deletions), [9]);
-
-        // A journal removed since it was read is the extreme shrink: its
-        // earlier ids must go with it, not linger.
-        std::fs::remove_file(&ecj_path).unwrap();
-        deletions.catch_up().unwrap();
-        assert!(deletions.ids.is_empty());
-    }
 }

seaweed-volume/src/storage/erasure_coding/ec_encoder.rs

@@ -813,7 +813,7 @@ impl EncodeRun<'_> {
         // explicitly.
         for (i, buf) in self.buffers[..self.data_shards].iter_mut().enumerate() {
             let read_offset = offset + (i * block_size) as u64;
-            let n = crate::storage::io::read_full_at(self.dat_file, buf, read_offset)?;
+            let n = read_at_most(self.dat_file, buf, read_offset)?;
             buf[n..].fill(0);
         }
 
@@ -834,6 +834,19 @@ impl EncodeRun<'_> {
     }
 }
 
+/// Read into `buf` at `offset` until it is full or EOF; returns bytes read.
+fn read_at_most(dat_file: &File, buf: &mut [u8], offset: u64) -> io::Result<usize> {
+    let mut n = 0;
+    while n < buf.len() {
+        let r = crate::storage::io::read_at(dat_file, &mut buf[n..], offset + n as u64)?;
+        if r == 0 {
+            break;
+        }
+        n += r;
+    }
+    Ok(n)
+}
+
 #[cfg(test)]
 mod tests {
     use super::*;
@@ -848,7 +861,7 @@ mod tests {
         let dir = tmp.path().to_str().unwrap();
 
         // Create a volume with some data
-        let v = Volume::new(
+        let mut v = Volume::new(
             dir,
             dir,
             VolumeId(1),
@@ -895,7 +908,7 @@ mod tests {
     fn make_volume_with_needles(n: u64) -> TempDir {
         let tmp = TempDir::new().unwrap();
         let dir = tmp.path().to_str().unwrap();
-        let v = Volume::new(
+        let mut v = Volume::new(
             dir,
             dir,
             VolumeId(1),
@@ -970,7 +983,7 @@ mod tests {
     // the dir path so a test can drop/truncate shards and rebuild.
     fn encode_sample_volume(tmp: &TempDir) -> String {
         let dir = tmp.path().to_str().unwrap().to_string();
-        let v = Volume::new(
+        let mut v = Volume::new(
             &dir,
             &dir,
             VolumeId(1),
@@ -1167,7 +1180,7 @@ mod tests {
         use crate::storage::volume::{Volume, VolumeSpec};
         let tmp = TempDir::new().unwrap();
         let dir = tmp.path().to_str().unwrap().to_string();
-        let v = Volume::new(
+        let mut v = Volume::new(
             &dir,
             &dir,
             VolumeId(2),
@@ -1216,7 +1229,7 @@ mod tests {
         use crate::storage::volume::{Volume, VolumeSpec};
         let tmp = TempDir::new().unwrap();
         let dir = tmp.path().to_str().unwrap().to_string();
-        let v = Volume::new(
+        let mut v = Volume::new(
             &dir,
             &dir,
             VolumeId(3),
@@ -1316,7 +1329,7 @@ mod tests {
         let idx_dir = idx_tmp.path().to_str().unwrap();
 
         // Create a volume with separate data and index directories
-        let v = Volume::new(
+        let mut v = Volume::new(
             dat_dir,
             idx_dir,
             VolumeId(1),
@@ -1396,7 +1409,7 @@ mod tests {
         let idx_dir = idx_tmp.path().to_str().unwrap();
         let wrong_dir = wrong_tmp.path().to_str().unwrap();
 
-        let v = Volume::new(
+        let mut v = Volume::new(
             dat_dir,
             idx_dir,
             VolumeId(1),
@@ -1430,7 +1443,7 @@ mod tests {
     /// a caller-chosen directory, which is what a split-disk test needs: the
     /// shards have to be scattered out of the directory they were encoded into.
     fn seed_encoded_volume(dir: &str, vid: VolumeId) {
-        let v = Volume::new(
+        let mut v = Volume::new(
             dir,
             dir,
             vid,

seaweed-volume/src/storage/erasure_coding/ec_shard.rs

@@ -87,14 +87,14 @@ impl EcVolumeShard {
         Ok(())
     }
 
-    /// Read data at a specific offset, filling `buf` unless the shard ends first.
+    /// Read data at a specific offset.
     pub fn read_at(&self, buf: &mut [u8], offset: u64) -> io::Result<usize> {
         let file = self
             .ecd_file
             .as_ref()
             .ok_or_else(|| io::Error::other("shard file not open"))?;
 
-        crate::storage::io::read_full_at(file, buf, offset)
+        crate::storage::io::read_at(file, buf, offset)
     }
 
     /// Write data to the shard file (appends).
@@ -195,104 +195,6 @@ impl ShardBits {
     }
 }
 
-/// Parses the generation of a 2PC-staged `<base>.v<N>` file: `None` means the
-/// name is not a generation file of `base`.
-pub fn ec_file_generation(name: &str, base: &str) -> Option<u32> {
-    let suffix = name.strip_prefix(&format!("{}.v", base))?;
-    match suffix.parse::<u32>() {
-        Ok(g) if g > 0 => Some(g),
-        _ => None,
-    }
-}
-
-/// Removes 2PC generation files staged under `base`:
-/// `<base>.ecNN.v<N>`, `<base>.ecx.v<N>`, `<base>.ecj.v<N>`, `<base>.ecsum.v<N>`
-/// and `<base>.vif.v<N>`. `generations_older_than == 0` removes every
-/// generation; otherwise only generations strictly below it. Returns the
-/// first real removal failure. Mirrors Go's `RemoveEcGenerationFiles`.
-pub fn remove_ec_generation_files(base: &str, generations_older_than: u32) -> io::Result<()> {
-    let path = std::path::Path::new(base);
-    let (Some(parent), Some(fname)) = (path.parent(), path.file_name()) else {
-        return Ok(());
-    };
-    let ec_prefix = format!("{}.ec", fname.to_string_lossy());
-    let vif_name = format!("{}.vif", fname.to_string_lossy());
-    let mut first_err: Option<io::Error> = None;
-    let mut record = |res: io::Result<()>| {
-        if let Err(e) = res
-            && first_err.is_none()
-        {
-            first_err = Some(e);
-        }
-    };
-    match fs::read_dir(parent) {
-        Ok(entries) => {
-            for entry in entries {
-                let entry = match entry {
-                    Ok(entry) => entry,
-                    Err(e) => {
-                        // A skipped entry means an incomplete sweep; report it
-                        // instead of pretending the cleanup finished.
-                        record(Err(e));
-                        continue;
-                    }
-                };
-                let name = entry.file_name().to_string_lossy().into_owned();
-                let Some((artifact, _)) = name.rsplit_once(".v") else {
-                    continue;
-                };
-                if artifact != vif_name && !artifact.starts_with(&ec_prefix) {
-                    continue;
-                }
-                let Some(generation) = ec_file_generation(&name, artifact) else {
-                    continue;
-                };
-                if generations_older_than > 0 && generation >= generations_older_than {
-                    continue;
-                }
-                record(match fs::remove_file(entry.path()) {
-                    Err(e) if e.kind() != io::ErrorKind::NotFound => Err(e),
-                    _ => Ok(()),
-                });
-            }
-        }
-        Err(e) if e.kind() != io::ErrorKind::NotFound => record(Err(e)),
-        Err(_) => {}
-    }
-    match first_err {
-        Some(e) => Err(e),
-        None => Ok(()),
-    }
-}
-
-/// Removes every staged generation `<shard_file>.v<N>` of one shard file.
-/// Returns true when at least one generation file was removed.
-pub fn remove_ec_shard_generations(shard_file: &str) -> io::Result<bool> {
-    let path = std::path::Path::new(shard_file);
-    let (Some(parent), Some(fname)) = (path.parent(), path.file_name()) else {
-        return Ok(false);
-    };
-    let fname = fname.to_string_lossy().into_owned();
-    let mut removed = false;
-    match fs::read_dir(parent) {
-        Ok(entries) => {
-            for entry in entries {
-                let entry = entry?;
-                let name = entry.file_name().to_string_lossy().into_owned();
-                if ec_file_generation(&name, &fname).is_some() {
-                    match fs::remove_file(entry.path()) {
-                        Err(e) if e.kind() != io::ErrorKind::NotFound => return Err(e),
-                        _ => removed = true,
-                    }
-                }
-            }
-        }
-        Err(e) if e.kind() != io::ErrorKind::NotFound => return Err(e),
-        Err(_) => {}
-    }
-    Ok(removed)
-}
-
 #[cfg(test)]
 mod tests {
     use super::*;

seaweed-volume/src/storage/erasure_coding/ecj_merge.rs

@@ -1,290 +0,0 @@
-//! Set-union merge of `.ecj` deletion journals for EC shard copy / index
-//! recovery. Mirrors Go's `weed/storage/erasure_coding/ecj_merge.go`.
-//!
-//! An EC volume's deletion journal (`<vid>.ecj`) is a *set* of deleted needle
-//! ids stored as 8-byte big-endian records. Shard copy and index recovery fold
-//! a peer's journal into the local one; they must append only the ids the
-//! local journal lacks, or every `ec_balance` round trip doubles the file.
-//!
-//! The journal is only ever appended to, never replaced: a mounted `EcVolume`
-//! holds it open, and a rename would leave that handle writing to an unlinked
-//! inode, losing every later delete at the next mount. A mounted volume merges
-//! through [`EcVolume::merge_journal`](super::ec_volume::EcVolume::merge_journal);
-//! [`append_ecj_ids`] is for a journal no volume has open.
-
-use std::collections::HashSet;
-use std::fs::{self, OpenOptions};
-use std::io::{self, Read, Seek, SeekFrom, Write};
-use std::path::Path;
-
-use crate::storage::types::{NEEDLE_ID_SIZE, NeedleId};
-use crate::storage::volume::fsync_dir;
-use crate::storage::volume_open::open_volume_file;
-
-/// Bytes per read when scanning a journal; a multiple of `NEEDLE_ID_SIZE`.
-const ECJ_READ_CHUNK_BYTES: usize = 1 << 20;
-
-/// Decodes `.ecj` records from a byte stream split at arbitrary boundaries (a
-/// CopyFile stream, chunked reads), collecting the distinct ids. Memory
-/// follows the number of distinct ids, not the journal's length. A trailing
-/// partial record is never decoded.
-#[derive(Default)]
-pub(crate) struct EcjIdDecoder {
-    ids: HashSet<NeedleId>,
-    partial: [u8; NEEDLE_ID_SIZE],
-    pending: usize,
-}
-
-impl EcjIdDecoder {
-    pub(crate) fn push(&mut self, mut bytes: &[u8]) {
-        if self.pending > 0 {
-            let n = (NEEDLE_ID_SIZE - self.pending).min(bytes.len());
-            self.partial[self.pending..self.pending + n].copy_from_slice(&bytes[..n]);
-            self.pending += n;
-            bytes = &bytes[n..];
-            if self.pending < NEEDLE_ID_SIZE {
-                return;
-            }
-            self.ids.insert(NeedleId::from_bytes(&self.partial));
-            self.pending = 0;
-        }
-        let mut records = bytes.chunks_exact(NEEDLE_ID_SIZE);
-        for record in &mut records {
-            self.ids.insert(NeedleId::from_bytes(record));
-        }
-        let rest = records.remainder();
-        self.partial[..rest.len()].copy_from_slice(rest);
-        self.pending = rest.len();
-    }
-
-    pub(crate) fn into_ids(self) -> HashSet<NeedleId> {
-        self.ids
-    }
-}
-
-/// Read the distinct ids of the journal at `path` in bounded chunks. A missing
-/// file reads as empty. Also returns the whole-record length read; a torn
-/// trailing partial record is excluded from it.
-pub(crate) fn read_ecj_ids(path: &str) -> io::Result<(HashSet<NeedleId>, u64)> {
-    let mut file = match fs::File::open(path) {
-        Ok(f) => f,
-        Err(e) if e.kind() == io::ErrorKind::NotFound => return Ok((HashSet::new(), 0)),
-        Err(e) => return Err(e),
-    };
-    let len = file.metadata()?.len();
-    let size = len - len % NEEDLE_ID_SIZE as u64;
-    let mut decoder = EcjIdDecoder::default();
-    let mut buf = vec![0u8; (ECJ_READ_CHUNK_BYTES as u64).min(size) as usize];
-    let mut off = 0u64;
-    while off < size {
-        let want = (buf.len() as u64).min(size - off) as usize;
-        file.read_exact(&mut buf[..want])?;
-        decoder.push(&buf[..want]);
-        off += want as u64;
-    }
-    Ok((decoder.into_ids(), size))
-}
-
-/// The ids of `incoming` that `has` does not report, ascending, so a merge
-/// appends deterministic output.
-pub(crate) fn ecj_delta(
-    incoming: &HashSet<NeedleId>,
-    has: impl Fn(&NeedleId) -> bool,
-) -> Vec<NeedleId> {
-    let mut delta: Vec<NeedleId> = incoming.iter().copied().filter(|id| !has(id)).collect();
-    delta.sort_unstable();
-    delta
-}
-
-pub(crate) fn encode_ecj_ids(ids: &[NeedleId]) -> Vec<u8> {
-    let mut buf = vec![0u8; ids.len() * NEEDLE_ID_SIZE];
-    for (record, id) in buf.chunks_exact_mut(NEEDLE_ID_SIZE).zip(ids) {
-        id.to_bytes(record);
-    }
-    buf
-}
-
-/// Append to the journal at `path` the ids of `incoming` that `local` lacks,
-/// in one write and one fsync, returning how many were added. `local` and
-/// `size` come from [`read_ecj_ids`] on the same path: if the journal's
-/// whole-record length is no longer `size`, returns `Ok(None)` so the caller
-/// re-reads. A torn tail past `size` is truncated first so the new records
-/// stay aligned.
-pub(crate) fn append_ecj_ids(
-    path: &str,
-    local: &HashSet<NeedleId>,
-    incoming: &HashSet<NeedleId>,
-    size: u64,
-) -> io::Result<Option<usize>> {
-    let delta = ecj_delta(incoming, |id| local.contains(id));
-    if delta.is_empty() {
-        return Ok(Some(0));
-    }
-    let created = !Path::new(path).exists();
-    let mut file = open_volume_file(OpenOptions::new().read(true).write(true).create(true), path)?;
-    let len = file.metadata()?.len();
-    if len - len % NEEDLE_ID_SIZE as u64 != size {
-        return Ok(None);
-    }
-    if len != size {
-        file.set_len(size)?;
-    }
-    let appended = file
-        .seek(SeekFrom::Start(size))
-        .and_then(|_| file.write_all(&encode_ecj_ids(&delta)))
-        .and_then(|_| file.sync_all());
-    if let Err(e) = appended {
-        let _ = file.set_len(size);
-        return Err(e);
-    }
-    if created {
-        fsync_dir(path)?;
-    }
-    Ok(Some(delta.len()))
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    fn ids(v: &[u64]) -> HashSet<NeedleId> {
-        v.iter().map(|&id| NeedleId(id)).collect()
-    }
-
-    fn bytes(v: &[u64]) -> Vec<u8> {
-        encode_ecj_ids(&v.iter().map(|&id| NeedleId(id)).collect::<Vec<_>>())
-    }
-
-    fn records(path: &str) -> Vec<u64> {
-        let data = fs::read(path).expect("read ecj");
-        assert_eq!(data.len() % NEEDLE_ID_SIZE, 0, "journal must stay aligned");
-        data.chunks_exact(NEEDLE_ID_SIZE)
-            .map(|c| NeedleId::from_bytes(c).0)
-            .collect()
-    }
-
-    /// Run the unmounted merge the way the server does: read, then append.
-    fn merge_file(path: &str, incoming: &HashSet<NeedleId>) -> usize {
-        let (local, size) = read_ecj_ids(path).expect("read");
-        append_ecj_ids(path, &local, incoming, size)
-            .expect("append")
-            .expect("journal unchanged")
-    }
-
-    #[test]
-    fn decoder_handles_records_split_across_chunks() {
-        let mut stream = bytes(&[1, 2, 3, 2, 0x0102030405060708]);
-        stream.extend_from_slice(&[9, 9, 9]);
-        for chunk in 1..=stream.len() {
-            let mut d = EcjIdDecoder::default();
-            for piece in stream.chunks(chunk) {
-                d.push(piece);
-            }
-            assert_eq!(
-                d.into_ids(),
-                ids(&[1, 2, 3, 0x0102030405060708]),
-                "chunk {}",
-                chunk
-            );
-        }
-    }
-
-    #[test]
-    fn read_ecj_ids_dedups_and_ignores_torn_tail() {
-        let dir = tempfile::tempdir().expect("tempdir");
-        let missing = dir.path().join("missing.ecj");
-        let (got, size) = read_ecj_ids(missing.to_str().unwrap()).expect("read");
-        assert!(got.is_empty());
-        assert_eq!(size, 0);
-
-        let torn = dir.path().join("torn.ecj");
-        let mut data = bytes(&[1, 2, 1]);
-        data.extend_from_slice(&[7, 7, 7]);
-        fs::write(&torn, data).unwrap();
-        let (got, size) = read_ecj_ids(torn.to_str().unwrap()).expect("read");
-        assert_eq!(got, ids(&[1, 2]));
-        assert_eq!(size, 3 * NEEDLE_ID_SIZE as u64);
-
-        // A bloated journal repeating a few ids across several read chunks
-        // keeps only the distinct ids.
-        let bloated = dir.path().join("bloated.ecj");
-        let data: Vec<u8> = (0..300_000u64).flat_map(|i| bytes(&[i % 3])).collect();
-        fs::write(&bloated, &data).unwrap();
-        let (got, size) = read_ecj_ids(bloated.to_str().unwrap()).expect("read");
-        assert_eq!(got, ids(&[0, 1, 2]));
-        assert_eq!(size, data.len() as u64);
-    }
-
-    #[test]
-    fn appends_only_missing_ids() {
-        let dir = tempfile::tempdir().expect("tempdir");
-        let path = dir.path().join("vol.ecj");
-        let path = path.to_str().unwrap();
-        fs::write(path, bytes(&[1, 2, 3])).unwrap();
-        assert_eq!(merge_file(path, &ids(&[3, 4])), 1);
-        assert_eq!(records(path), vec![1, 2, 3, 4]);
-    }
-
-    #[test]
-    fn round_trip_stays_constant() {
-        // A->B->A->B 20 times: the old append path doubled the journal each trip.
-        let dir = tempfile::tempdir().expect("tempdir");
-        let a = dir.path().join("a.ecj");
-        let b = dir.path().join("b.ecj");
-        let (a, b) = (a.to_str().unwrap(), b.to_str().unwrap());
-        fs::write(a, bytes(&[1, 2])).unwrap();
-        fs::write(b, bytes(&[2, 3])).unwrap();
-        for i in 0..20 {
-            let (src, dst) = if i % 2 == 0 { (a, b) } else { (b, a) };
-            let (incoming, _) = read_ecj_ids(src).expect("read");
-            merge_file(dst, &incoming);
-        }
-        for path in [a, b] {
-            let mut got = records(path);
-            got.sort_unstable();
-            assert_eq!(got, vec![1, 2, 3]);
-        }
-    }
-
-    #[test]
-    fn nothing_new_leaves_journal_alone() {
-        let dir = tempfile::tempdir().expect("tempdir");
-        let missing = dir.path().join("missing.ecj");
-        assert_eq!(merge_file(missing.to_str().unwrap(), &ids(&[])), 0);
-        assert!(
-            !missing.exists(),
-            "an empty merge must not create a journal"
-        );
-
-        let path = dir.path().join("vol.ecj");
-        let path = path.to_str().unwrap();
-        fs::write(path, bytes(&[1, 2])).unwrap();
-        assert_eq!(merge_file(path, &ids(&[2, 1])), 0);
-        assert_eq!(records(path), vec![1, 2]);
-    }
-
-    #[test]
-    fn repairs_torn_tail() {
-        let dir = tempfile::tempdir().expect("tempdir");
-        let path = dir.path().join("vol.ecj");
-        let path = path.to_str().unwrap();
-        let mut data = bytes(&[1, 2]);
-        data.extend_from_slice(&[9, 9, 9]);
-        fs::write(path, data).unwrap();
-        assert_eq!(merge_file(path, &ids(&[3])), 1);
-        assert_eq!(records(path), vec![1, 2, 3]);
-    }
-
-    #[test]
-    fn rejects_changed_journal() {
-        let dir = tempfile::tempdir().expect("tempdir");
-        let path = dir.path().join("vol.ecj");
-        let path = path.to_str().unwrap();
-        fs::write(path, bytes(&[1])).unwrap();
-        let (local, size) = read_ecj_ids(path).expect("read");
-        fs::write(path, bytes(&[1, 5])).unwrap();
-        let outcome = append_ecj_ids(path, &local, &ids(&[2]), size).expect("append");
-        assert_eq!(outcome, None);
-        assert_eq!(records(path), vec![1, 5]);
-    }
-}

seaweed-volume/src/storage/erasure_coding/ecj_registry.rs

@@ -1,326 +0,0 @@
-//! Process-wide coordination of everything that touches one `.ecj` path.
-//!
-//! Mount-time compaction replaces a deletion journal with a new inode. That is
-//! only safe while nothing else in this process can write the old one:
-//!
-//! - **Holders** are mounted `EcVolume`s with an append handle on the path. A
-//!   store holds one `EcVolume` per disk location, and a shard mount or a
-//!   cross-disk reconcile can point one disk's volume at another disk's
-//!   `.ecj`, so several holders of one path are normal. A holder that keeps
-//!   appending to a replaced inode acknowledges deletes that are gone at the
-//!   next mount.
-//! - **Writers** append to or replace the path by name without holding it
-//!   open across calls: `ReceiveFile` of an EC `.ecj`, and the unmounted
-//!   append in `merge_ec_journal`, which `VolumeEcShardsCopy` and EC index
-//!   recovery funnel a peer's journal through. Bytes they write after the
-//!   compactor sized the journal would be dropped by the rename.
-//!
-//! Compaction therefore runs only while its caller is the sole holder and no
-//! writer is active, and while it runs no holder may open the path and no
-//! writer may start. Both wait instead; a compaction rewrites only the distinct
-//! id set, so the wait is short.
-//!
-//! No writer active at the reservation is not enough: one that ran while the
-//! holder loaded the journal, or after, and has finished may have rewritten it
-//! in place to the same length (`ReceiveFile` truncates and refills), which
-//! the inode-and-size re-check cannot see. So each writer bumps the path's
-//! write generation as it starts, and a holder may compact only if no writer
-//! was active when it registered and the generation has not moved since.
-//!
-//! Paths are keyed by their canonical parent directory, so two disk locations
-//! that spell one directory differently still meet here.
-
-use std::collections::HashMap;
-use std::path::{Path, PathBuf};
-use std::sync::{Condvar, LazyLock, Mutex, MutexGuard};
-
-#[derive(Default)]
-struct PathState {
-    holders: usize,
-    writers: usize,
-    compacting: bool,
-    /// Writers that have started on the path. Lives as long as the entry,
-    /// which a registered holder keeps.
-    write_gen: u64,
-}
-
-impl PathState {
-    fn idle(&self) -> bool {
-        self.holders == 0 && self.writers == 0 && !self.compacting
-    }
-}
-
-struct Registry {
-    paths: Mutex<HashMap<PathBuf, PathState>>,
-    changed: Condvar,
-}
-
-static REGISTRY: LazyLock<Registry> = LazyLock::new(|| Registry {
-    paths: Mutex::new(HashMap::new()),
-    changed: Condvar::new(),
-});
-
-fn lock() -> MutexGuard<'static, HashMap<PathBuf, PathState>> {
-    // The critical sections only adjust counters and cannot panic midway, so
-    // a poisoned lock still guards consistent state.
-    REGISTRY.paths.lock().unwrap_or_else(|e| e.into_inner())
-}
-
-/// Canonical key for `path`: its resolved parent directory joined with the
-/// file name. The file itself may not exist yet (a copy creates it), so only
-/// the directory is resolved.
-fn key_for(path: &str) -> PathBuf {
-    let p = Path::new(path);
-    let (Some(parent), Some(name)) = (p.parent(), p.file_name()) else {
-        return std::path::absolute(p).unwrap_or_else(|_| p.to_path_buf());
-    };
-    let parent = if parent.as_os_str().is_empty() {
-        Path::new(".")
-    } else {
-        parent
-    };
-    let dir = std::fs::canonicalize(parent)
-        .or_else(|_| std::path::absolute(parent))
-        .unwrap_or_else(|_| parent.to_path_buf());
-    dir.join(name)
-}
-
-/// Block until no compaction is running on `key`, then apply `f` to its state.
-fn update_when_not_compacting<R>(key: &Path, f: impl FnOnce(&mut PathState) -> R) -> R {
-    let mut paths = lock();
-    while paths.get(key).is_some_and(|s| s.compacting) {
-        paths = REGISTRY
-            .changed
-            .wait(paths)
-            .unwrap_or_else(|e| e.into_inner());
-    }
-    f(paths.entry(key.to_path_buf()).or_default())
-}
-
-fn release(key: &Path, f: impl FnOnce(&mut PathState)) {
-    let mut paths = lock();
-    if let Some(state) = paths.get_mut(key) {
-        f(state);
-        if state.idle() {
-            paths.remove(key);
-        }
-    }
-    drop(paths);
-    REGISTRY.changed.notify_all();
-}
-
-/// A mounted `EcVolume`'s registration as a holder of its `.ecj`. Taken before
-/// the journal is opened and released when dropped.
-pub(crate) struct EcjHold {
-    key: PathBuf,
-    /// The path's write generation when the hold was taken, and whether a
-    /// writer was active then. Taken before the journal is opened and loaded,
-    /// so they cover every write the load might have missed.
-    write_gen: u64,
-    writer_at_start: bool,
-}
-
-impl EcjHold {
-    /// Register as a holder of `ecj_path`, first waiting out any compaction in
-    /// progress so the handle opened afterwards is on the final inode.
-    pub(crate) fn acquire(ecj_path: &str) -> Self {
-        let key = key_for(ecj_path);
-        let (write_gen, writer_at_start) = update_when_not_compacting(&key, |s| {
-            s.holders += 1;
-            (s.write_gen, s.writers > 0)
-        });
-        EcjHold {
-            key,
-            write_gen,
-            writer_at_start,
-        }
-    }
-
-    /// Reserve the path for a compaction, or `None` when another holder or an
-    /// active writer could still reach the current inode, or when a writer
-    /// has run on the path since the hold was taken, so the journal may no
-    /// longer be what the holder loaded.
-    pub(crate) fn try_begin_compaction(&self) -> Option<EcjCompaction> {
-        let mut paths = lock();
-        let state = paths.get_mut(&self.key)?;
-        if state.holders != 1 || state.writers != 0 || state.compacting {
-            return None;
-        }
-        if self.writer_at_start || state.write_gen != self.write_gen {
-            return None;
-        }
-        state.compacting = true;
-        Some(EcjCompaction {
-            key: self.key.clone(),
-        })
-    }
-}
-
-impl Drop for EcjHold {
-    fn drop(&mut self) {
-        release(&self.key, |s| s.holders = s.holders.saturating_sub(1));
-    }
-}
-
-/// An exclusive reservation of a `.ecj` path for compaction. Holders and
-/// writers wait until it is dropped.
-pub(crate) struct EcjCompaction {
-    key: PathBuf,
-}
-
-impl Drop for EcjCompaction {
-    fn drop(&mut self) {
-        release(&self.key, |s| s.compacting = false);
-    }
-}
-
-/// An out-of-band writer (shard copy, index recovery, `ReceiveFile`) on a
-/// `.ecj` path.
-/// Compaction does not start while one is alive.
-pub(crate) struct EcjWrite {
-    key: PathBuf,
-}
-
-impl Drop for EcjWrite {
-    fn drop(&mut self) {
-        release(&self.key, |s| s.writers = s.writers.saturating_sub(1));
-    }
-}
-
-/// Register as a writer of `ecj_path`, waiting out any compaction in progress.
-/// Blocks; async callers use [`begin_ecj_write_async`].
-pub(crate) fn begin_ecj_write(ecj_path: &str) -> EcjWrite {
-    let key = key_for(ecj_path);
-    update_when_not_compacting(&key, |s| {
-        s.writers += 1;
-        s.write_gen += 1;
-    });
-    EcjWrite { key }
-}
-
-/// [`begin_ecj_write`] for async handlers: the wait runs on the blocking pool
-/// so a compaction in progress never stalls a runtime worker.
-pub(crate) async fn begin_ecj_write_async(ecj_path: &str) -> EcjWrite {
-    let path = ecj_path.to_string();
-    match tokio::task::spawn_blocking(move || begin_ecj_write(&path)).await {
-        Ok(write) => write,
-        // Only a panic inside the registry lands here, and it leaves no count
-        // behind; registering inline is still correct, merely blocking.
-        Err(_) => begin_ecj_write(ecj_path),
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use std::sync::mpsc;
-    use std::time::Duration;
-    use tempfile::TempDir;
-
-    fn ecj(dir: &TempDir) -> String {
-        dir.path().join("1.ecj").to_str().unwrap().to_string()
-    }
-
-    #[test]
-    fn sole_holder_may_compact() {
-        let dir = TempDir::new().unwrap();
-        let hold = EcjHold::acquire(&ecj(&dir));
-        assert!(hold.try_begin_compaction().is_some());
-    }
-
-    #[test]
-    fn second_holder_blocks_compaction() {
-        let dir = TempDir::new().unwrap();
-        let a = EcjHold::acquire(&ecj(&dir));
-        let b = EcjHold::acquire(&ecj(&dir));
-        assert!(a.try_begin_compaction().is_none());
-        drop(b);
-        assert!(a.try_begin_compaction().is_some());
-    }
-
-    #[test]
-    fn active_writer_blocks_compaction() {
-        let dir = TempDir::new().unwrap();
-        let hold = EcjHold::acquire(&ecj(&dir));
-        let w = begin_ecj_write(&ecj(&dir));
-        assert!(hold.try_begin_compaction().is_none());
-        drop(w);
-        // This hold loaded before the write; a later one may compact.
-        drop(hold);
-        let hold = EcjHold::acquire(&ecj(&dir));
-        assert!(hold.try_begin_compaction().is_some());
-    }
-
-    /// A writer that ran after the hold was taken, or was already running
-    /// then, may have changed the journal the holder loaded, even though it
-    /// has finished by the time compaction asks.
-    #[test]
-    fn finished_writer_since_hold_blocks_compaction() {
-        let dir = TempDir::new().unwrap();
-        let path = ecj(&dir);
-
-        let hold = EcjHold::acquire(&path);
-        drop(begin_ecj_write(&path));
-        assert!(
-            hold.try_begin_compaction().is_none(),
-            "a writer that started after the hold",
-        );
-        drop(hold);
-
-        let w = begin_ecj_write(&path);
-        let hold = EcjHold::acquire(&path);
-        drop(w);
-        assert!(
-            hold.try_begin_compaction().is_none(),
-            "a writer active when the hold was taken",
-        );
-        drop(hold);
-
-        let hold = EcjHold::acquire(&path);
-        assert!(
-            hold.try_begin_compaction().is_some(),
-            "no writer since the hold",
-        );
-    }
-
-    #[test]
-    fn differently_spelled_paths_share_one_key() {
-        let dir = TempDir::new().unwrap();
-        std::fs::create_dir(dir.path().join("sub")).unwrap();
-        let plain = ecj(&dir);
-        let dotted = dir
-            .path()
-            .join("sub")
-            .join("..")
-            .join("1.ecj")
-            .to_str()
-            .unwrap()
-            .to_string();
-        let a = EcjHold::acquire(&plain);
-        let _b = EcjHold::acquire(&dotted);
-        assert!(a.try_begin_compaction().is_none());
-    }
-
-    #[test]
-    fn writer_waits_for_compaction_to_finish() {
-        let dir = TempDir::new().unwrap();
-        let path = ecj(&dir);
-        let hold = EcjHold::acquire(&path);
-        let compaction = hold.try_begin_compaction().unwrap();
-
-        let (tx, rx) = mpsc::channel();
-        let p = path.clone();
-        let t = std::thread::spawn(move || {
-            let _w = begin_ecj_write(&p);
-            tx.send(()).unwrap();
-        });
-        assert!(
-            rx.recv_timeout(Duration::from_millis(100)).is_err(),
-            "a writer must not start while a compaction holds the path",
-        );
-        drop(compaction);
-        rx.recv_timeout(Duration::from_secs(5))
-            .expect("writer must proceed once the compaction ends");
-        t.join().unwrap();
-    }
-}

seaweed-volume/src/storage/erasure_coding/mod.rs

@@ -9,8 +9,6 @@ pub mod ec_encoder;
 pub mod ec_locate;
 pub mod ec_shard;
 pub mod ec_volume;
-pub mod ecj_merge;
-pub(crate) mod ecj_registry;
 
 pub use ec_shard::{
     DATA_SHARDS_COUNT, EcVolumeShard, MAX_SHARD_COUNT, MIN_TOTAL_DISKS, PARITY_SHARDS_COUNT,

seaweed-volume/src/storage/idx/mod.rs

@@ -21,26 +21,12 @@ where
     let mut buf = vec![0u8; NEEDLE_MAP_ENTRY_SIZE * ROWS_TO_READ];
 
     loop {
-        // Fill the batch before decoding: `read` may return a count that is
-        // not a multiple of the entry size, and a split entry would misalign
-        // every later row. Go is immune: `ReadAt` fills or errors.
-        let mut count = 0;
-        let mut eof = false;
-        while count < buf.len() {
-            match reader.read(&mut buf[count..]) {
-                Ok(0) => {
-                    eof = true;
-                    break;
-                }
-                Ok(n) => count += n,
-                Err(ref e) if e.kind() == io::ErrorKind::Interrupted => continue,
-                Err(ref e) if e.kind() == io::ErrorKind::UnexpectedEof => {
-                    eof = true;
-                    break;
-                }
-                Err(e) => return Err(e),
-            }
-        }
+        let count = match reader.read(&mut buf) {
+            Ok(0) => return Ok(()),
+            Ok(n) => n,
+            Err(ref e) if e.kind() == io::ErrorKind::UnexpectedEof => return Ok(()),
+            Err(e) => return Err(e),
+        };
 
         let mut i = 0;
         while i + NEEDLE_MAP_ENTRY_SIZE <= count {
@@ -48,11 +34,6 @@ where
             f(key, offset, size)?;
             i += NEEDLE_MAP_ENTRY_SIZE;
         }
-
-        // A trailing partial entry at EOF is ignored, as Go does on `io.EOF`.
-        if eof {
-            return Ok(());
-        }
     }
 }
 
@@ -196,111 +177,6 @@ mod tests {
         data
     }
 
-    /// Reader that hands back at most `chunk` bytes per `read`. 7 is coprime
-    /// with the 17-byte entry size, so nearly every read ends mid-entry. With
-    /// `interrupts`, every other call fails with `ErrorKind::Interrupted`.
-    struct ShortReader {
-        inner: Cursor<Vec<u8>>,
-        chunk: usize,
-        interrupts: bool,
-        interrupt_next: bool,
-    }
-
-    impl ShortReader {
-        fn new(data: Vec<u8>, interrupts: bool) -> Self {
-            ShortReader {
-                inner: Cursor::new(data),
-                chunk: 7,
-                interrupts,
-                interrupt_next: false,
-            }
-        }
-    }
-
-    impl Read for ShortReader {
-        fn read(&mut self, buf: &mut [u8]) -> io::Result<usize> {
-            if self.interrupt_next {
-                self.interrupt_next = false;
-                return Err(io::Error::from(io::ErrorKind::Interrupted));
-            }
-            self.interrupt_next = self.interrupts;
-            let n = buf.len().min(self.chunk);
-            self.inner.read(&mut buf[..n])
-        }
-    }
-
-    impl Seek for ShortReader {
-        fn seek(&mut self, pos: SeekFrom) -> io::Result<u64> {
-            self.inner.seek(pos)
-        }
-    }
-
-    fn walk_all<R: Read + Seek>(reader: &mut R, start_from: u64) -> Vec<(NeedleId, i64, Size)> {
-        let mut collected = Vec::new();
-        walk_index_file(reader, start_from, |key, offset, size| {
-            collected.push((key, offset.to_actual_offset(), size));
-            Ok(())
-        })
-        .unwrap();
-        collected
-    }
-
-    /// More than one ROWS_TO_READ batch, so the walk crosses a buffer refill.
-    fn many_entries() -> Vec<(NeedleId, Offset, Size)> {
-        (0..(ROWS_TO_READ as u64 * 2 + 37))
-            .map(|i| {
-                (
-                    NeedleId(i * 7 + 1),
-                    Offset::from_actual_offset(i as i64 * 128),
-                    Size(i as i32 + 1),
-                )
-            })
-            .collect()
-    }
-
-    #[test]
-    fn test_walk_index_file_short_reads_keep_alignment() {
-        let data = idx_bytes(&many_entries());
-        let expected = walk_all(&mut Cursor::new(data.clone()), 0);
-        assert_eq!(expected.len(), ROWS_TO_READ * 2 + 37);
-
-        let mut short = ShortReader::new(data, false);
-        assert_eq!(walk_all(&mut short, 0), expected);
-    }
-
-    #[test]
-    fn test_walk_index_file_retries_interrupted_reads() {
-        let data = idx_bytes(&many_entries());
-        let expected = walk_all(&mut Cursor::new(data.clone()), 0);
-
-        let mut short = ShortReader::new(data, true);
-        assert_eq!(walk_all(&mut short, 0), expected);
-    }
-
-    #[test]
-    fn test_walk_index_file_short_reads_start_from() {
-        let data = idx_bytes(&many_entries());
-        let expected = walk_all(&mut Cursor::new(data.clone()), 0);
-
-        let start = ROWS_TO_READ as u64 + 5;
-        let mut short = ShortReader::new(data, false);
-        assert_eq!(walk_all(&mut short, start), expected[start as usize..]);
-    }
-
-    #[test]
-    fn test_walk_index_file_ignores_trailing_partial_entry() {
-        // A torn final entry is dropped without an error, as Go does on io.EOF.
-        let entries = many_entries();
-        let mut data = idx_bytes(&entries);
-        data.extend_from_slice(&[0xAB; NEEDLE_MAP_ENTRY_SIZE - 1]);
-
-        let expected = walk_all(&mut Cursor::new(idx_bytes(&entries)), 0);
-        assert_eq!(walk_all(&mut Cursor::new(data.clone()), 0), expected);
-
-        let mut short = ShortReader::new(data, false);
-        assert_eq!(walk_all(&mut short, 0), expected);
-    }
-
     #[test]
     fn test_check_index_file_clean() {
         let data = idx_bytes(&[